Express Checkout operations & compliance

The integration guide covers the build; this page covers running it and your security review. Platform-wide detail is on Security & data handling.

Security checklist

• Treat apiKey as public: it ships in your page’s JavaScript and is sent as x-api-key on the offer save. It identifies your application (Authentication).
• If your page sets a Content-Security-Policy, allow (e2e hosts shown; flights.movmo.io / api.movmo.io when isProd: true):
  • script-src: the CDN host you load the bundle from (https://cdn.e2e.movmo.io).
  • connect-src: https://flights.e2e.movmo.io (the offer save, via its /v1/proxy; the navigation to Movmo’s checkout page needs no CSP entry) and https://e2e.api.movmo.io (the analytics beacon).
  • style-src: 'unsafe-inline' (the script-tag build injects a <style> element) and https://fonts.googleapis.com (the button’s Inter font import).
  • font-src: https://fonts.gstatic.com.
• Production pins the script-tag version with SRI (Version pinning and SRI).
• Movmo’s list of your origins matches every host that serves the button or your returnUrl (Where it can run).

What you do NOT build

• No card entry, vaulting or 3-D Secure handling on your page.
• No passenger or traveler-profile storage.
• No consent screens.
• No booking confirmation email or receipt; Movmo sends it.

Operating the integration

• Save failures. onError stages and actions are under onError stages.
• Exits. onExit reasons and next steps are under After the click. Confirm a booking server-side before you fulfil: onBookingComplete and onExit are unauthenticated browser signals.
• Analytics. The button reports its funnel to Movmo with your iataCode as partner_id, and only your page’s hostname as page context.
• Rate limits. See Errors and rate limits.
• Incident contact. Movmo’s is security@movmo.io; give Movmo yours at onboarding so either side can reach the other.

PCI and GDPR

• Card data never reaches your page. Card entry happens in PCI-certified hosted fields on Movmo’s checkout page, on Movmo’s origin; the card number and CVC go straight to Spreedly, Movmo’s vault partner, and never enter Movmo’s systems or your page.
• Your PSP is merchant of record. At booking time the vaulted card is forwarded server-side to your PSP, which authorizes the charge and owns 3-D Secure / SCA; settlement, refunds and chargebacks stay with you and your PSP.
• Traveler data is collected only inside Movmo’s checkout, never read from your page, and travelers manage or delete it from their Movmo account.
• You are a controller in your own right for the booking data you receive; Movmo may act as processor or joint controller when facilitating the booking. The parties confirm their roles in the integration agreement.