Trust the bound interaction
Read amount, currency, merchant, protocol, scope, and expiry from the current payment interaction. Do not let a model or client override those terms in the payment request.
Keep credentials out of the Action
- Never put raw card details, bank credentials, wallet keys, payment tokens, or checkout secrets in prompts or Action updates.
- Use first-party
webLink flows after a user gesture when sensitive input is required.
- Store processor-tokenized references rather than card data when the user explicitly saves a method.
- Keep authentication and payment authority as separate decisions.
Make retries idempotent
Use one stable requestId for the same payment attempt. After a timeout, read the same Action before retrying so the client cannot create a duplicate charge or replacement Action.
Confirm from server state
A redirect, closed checkout window, wallet signature, or provider response displayed in the client is not the final authority. Continue reading the same actionId until Darwin reports the backend-confirmed state.
Test payment-specific failures
Test changed terms, expired checkout, duplicate submission, decline, insufficient balance, abandoned browser flow, processor timeout, and a successful charge followed by delayed Action confirmation.Last modified on September 22, 2026
