<PulseCheckout> (@pulsebyshiga/collect-react) is the in-app rendering
model: no iframe, no session token. It’s driven directly by your API key,
so it belongs only in a trusted runtime — a server component, a native app, or
a backend-for-frontend — never a plain browser page.
<PulseCheckout> quotes, creates the order, renders the pay instructions, and
polls status itself — there’s no session to mint and no embed to mount.
It renders as a modal, portaled to document.body, whose open/closed state is
controlled entirely by the request prop — a non-null request opens it, null
closes it — with onClose gating the ×/Esc dismissal; see
Frontend packages for the full prop reference.
Trusted runtime only
The API key must stay in a trusted runtime. Constructing it in a real browser
warns — for untrusted browsers, use the embedded iframe
(Tier A) instead, which is driven by a short-lived session token and never
sees your key.
onSuccess fires as soon as the client sees a funded order — it’s a UX
signal only, not proof of settlement.
Credit a customer only after a verified disbursement.completed webhook.
Client-side callbacks such as onSuccess are UX signals — they can be spoofed.
The signed webhook is the only source of truth for crediting a user.
Showing a rate ahead of time
To show a live rate before any order exists, use the useRate hook or the
<PulseRate> component. Both are proxied through your own backend’s
pulse.rates.preview route rather than calling the engine directly — see
Preview a rate for the server-side route and
Theming for their styling options.
