The session’s client_secret from POST /v1/hosted-sessions. This is the session credential the component sends as Authorization: Bearer … on every call (read config, quote fee, challenge, confirm).
off · on_session · off_session — when on_session/off_session, an opt-in “Save this payment method to my wallet” checkbox is shown for new card/ACH entry (default checked); the method is saved only when it’s checked. off/unset hides it and never saves.
disable-ach
false
true disables ACH even if the session allows it
disable-credit-card
false
true disables card entry
cvv-recheck
account config
true re-prompts CVV for saved cards
management-mode
false
true renders saved-method management (add/remove) instead of checkout
new-method-only
false
true suppresses the saved-method selector and only allows entering a new card/ACH — even if the session’s customer has saved methods. setup-future-usage still applies, so the new method can still be saved to that customer’s wallet. For admin “capture a new method” flows where existing methods are verified out-of-band.
ach-sec-code
unset
NACHA SEC code for ACH debits — web (internet-authorized), tel (telephone/agent-authorized), or ppd. When set and the payer chooses ACH, the component shows the matching authorization and records the accepted mandate (sec code + timestamp) with the payment. web displays the mandate next to Pay; clicking Pay is the authorization (no extra click). tel/ppd show an explicit checkbox that must be ticked before Pay (agent/staff attestation). Unset = no ACH authorization shown. Ignored for card / Apple Pay.
await el.refreshSession(); // re-fetch the session + refresh amount/total/fee in place
refreshSession() re-fetches the hosted session and updates the displayed
amount/total/fee without tearing down the entered method — use it after PATCHing the
session amount server-side so the summary updates while the payer’s typed-in card survives.
(Changing the session-id attribute instead does a full reload and discards entered input.)