Smart Payment is unavailable in the merchant app's WebView

Normally, when navigating directly from PayPay to the merchant site, the merchant does not need to handle one_time_token separately. After logging in to PayPay, PayPay redirects to the configured redirectUrl with one_time_token appended. Even when opening the URL with one_time_token in a WebView as is, no additional process is required to transfer the token.

However, if your configuration changes the return URL—for example, if the user returns to the app after logging in through an external browser and the app opens a payment page in a WebView that differs from the redirectUrl—you must pass one_time_token to the WebView. The initial pp.init initializes the JSSDK using this token.

Steps for returning to a WebView

1. When returning from PayPay to the redirectUrl configured with pp.getLoginUrl, pp.render, or /v2/smartpayment/qr/sessions, retrieve the one_time_token appended to the URL.
2. When constructing the URL to open in the app's WebView, pass the one_time_token as a query parameter. For example, if the payment page to open in the WebView is https://example.com/checkout, use https://example.com/checkout?one_time_token={value}.
3. After launching the WebView, promptly execute the initial pp.init while the token retained at the return destination is available for use.

Notes

• one_time_token is a temporary token. The specific validity period in seconds has not been disclosed. Do not unnecessarily delay launching the WebView or executing the initial pp.init after the redirect.
• In the ticket case, in addition to passing one_time_token, it was necessary to retain the cookie for ppjssdk.codeVerifier generated when pp.getLoginUrl was executed until pp.init after login. If initialization fails even after passing the token, check whether the cookie has been deleted or changed.
• If the return destination for the app is a Universal Link, you can use pp.getLoginUrl. When using a Custom URL Scheme Deep Link, pp.getLoginUrl is not supported, so use /v2/smartpayment/qr/sessions.