Reference page listing the most frequent mistakes made when integrating hosted payin. Each pitfall describes the observed symptom, the cause, and the correction to apply.Documentation Index
Fetch the complete documentation index at: https://developers.ligdicash.com/llms.txt
Use this file to discover all available pages before exploring further.
customer not empty — operators hidden on the payment page
customer not empty — operators hidden on the payment page
Blocked iframe — blank page or console error
Blocked iframe — blank page or console error
Symptom: the iframe stays empty, or the browser console shows an error like
See Redirect the customer for the full implementations.
Refused to display … in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.Cause: LigdiCash deliberately blocks the loading of its payment page in an <iframe>. This is a security measure against clickjacking, not a bug.Fix: open the payment URL in a real navigation context.| Mode | Implementation |
|---|---|
| Same tab | window.location.href = url |
| New tab | window.open(url, '_blank') |
| Popup | about:blank pattern (see below) |
| Native mobile | Native iOS / Android WebView |
Popup blocked by the browser — window.open() returns null
Popup blocked by the browser — window.open() returns null
Symptom: See Redirect the customer for the full pattern.
window.open() returns null and nothing opens. No visible error for the user.Cause: browsers block calls to window.open() that are not directly triggered by a user gesture. A call made after an await fetch(...) is considered asynchronous and blocked.Fix: open about:blank synchronously on click, then navigate to the URL once the API response is received.JavaScript
Validating the payment based on return_url or cancel_url only
Validating the payment based on return_url or cancel_url only
Symptom: orders are fulfilled without a real payment, or the order state is wrong after cancellation.Cause:
return_url and cancel_url are simply browser redirects. Anyone who knows the URL can navigate to it directly — they are not proof of payment status.Fix: in both cases (return_url and cancel_url), always verify the real transaction status by calling confirm server-side before making any business decision.JavaScript
Using the callback token to call confirm
Using the callback token to call confirm
Symptom: reconciliation with your order fails, or you confirm the wrong transaction.Cause: the See The transaction_id pattern for the recommended reconciliation strategy.
token present in the callback payload is different from the token returned at invoice creation. Both let you call confirm, but only the creation token lets you link the response to your merchant-side order.Fix: store the token returned by the create endpoint in your database as soon as the invoice is created, and use it preferentially to call confirm.JavaScript
cancel_url and return_url swapped
cancel_url and return_url swapped
Symptom: the user lands on the success page after cancelling, or on the cancellation page after a successful payment.Cause: the two fields are easily confused. The older LigdiCash documentation even had them swapped in its examples.Fix:
return_url→ URL where LigdiCash redirects after a successful paymentcancel_url→ URL where LigdiCash redirects after a cancellation
Related pages
- Redirect the customer — opening patterns and anti-blocker popup
- Verify the status — calling
confirmcorrectly - Callback — security — re-verification and handler protection
- The transaction_id pattern — merchant-side reconciliation
