# Integration steps

A Cashier integration has two halves: your **backend** creates a session, and your **frontend** opens it. Follow these steps in order.

## 1. Get an access token (backend)

Exchange your Client ID and Client Secret for an access token at the [token endpoint](/guides/base-urls). Keep credentials in environment variables.

**cURL**

```bash
curl -X POST "https://sso.omno.com/realms/omno/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=$OMNO_CLIENT_ID" \
  -d "client_secret=$OMNO_CLIENT_SECRET"
```

## 2. Create a session (backend)

Call `POST /v3/public/cashier/session` with the access token. The response includes `sessionId` and the Cashier `token`.

**Node (fetch)**

```javascript
const res = await fetch("https://api.omno.com/v3/public/cashier/session", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${accessToken}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    currency: "EUR",
    paymentTypes: ["CARD", "APM", "CRYPTO"],
    customer: { externalUserId: "3183818381183" },
  }),
});
const { sessionId, token } = await res.json();
```

**Python (requests)**

```python
res = requests.post(
    "https://api.omno.com/v3/public/cashier/session",
    headers={"Authorization": f"Bearer {access_token}"},
    json={
        "currency": "EUR",
        "paymentTypes": ["CARD", "APM", "CRYPTO"],
        "customer": {"externalUserId": "3183818381183"},
    },
)
data = res.json()  # data["sessionId"], data["token"]
```

**PHP**

```php
$res = $client->post("https://api.omno.com/v3/public/cashier/session", [
  "headers" => ["Authorization" => "Bearer {$accessToken}"],
  "json" => [
    "currency" => "EUR",
    "paymentTypes" => ["CARD", "APM", "CRYPTO"],
    "customer" => ["externalUserId" => "3183818381183"],
  ],
]);
$data = json_decode($res->getBody(), true); // $data["sessionId"], $data["token"]
```

**cURL**

```bash
curl -X POST "https://api.omno.com/v3/public/cashier/session" \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -d '{"currency":"EUR","paymentTypes":["CARD","APM","CRYPTO"],"customer":{"externalUserId":"3183818381183"}}'
```

Create the session **right before** you open the Cashier (for example when the player clicks Deposit) — it expires 15 minutes after creation. See [Session & token](/cashier/session-and-token).

## 3. Hand off to your frontend

Return `{ sessionId, token }` to your frontend over **your own authenticated endpoint**. Never create sessions from the browser, and never log the token.

## 4. Install and initialise the SDK (frontend)

```bash
npm install @omno-payment/checkout-js
```

```typescript
import CashierSDK, { CashierEmitEvent } from "@omno-payment/checkout-js";

const cashier = new CashierSDK({ baseUrl: "https://checkout.omno.com" });
```

Use the checkout domain Omno assigned to your account as `baseUrl` (default `https://checkout.omno.com`).

## 5. Register events (frontend)

```typescript
cashier.on(CashierEmitEvent.PAYMENT_SUCCESS, (data) => {/* UI only */});
cashier.on(CashierEmitEvent.PAYMENT_FAILED, (data) => {/* UI only */});
cashier.on(CashierEmitEvent.PAYMENT_PENDING, (data) => {/* UI only */});
```

## 6. Open the Cashier (frontend)

```typescript
cashier.open({ sessionId, token }); // sessionId and token from your backend
```

## 7. Handle expiry

If the session expires, the Cashier shows a session-expired screen. Create a **new** session on your backend and call `open()` again with the new `sessionId` and `token`.

## 8. Reconcile by webhook, then GET

Credit or debit balances only after a [webhook](/guides/concepts/webhooks) (or a GET on the transaction) confirms the final status.

> ⛔ **Never**
- Never create a session in the browser — always server-side.
- Never log or store the Cashier `token`.
- Never credit/debit a balance from an SDK event or a redirect — use the webhook or a GET.
- Never open the Cashier without the `token`.



## Build it →

- [Session & token](/cashier/session-and-token) · [Open without the SDK](/cashier/hosted-url) · [Web SDK → Events](/cashier/sdk/events)