Checkout

The Pullup account owning the events and tickets being sold. Every key binds to exactly one creator — cross-creator access fails before anything else runs.

The thing being sold: title, schedule, venue, visibility, ticket inventory. Every checkout references exactly one event_id; foreign ids fail with 400. Your integration references the event when initiating POST /v1/session.

Priced inventory inside an event: name, price, currency, capacity, status. Pass ticket_id to sell a specific tier, or omit it and let the session resolve across available tiers — or inside Pay.

Event sections (VIP, general, early-bird gates). Divisions scope highlight reads and can scope ticket selection. A ticket belongs to at most one division.

The short-lived purchase attempt created by POST /v1/session: buyer intent, frozen event snapshot, your metadata, and the flow_url. Expires ten minutes after creation. Full contract in Sessions API.

Pricing, ticket types, form fields, and visibility frozen at initiation. Later event edits cannot alter an open session — the buyer journey stays consistent even mid-flow.

The buyer-facing URL for one purchase attempt. Hand it over with a full-page navigation; it is not a long-term purchase record.

Where the browser returns after checkout ends. Set at creation; omitted, the buyer lands on the Pullup event page. Distinct from callback_url, which routes webhooks. Both are display/routing knobs — only the webhook proves payment.

Initiates POST /v1/session on public or embeddable events within allowlisted origins. Cannot issue secrets, configure webhooks, or perform privileged actions. See Browser pattern.

Creates sessions, performs trusted reads, attaches sensitive metadata. Secret-key sessions skip reserved-key enforcement and visibility gates — that trust is why exposure means instant revocation. See Server pattern.

Verifies x-pullup-signature on every delivery. One per environment; never sent in requests. See Webhooks.

Pullup POSTing your server after terminal state changes. The only fulfillment-grade event is flow.session.success — verified first, always.

Once reached, never transitions again; further operations return 400 naming the lowercase state. Exact triggers in State machine; payloads in Webhooks.

Internal order, campaign, and customer ids echoed verbatim in every terminal webhook. Mapping only — never authorization, never secrets. Reserved keys and rules in Sessions API.

Tier identity and display name. Pass id as ticket_id to preselect; omit for buyer choice.

Lowest active price surfaces as the event price. Free tiers (price: 0) complete without payment intent through the identical lifecycle — never branch integration code on price.

remaining is capacity minus sold, or null for uncapped tiers. A tier counts as available only when status is ACTIVE and remaining is null or positive — the exact rule behind next_step derivation and the sold-out resolve errors.

Upper-cased tier state. Only ACTIVE tiers sell; anything else is display-only. Deactivation between creation and resolve produces Selected ticket is no longer available in this flow session.

Buyer-facing tier description lines. Render them at selection; they carry no enforcement semantics.

Per-order quantity policy enforced inside Pay. Your frontend may mirror it for UX, but Pay is authoritative.

Buyer inputs Pay collects itself. Collecting them too duplicates effort and confuses attribution — leave locked fields to Pay.

Discoverable and purchasable. The only visibility publishable keys can sell — browser checkouts require it (or embedding below).

Extends browser saleability to non-public events on approved surfaces. Checked alongside visibility at session creation; failure returns 400 Event is not publicly accessible.

Server pattern only. Browsers must never touch them — creation demands an sk_... key, and any publishable attempt fails closed.

Redirect returns forge, close, and replay. Only verified flow.session.success proves payment — every other signal is a display hint.

fl_... tokens are opaque Pay material. Parsing them couples you to an internal format; use session_id for every join.

Free events traverse the identical lifecycle. Price branches rot eventually — prove the free path in TEST instead.

Keys in logs, errors, and analytics exports become long-lived compromises. Redact P-Sec-Key values at the transport layer before they reach storage.

Client errors encode caller mistakes — resending repeats them. Change the request (or the key) instead.

One key for browser and server merges blast radii. Issue per-job keys with minimum products so revocation stays a non-event.

Buyer inputs Pay collects: {id, label, type, required} entries (e.g. full-name text, required). Rendered inside Pay — collecting them yourself duplicates effort and splits attribution.

{place, address, coordinates}, each nullable independently. A null location means an online or location-free event — never assume physical presence from a session.

Hero artwork reference when set, null otherwise. Display-grade only; never gate purchases on artwork presence.

Funnel counters (views, checkouts_started, checkouts_completed). Analytics telemetry for your dashboards — stale the moment after creation, so never gate logic on it.

Lowest active tier price in currency_code. Display anchor only; capture settles the tier price, not this rollup.

Settlement currency for the event (e.g. NGN). Mixed-currency events do not exist — one event, one currency, enforced at snapshot time.

Lowest active tier price. Display anchor for listings; capture settles the selected tier’s price, not this rollup.

Complete without payment intent through the identical lifecycle and webhook set. Integration code never branches on price — prove the free path in TEST like any paid path.

Browser session creation on public or embeddable events within allowlisted origins. P-Pub-Key or ?pPubKey=.

Session creation anywhere you own, trusted reads, sensitive metadata. P-Sec-Key only — no query fallback.

HMAC-SHA256 verification of every delivery. One per environment; never transmitted.

Join key for orders, fulfillment dedup, resolve calls, and delivery correlation. Stable for the session lifetime.

Pay pre-flight token, fl_ + 18 random chars. Single-purpose handoff material — never parsed, never stored beyond the redirect.

The event being sold. Scopes sessions and highlight reads to your creator account.

Preselected tier. Belongs to exactly one event; foreign ids fail creation.

Dashboard handle for list, update, reveal, and revoke. Never authenticates — only the full key value does.

Per-delivery handle in x-pullup-delivery-id, stable across retries. Dedup key alongside session_id.

Write session_id onto your order at creation, before redirect. Orders without session ids cannot correlate failures, redeliveries, or refunds.

Echoes your internal_user_id and order_ref back on every terminal event. Redundant by design — either join path survives the other’s corruption.

Record (event_type, session_id) before issuing tickets. The record doubles as the idempotency key and the audit trail for support tickets.

List the events your key owns — the same events checkout sells against. events.read scope. See Events API.

Surface event highlights — recaps, feeds, embeds — beside the box office. Same key model, moments.read scope. See Moments.

Signals and Media scopes issue today and enforce nothing yet. Attach them to keys now only in TEST; production promotion waits for runtime launch. See Preview.

Per-environment sessions, deliveries, and key usage. Feed fulfillment lag, failure rates, and delivery health into the alerting from Launch.