---
title: "Prepare a cart and get a link to it"
method: POST
path: "/checkout/sessions"
tags: ["Checkout"]
---

# Prepare a cart and get a link to it

`POST /checkout/sessions`

## Request

- Base URL: `https://sitesplaced.com/api/v1`
- URL: `https://sitesplaced.com/api/v1/checkout/sessions`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Api-Key`

Secret or publishable key. Permission `checkout:write`. Send the shopper to `url`: the cart opens with those lines; prices, stock, payment methods and every checkout guard are SitesPlaced's own. Up to 50 lines. Unknown or archived products give 422. With a publishable key, `return_url` must be on the key's allowed websites. The link works for 24 hours.

## Request body

- CheckoutSessionRequest
  - `items` object[], required
    - `product_id` string, uuid, required
    - `quantity` integer
    - `variant` object
  - `return_url` string, uri: With a publishable key, this must be on the key's allowed websites.

## Response `201`

The prepared cart.

- CheckoutSession
  - `url` string, uri, required: Send the shopper here.
  - `token` string, required
  - `expires_at` string, date-time, required: ISO 8601, in UTC.

## Other responses

- `400`: `invalid_request`. The request is malformed or a field has a bad value; `param` names the field.
- `401`: `unauthorized`. The key is missing, wrong or revoked.
- `403`: `forbidden`. The key may not do this: a secret key sent from a browser, a publishable key from a website not on its list, the wrong kind of key, or a missing permission.
- `413`: `payload_too_large`. Bodies can be up to 1 MB.
- `422`: `unprocessable`.
- `429`: `rate_limited`. Wait for `Retry-After` seconds.
- `500`: `internal_error`.
- `503`: `unavailable`.

---

[API](https://skmtc.dev/sitesplaced/apis/sitesplaced-developer-api.md) · [All operations](https://skmtc.dev/sitesplaced/apis/sitesplaced-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sitesplaced/apis/sitesplaced-developer-api/revisions/66fbfbbaad1a?raw)