Embedded checkout errors - Hosted checkout

TL;DR: A session create that returns 422 embed:origins_not_configured means no domain is registered at all. A blank iframe on a created session means the embedding domain isn’t registered or the CSP doesn’t allow framing. A registered iframe that never posts events means an origin mismatch. Neither postMessage event is authenticated — always confirm server-side.

Events that signal failure

Full payload shapes live on the embedded events reference — this table only covers the events that mean the attempt didn’t succeed.

Event	Meaning	What to do	Retry?
`CHECKOUT_ERROR`	A network or client-side error interrupted the payment attempt	See Handle payment service outages during checkout; confirm server-side before retrying	Confirm nothing was charged first
`CHECKOUT_EXPIRED`	The session’s TTL elapsed while the shopper was submitting payment	See Handle expired checkout sessions	Start a new session
`CHECKOUT_DECLINED`	The payment was declined	See Payment outcomes	Start a new session with a new `order_reference`

There is no CHECKOUT_CANCELLED event — a shopper closing or navigating away from the iframe posts nothing at all. See Handle abandoned checkouts.

Origin rejection

Signal	Cause	What to do
Iframe loads, but no `message` event ever arrives at your listener	Your embedding page’s origin isn’t in your registered `allowed_domains` — RadiumOne only posts to a registered origin	Register your exact embedding host — see Sandbox and API keys
Events arrive on Chrome/Safari but not Firefox	Firefox doesn’t expose `window.location.ancestorOrigins`; RadiumOne falls back to the origin derived from `success_url`, which must match your embedding page’s real origin	Align `success_url`’s origin with your embedding page — see Debug missing embedded checkout events
Listener attached but nothing received, even the initial `CHECKOUT_READY`	Listener attached after the iframe already posted its first event	Attach the `message` listener before setting the iframe’s `src`

Full walkthrough: Debug missing embedded checkout events.

Not loading

Signal	Cause	What to do
Session create returns `422 embed:origins_not_configured`	No `allowed_domains` entry is usable as a frame origin — the create is refused outright	Register at least one domain — see Sandbox and API keys
Iframe stays blank, no card form	Your embedding domain isn’t registered, or your page’s CSP doesn’t allow framing the checkout host	Register the domain and set `frame-src` — see Fix embedded checkout that won’t load
Session create returns `security:domain_not_allowed`	Same allow-list check applies to `success_url`/`cancel_url` on create	Register the host
Blank iframe even after registering	Mixed content — embedding page served over plain HTTP; or the session predates this release’s frame-origin fix	Serve the embedding page over HTTPS; create a new session if it’s an old one

Full walkthrough: Fix embedded checkout that won’t load.

Next steps

Embedded events reference

Full event and payload reference.

Embed hosted checkout

The full embedded integration guide.

API errors

Checkout API error codes, including security:domain_not_allowed.

Handle failures

Ten common failure scenarios, each with the exact signal and what to do.

Introduction

Guides

3D Secure

Handle failures

Errors

Reference

Embedded checkout errors - Hosted checkout

Events that signal failure

Origin rejection

Not loading

Next steps

Embedded events reference

Embed hosted checkout

API errors

Handle failures

​Events that signal failure

​Origin rejection

​Not loading

​Next steps

Embedded events reference

Embed hosted checkout

API errors

Handle failures

Events that signal failure

Origin rejection

Not loading

Next steps