Open a checkout session
Open a checkout session for one or more (up to 10) of your own billing periods. `customer_id` is optional and, if sent with a value, must be a customer already recorded on your account; omit it, or send it null or blank, to have the buyer enter their full name, email, phone and address at checkout. Each item's price is snapshotted at creation, so a plan edited afterwards cannot change what the buyer already saw. If two items resolve to the same product (e.g. via different `pbp_id`s), only the last one is kept. `return_url` is required and is where the buyer lands after paying. Send the returned `checkout_url` to the buyer to collect payment. This is the one rate-limited endpoint on the partner API — 20 sessions a minute per account by default, answered with 429 once exceeded.
Authorization
ApiKey API key issued to the partner, sent with the Bearer prefix — for example: Authorization: Bearer su_key_9f2c4d1ab3….
Keys minted on the live instance are prefixed su_key_ and keys minted on sandbox su_test_key_. The two instances keep separate key tables and separate hosts, so a sandbox key sent to the live host — or the reverse — answers Invalid API key. rather than falling back to the other environment.
In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/checkout-sessions/" \ -H "Content-Type: application/json" \ -d '{ "items": [ { "pbp_id": "pbp_3n9k2x" } ], "return_url": "https://partner.example.com/orders/1234" }'{ "public_id": "cks_3n9k2xQ7m", "expires_at": "2026-07-03T10:45:00Z", "checkout_url": "https://app.suqo.ai/checkout/cks_3n9k2xQ7m"}Changelog
What changed in each version of the SUQO API.
Retrieve a checkout session GET
Read one of your own open checkout sessions by the `public_id` returned when it was opened: its line items, customer, seller details and expiry. A session is served only while it is open — once paid or past `expires_at` it answers 404, as does an unknown `public_id` or one belonging to another account.