No card data
Payment details are collected in a provider-hosted secure interface.
SECURE PAYMENT FOUNDATION
A controlled architecture that keeps card data off the site.
The technical foundation for EKBE checkout is ready. Live transactions will open only after a verified provider account and server-side signature validation are complete.
Security boundary
The browser submits product selection only.
Card number, expiry date and CVV are never entered on EKBE static pages. Once enabled, the payment session is created through a secure same-origin API.
No exposed secrets
API keys and signing secrets never appear in browser JavaScript.
Signature validation
Results and callbacks are processed only after server verification.
Safe redirect
Navigation is restricted to explicitly allowed HTTPS provider hosts.
TARGET FLOW
Five verifiable steps.
Payment success is confirmed by a signed server callback, never by a browser redirect alone.
- 01Product selection
Browser sends product ID and language only.
- 02Server session
Worker verifies price and signs the provider request.
- 03Hosted payment
Card data is entered in the provider interface.
- 04Callback
Provider reports the result to the server.
- 05Verify and fulfil
Signature and amount are checked before fulfilment.
PROVIDER READINESS
Connect after commercial onboarding.
The adapter is prepared for server-session models such as iyzico Checkout Form or PayTR iFrame. The final provider is selected only after merchant approval, contract, fees and technical credentials are verified.
Activation checklist
- Approved merchant account
- API credentials stored as Worker secrets
- Live callback and return URLs
- Signature, amount and order-ID validation
- Refund and failed-payment scenarios
- Low-value end-to-end live test
Payment today
Sales continue without adding risk.
Until EKBE checkout is enabled, the 250 live products continue to use their verified Shopier links. The 758 prepared products are never shown as purchasable without a verified sales link.