Transak

Integration flow (server-minted widget URL)

Transak's current model splits work between backend and frontend so the API key never reaches the browser. The result is a slightly heavier integration than a pure publishable-key widget, but a more secure one.

• Backend exchanges API key (+ secret) for an access token via refresh-access-token.
• Backend calls Create Widget URL with widgetParams → receives a single-use widgetUrl (sessionId), valid ~5 minutes.
• Frontend mounts the widgetUrl with @transak/ui-js-sdk into a containerId via new Transak(config).init().
• Order tracking layered: client events (TRANSAK_ORDER_CREATED/SUCCESSFUL) for UX, plus webhooks / WebSockets / Get Order By ID for truth.

Local rails & coverage

Transak's edge is the breadth of local pay-in/pay-out methods — particularly in emerging markets where card rails are weak — layered on top of standard card and instant-bank rails in developed markets.

• India: UPI; Brazil: PIX; EU: SEPA Instant; US: ACH + card; UK: Faster Payments; Australia: PayID.
• On-ramp across 64+ countries / 115+ overall, 70+ fiat currencies, 130+ crypto, 75+ chains. [verify exact counts]
• Off-ramp narrower: 40+ countries, 20+ networks, expanding.
• Stablecoin breadth includes USDC, USDT, EURC (Circle) and USDG (Paxos) for MiCA-aligned EU flows.

Compliance & licensing

A multi-jurisdiction license stack is the real moat — it's what lets partners switch on a market by changing a config rather than acquiring their own licenses.

• US: FinCEN-registered MSB; UK: FCA-registered; EU: VASP registration (migrating toward MiCA/CASP). [verify MiCA CASP status]
• Canada: FINTRAC; Australia: AUSTRAC; India: FIU-IND.
• KYC is collected once per user and reused across partner sessions; sanctions screening + fraud handled in-platform.
• Webhook payloads are JWT-encrypted with the partner's access token so order data isn't exposed in transit.

Fees & risk

• Card on-ramp fees typically ~3.5–5.5% by region; bank/local rails cheaper. [verify current tiers]
• Revenue = fee + spread on each transaction, with partner revenue-share on volume.
• Chargeback/fraud risk on card on-ramps; FX + liquidity risk in emerging-market corridors.
• Fee-compression pressure from zero-fee USDC rivals (Coinbase Onramp) and aggregators routing for best quote.

Architecture

Transak sits between local payment rails / card acquirers / banks and the chains. Unlike a pure publishable-key model, the current flow is server-assisted: the partner backend calls the Create Widget URL API (authenticated with the API key) to encapsulate all widget params into a single-use, 5-minute widgetUrl carrying a sessionId. The frontend SDK only ever sees that opaque URL, so the API key never touches the client. Transak runs KYC, payment acceptance, fraud, liquidity sourcing, and the on-chain payout (and the reverse for off-ramp). For Transak One, Transak additionally executes a partner-supplied smart-contract call after converting fiat to the source token. Order state is pushed back via SDK events, webhooks (JWT-encrypted with the partner's access token), WebSockets, and the Get Order(s) REST API.

Integration shape

Primary path: the @transak/ui-js-sdk (successor to the legacy @transak/transak-sdk) renders the widgetUrl as a hosted or embedded iframe; one Transak instance = one widget mounted to a containerId. Native iOS, Android, React Native, and Flutter SDKs exist, plus a REST/Whitelabel API for headless flows. apiKey and referrerDomain are mandatory; productsAvailed selects BUY/SELL; the rest of the flow (asset, network, fiat, amount, wallet, payment method, partnerOrderId, redirectURL, theme) is configured via widget params.

API surface

POST Create Widget URL

Server-side: pass widgetParams (apiKey, referrerDomain, productsAvailed, cryptoCurrencyCode, network, walletAddress, fiatCurrency, fiatAmount…) → returns a single-use widgetUrl + sessionId, valid 5 minutes.

POST refresh-access-token

Exchange the API key + secret for an access token used to sign widget URLs and decrypt webhook payloads; issuing a new token invalidates the prior one.

GET Get Orders / Get Order By ID

Poll order objects and current status (e.g. AWAITING_PAYMENT_FROM_USER → PROCESSING → COMPLETED / FAILED / EXPIRED).

Webhooks

Real-time order lifecycle callbacks to the partner backend; the data field is a JWT you decrypt with your access token — treat as source of truth.

WebSockets

Live order-status stream as an alternative to polling for in-session UI updates.

new Transak(config) + transak.init()

Client SDK: mount the widget from a widgetUrl into a containerId; configure widgetHeight/widgetWidth.

transak.on(Transak.EVENTS.*)

Subscribe to TRANSAK_ORDER_CREATED, TRANSAK_ORDER_SUCCESSFUL, and TRANSAK_WIDGET_CLOSE to advance your own UI.

Minimal integration

Two-step flow: mint a widgetUrl server-side, then render + listen for the order client-side.

// 1) SERVER: mint a single-use widgetUrl (keeps the API key off the client)
const res = await fetch('https://api.transak.com/api/v2/widget-url', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    apiKey: TRANSAK_API_KEY,            // secret — server-side only
    referrerDomain: 'rails.app',
    widgetParams: {
      productsAvailed: 'BUY',           // or 'SELL' for off-ramp
      cryptoCurrencyCode: 'USDC',
      network: 'base',
      fiatCurrency: 'EUR',
      fiatAmount: 50,
      walletAddress: '0xabc...def',
      partnerOrderId: 'order_123',
    },
  }),
});
const { widgetUrl } = await res.json(); // valid ~5 min, single use

// 2) CLIENT: render the widget and react to order events
import { Transak } from '@transak/ui-js-sdk';

const transak = new Transak({ widgetUrl, containerId: 'transak-mount' });
transak.init();

transak.on(Transak.EVENTS.TRANSAK_ORDER_SUCCESSFUL, (order) => {
  console.log('paid', order);          // confirm via webhook server-side too
  transak.close();
});
transak.on(Transak.EVENTS.TRANSAK_WIDGET_CLOSE, () => transak.cleanup());

Build notes

• The legacy @transak/transak-sdk (apiKey + environment passed on the client) is deprecated — new integrations use @transak/ui-js-sdk with the server-minted widgetUrl. [verify the exact widget-url endpoint path/version against current docs]
• widgetUrl/sessionId is single-use and expires in ~5 minutes; mint a fresh one per user flow rather than caching it.
• Treat webhooks (JWT-decrypted with your access token) or Get Order By ID as the source of truth for settlement — the client TRANSAK_ORDER_SUCCESSFUL event only means payment was initiated.
• Use the STAGING environment + staging API key first; switch to PRODUCTION by swapping credentials.
• Transak One uses extra widget params (smartContractAddress, sourceTokenData, calldata, estimatedGasLimit, cryptoCurrencyData) to fund and execute a contract call in one transaction. [verify exact param names against docs]