---
title: "Create a Stripe-hosted Checkout Session"
method: POST
path: "/billing/checkout-sessions"
tags: ["Billing"]
---

# Create a Stripe-hosted Checkout Session

`POST /billing/checkout-sessions`

## Request

- Base URL: `https://api.flashdata.dev/v2`
- URL: `https://api.flashdata.dev/v2/billing/checkout-sessions`
- Auth: API key in cookie `__Host-fd_session` and API key in header `X-CSRF-Token`

Subscriptions and published credit packs use priceId. A custom top-up uses amountMinor instead (USD cents, $10 to $999,999.99); the server calculates credits at the fixed credit value and creates a private one-time Stripe price. Product, provider price, currency, success URL and cancel URL are never accepted from the browser. Credits are granted only after a verified paid event for the quoted amount.

## Headers

- `Idempotency-Key` string, required

## Request body

- union
  - object
    - `priceId` string, required
    - `purchaseType` 'subscription' | 'top_up'
  - object
    - `amountMinor` integer, required: Custom top-up amount in USD cents.
    - `purchaseType` 'top_up', required

## Response `201`

Stripe Checkout Session

- HostedSession
  - `id` string, required
  - `url` string, uri, required: Provider-hosted HTTPS URL on a Stripe-controlled *.stripe.com host. Web clients must validate the origin and redirect from a server-only boundary.
  - `expiresAt` string, date-time, required

## Other responses

- `401`: Authentication required or invalid
- `403`: Authenticated but not permitted, or CSRF validation failed
- `409`: Resource state or idempotency conflict
- `422`: Request validation failed
- `502`: An upstream provider failed
- `503`: The billing catalog or provider is not configured or is temporarily unavailable

---

[API](https://skmtc.dev/flashdata/apis/flashdata-customer-api.md) · [All operations](https://skmtc.dev/flashdata/apis/flashdata-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flashdata/apis/flashdata-customer-api/revisions/109179fe9313?raw)