Skip to main content

Enable your organization

Contact [email protected] or your WeGive contact with your organization, whether you need hosted checkout or Payframes, and the website origins where you will use the SDK. Include your payment methods, processing currency, recurring requirements, and any organization brands you intend to use. After enablement, use Settings → Pay SDK Keys in your WeGive dashboard to manage keys and allowed origins. Access depends on your dashboard permissions.

Public service URLs

The SDK selects the hosted checkout and API URLs automatically. Initialize it with your publishable key; you do not need to configure an API URL, payment vault, or a processor public key. Your backend uses the API base above for Payframes processing requests.

Test and live keys

Test and live keys use the same public URLs. The key determines payment mode; there is no is_test option to pass into the pop-up. Use test credentials and the test payment details supplied for your configured processor while developing. The hosted pop-up only needs a publishable key. Payframes requires a publishable key and a secret key issued for the same organization and payment mode. Do not pair a test publishable key with a live secret key or reuse credentials from another organization.
Keep secret keys on your server. Never include them in HTML, browser JavaScript, client-side build variables, mobile application bundles, URLs, or browser storage.
Store a newly issued secret in your server’s secret manager when it is shown. Do not assume the dashboard can show the complete value again. A publishable key can appear in page source, but still restrict it to your intended origins.

Register website origins

An origin contains the scheme, hostname, and port, if any. It does not include a path, query string, or fragment. Register each hostname and development port you use. www.example.org and example.org are different origins. Use a local web server rather than opening an HTML file with a file:// URL. Use HTTPS for deployed donation pages. Origin permission does not authenticate a donor or authorize an amount. Your Payframes backend must validate the donation intent, amount, currency, attribution, and access to any customer or payment-method identifiers it accepts.

Rotate and revoke credentials

Issue replacement credentials, update your server or browser configuration, and verify them before revoking the old credentials. Revoke exposed secret keys promptly and contact WeGive to review affected activity. Plan rotation around in-flight payments. A processing retry must retain the original secret-key identity, idempotency key, endpoint, and request body. Switching to a replacement secret key does not preserve the original request’s deduplication scope. Reconcile uncertain attempts before retiring their key. See safe retries. Next, load the SDK.