Hand off to Checkout

Give the buyer nextAction.url as a link or QR, exactly as returned by payments.create:

import { createTimbroPayments } from "@timbro/payments";

const secretKey = process.env.TIMBRO_PAYMENTS_SECRET_KEY;
if (!secretKey) throw new Error("Missing TIMBRO_PAYMENTS_SECRET_KEY");
const timbro = createTimbroPayments({ secretKey });
const payment = await timbro.payments.create({
  idempotencyKey: "create-order-123",
  saleReference: "order-123",
  amount: { currency: "DOP", minorUnits: 125_000 },
  description: "Maintenance service",
  fiscalDocument: null,
});
const checkoutUrl = payment.nextAction?.url;
if (!checkoutUrl) throw new Error("Payment has no Checkout action");

Checkout displays the merchant identity from server records, scopes the session to the payment, and allows guest payment when the flow supports it. Open the URL in a top-level browsing context and retain payment.id for retrieval.

Never put PAN, CVC, credentials, or provider tokens in a URL. Checkout owns the payer experience; your system keeps the reference and queries status server-side.

Do not treat the browser return as authorization. Your server retrieves GET /v1/payments/{paymentId} and waits for a terminal state before fulfillment; verifying requires reconciliation.