NFT Checkout Security Notes

• Create sessions only from the store backend after validating the order and price.
• Keep x-api-key and webhookSecret out of browser code, logs, and analytics.
• Send only checkoutId and its short-lived clientSecret to the storefront.
• Configure the exact HTTPS allowedOrigin for the storefront.
• Pass the expected Belong origin to isPaymentEvent and check the iframe source window.
• Never fulfill an order from a browser event. Verify the signed server webhook.
• Reuse a stable externalOrderId when retrying the same order. Use a new versioned order reference if the price or NFT snapshot changes.
• Expect duplicate webhook deliveries and process each event ID idempotently.
• Do not assume card funding is available. Enable thirdweb_card only for a merchant and network where Belong has confirmed it.
• Crossmint and Transak are not part of this checkout.