A Lynq integration separates payment creation, payment collection, and order fulfilment. Understanding that separation helps you keep credentials safe and prevents duplicate or premature fulfilment.
Responsibilities
Never send your secret API key or webhook signing secret to the browser. A publishable key is designed for browser code; a secret key is not.
Payment sequence
Browser results versus webhooks
The browser result exists to update customer-facing UI. It can tell you to show success, pending, or a payment-method error, but browsers can close, lose connectivity, or be manipulated.
The signed webhook is the authoritative server-to-server confirmation. Fulfil goods, grant access, or mark an order paid only after verifying payment_intent.succeeded and processing its event ID exactly once.
Test and live environments
Test and live mode are isolated. A Payment Intent only works with the publishable key and payment-method connections from its own environment. Test webhook events go only to the test endpoint; live events go only to the live endpoint.
Next, create API keys or go directly to the quickstart. 
