Two calls, no SDKPOST a checkout with a secret key. GET it back before you fulfill. HTTPS and JSON are enough.
Money only comes inA key opens checkouts that pay your account, and reads those checkouts. It cannot send money out or read your wallet.
Your server sets the priceThe payer cannot change the amount. Kenya collects with M-Pesa. Uganda collects with MTN MoMo.
Safe to retrySend an Idempotency-Key on every create. A timeout and a retry return the same checkout.