Available
Authenticated browser sessions
Short-lived sessions your backend issues for one signed-in customer and one browser origin. Revocable, and never holding a server key.
Web SDK · Available
Subscriptions for web apps, one customer everywhere.
Read who has paid, on your pages and on your server, with the same entitlements your iOS and Android apps already use. Connect your existing Stripe checkout.
cashsdk / web sdk · available Product preview
In the browser
npm install cashsdk-web cashsdk-node
const cashsdk = createCashSDK({
publishableKey: "csk_pk_…",
environment: "production",
getSessionToken, // from your backend
});
await cashsdk.initialize();
const { entitlements } = await cashsdk.getEntitlements();
const isPro = entitlements.some((e) => e.identifier === "pro");How it works
Your sign-in, your checkout. CashSDK keeps the access.
The browser never holds a secret key and never decides who the customer is. Your backend does, the same way it already does for everything else.
01
Allow your site
Add your web app's exact origins in the dashboard, and create a publishable key and a server key.
02
Issue a session
After your own sign-in, your backend asks CashSDK for a ten-minute session for that customer and that origin.
03
Read access
The browser reads the customer's entitlements, subscriptions and offering with that session.
04
Get paid
Connect Stripe. Its signed events grant, renew and end access, and the same customer is Pro on every platform.
On your server
The session endpoint is four lines.
cashsdk-node issues sessions, ends them on sign-out, checks access before you serve anything paid for, and verifies CashSDK webhooks. It runs anywhere Node.js 20.19 or 22.12 does, including Next.js route handlers, Express and NestJS.
- The customer comes from your authentication, never from the browser
- Sessions last ten minutes and are bound to one origin
- Sign-out ends the customer's sessions in every tab
app/api/cashsdk/session/route.ts
import { CashSDKServer } from "cashsdk-node";
const cashsdk = new CashSDKServer({
secretKey: process.env.CASHSDK_SECRET_KEY!,
environment: "production",
});
export async function POST() {
const user = await requireUser(); // your auth
const session = await cashsdk.createWebSession({
customerId: user.id,
origin: "https://app.example.com",
});
return Response.json(session, {
headers: { "Cache-Control": "no-store" },
});
}In React
Hooks that follow the signed-in customer.
cashsdk-react works with React 18 and 19 and the Next.js App Router. Server rendering shows an empty state and makes no request, and Strict Mode never duplicates a read or a purchase.
- useEntitlements, useSubscriptions, useOfferings and useCheckout
- One customer's data is never shown after another signs in
- useBillingPortal sends a customer to Stripe's portal from a click
Access.tsx
"use client";
import { useEntitlements } from "cashsdk-react";
export function Access() {
const { status, isActive } = useEntitlements();
if (status !== "ready") return <p>Loading…</p>;
return isActive("pro")
? <ProFeatures />
: <Pricing />;
}Built for money
What you can rely on.
One entitlement model
A subscription bought on the web unlocks the same entitlement as one bought in your iOS or Android app.
Keep your Stripe checkout
Connect Stripe in the Marketplace and add the customer id to your subscriptions. Nothing else changes.
No secrets in the browser
The browser only holds a publishable key and a short session. Returning from checkout never grants access by itself.
Renewals, cancellations, refunds
Signed provider events keep access right. A late or repeated event can never shorten a paid period.
Typed errors
Every failure has a stable code, whether a retry can help, and a request id to quote to support.
Small and open
MIT licensed, no runtime dependencies, ES modules with TypeScript types. The source is on GitHub.
Release 1.0.0
What is available today.
Generally available on npm.
Available
Customer access, subscriptions and offerings
Read the customer's entitlements, their subscriptions from every store, and the current offering, in the browser and on your server.
Available
Access from your own Stripe checkout
Keep your Stripe Checkout. Connect Stripe in the Marketplace, and every subscription grants and ends access the same way App Store and Google Play purchases do, including trials, add-ons, refunds and a week of access while Stripe retries a failed renewal.
Available
One-time purchases from your Stripe checkout
A paid one-time Checkout Session unlocks lifetime products, one purchase per line item, and a full refund takes the unlock back.
Available
Import Stripe prices
Pick prices from the connected Stripe account on the Products page, and CashSDK creates the matching products with the amount, currency and period Stripe states.
Available
Stripe customer portal
Open Stripe's hosted portal for the signed-in customer's own Stripe account, so they can update a card or cancel: openBillingPortal in the browser, useBillingPortal in React, createBillingPortalSession on your server.
Available
Stripe checkout started by the SDK
Hosted Stripe Checkout for your recurring and one-time Stripe prices, with free trials from intro offers, optional promotion codes and Stripe Tax, durable retries and a return page helper.
In development
PayPal payment tracking
Verified PayPal payment and refund events. Access lifecycle and PayPal checkout are not available yet.
Planned
Advanced web commerce
Plan changes, seats, credits, usage billing and embedded checkout.
Questions
Before you start.
No. Connect Stripe in the Marketplace, import your Stripe prices as products, and put your user id in the subscription's metadata as cashsdk_user_id. Stripe's events then grant and end access. One-time payments and failed renewals are covered on the Stripe page.
Yes. Use the same customer id on the web as in your mobile apps and the web SDK reads the same entitlements, whichever store the purchase came from.
It decides what to show. Your server decides what to serve: check access with cashsdk-node before returning anything paid for.
Anything that runs in a modern browser. cashsdk-react covers React 18 and 19, including the Next.js App Router. On the server, Node.js 20.19+ or 22.12+, with ES modules or CommonJS.
The SDKs are free and MIT licensed. Web revenue counts toward your CashSDK plan the same way App Store and Google Play revenue does.
Add your web app to CashSDK.
Create a web app, allow your origin and read access in minutes.