Every Omno integration follows the same shape: your backend authenticates, creates a transaction (or a Cashier session) on the /v3/public/... API, the customer pays, Omno picks a suitable provider, and a webhook delivers the authoritative outcome.
The two tokens
Omno uses two different tokens — don't mix them up:
API access token — a server-side OAuth 2.0 bearer token from the token endpoint. Your backend sends it on every /v3/public/... call. Short-lived (expires_in is about 300 seconds).
Cashier token — a per-session JWT returned when you create a Cashier session. The frontend passes it to the Web SDK to open that one session. It is mandatory for the Cashier and expires with the session (15 minutes). See Sessions & tokens.
What to rely on
The customer's browser shows a result and the SDK emits events, but neither is authoritative — a tab can close and a message can be lost or spoofed. Credit or debit a balance only after a webhook or a GET on the transaction confirms the final status.