Quickstart

Create a sandbox Gate session and mount the hosted widget.

You need a sandbox sk_test_*, the matching browser-safe pk_test_*, an allowed return_url, and a page origin configured for the partner.

1. Discover current capabilities

curl https://gate-api-sandbox.0bit.app/capabilities/eligibility?country_code=BR \
  -H "Authorization: Bearer sk_test_..."

Query currencies, assets, and payment methods before choosing inputs.

2. Create a session on your server

import crypto from 'node:crypto';

const response = await fetch('https://gate-api-sandbox.0bit.app/gate_sessions', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.GATE_SECRET_KEY}`,
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    amount: '100.00',
    currency: 'BRL',
    flow: 'on_ramp',
    return_url: 'https://partner.example/gate/complete',
  }),
});

if (!response.ok) throw new Error(`Gate returned ${response.status}`);
const session = await response.json();

Keep sk_* on the server. Send only session.client_secret to the browser.

3. Mount the widget

import { GateRamp } from '@0bit/gate/browser';

const ramp = new GateRamp({
  environment: 'sandbox',
  publishableKey: 'pk_test_...',
  clientSecret: session.client_secret,
});

await ramp.mount('#gate-container', {
  onSuccess: result => console.log(result),
  onError: error => console.error(error.code),
});

<div id="gate-container"></div>

The SDK calls POST /embed/bootstrap, validates the iframe origin, and exchanges only browser-safe credentials.

4. Receive signed webhooks

Configure the webhook URL through PATCH /dashboard/webhook-settings, rotate or obtain the current signing secret through the authorized account workflow, then send POST /webhooks/test. Verify Gate-Signature against the raw request body before returning 2xx.

Use gate_session.completed and transaction reconciliation as the business signal. Browser callbacks are for user experience only.