How it works
Every flow shares the same pipeline. What differs is only how the subscriber proves they want the service: everything before and after that is common, which is why learning one flow gets you most of the way through the others.
The four stages
1. Anti-fraud, before anything else. Your backend fetches a script, your page loads it, and the identifiers it produces travel with the confirming call. This is not optional and it is not something we do for you: a flow whose page never loaded the script is refused at the last step.
2. The subscriber confirms. A PIN, a tap, or a one-time code. This is the only part that differs between flows.
3. We decide, then act. The confirmation is checked, the anti-fraud verdict obtained, and only then is a subscription opened or a charge made. Nothing is charged behind a check that did not pass, and nothing is charged behind one that could not run.
4. DataSync carries the rest. The synchronous response tells you what happened on that call. Everything afterwards (renewals, failed charges, endings) reaches you as events.
What you hold, and what we hold
| You | Us |
|---|---|
| Your API credential, server-side only | The operator relationship and connections |
Your spTransactionId for each attempt | The anti-fraud account and its credentials |
| A receiver for DataSync events | The record of what was charged, and when |
| Your landing page | Retries, backoff and the subscription lifecycle |
You never hold anti-fraud credentials and never talk to the operator. That is the boundary, and most of the API's shape follows from it.