Checkout SDK Updates

Web SDK — v1.9.0 (2026-11-03)

View on GitHub

Added

ACH secure hosted fields (SpreedlyACHFields): a new standalone class (exposed from the Hosted Fields bundle as window.SpreedlyACHFields) for collecting a US/Canadian bank account with Spreedly-hosted secure fields. Routing and account numbers are entered in two Spreedly-hosted iframes (digits only, account field masked by default) and tokenized from inside them, so they never enter the merchant's application state — the same secure-field model as card number/CVV. API: inAppElements({ routing, account }); submit(formData, submitParams?) (formData takes the non-sensitive fields with Spreedly's names, like the card submit(); submitParams takes metadata/mandate); plus validate(), resetFields(), toggleMask(), per-field setPlaceholder/setLabel/setStyles/transferFocus, setPlaceholderStyles, reload(), isLoaded(), removeHandlers(), destroy(). Events: ready, tokenGenerated (the whole Spreedly transaction, same shape as card hosted fields; bank numbers masked), error, validation, fieldStateChange. Tokenizes through the origin-restricted endpoint like the card fields.
Express Checkout ACH form (SpreedlyACHForm): a new standalone class (exposed from the Express Checkout bundle as window.SpreedlyACHForm), a prebuilt bank account form in one Spreedly-hosted iframe. The customer types the routing and account numbers into the iframe and the form tokenizes them there; your page receives tokenGenerated with { message, tokenResponse, shouldRetain } (bank numbers masked). mount({ parentContainerId?, uiConfig?, submitParams? }) embeds the form, or opens it as a dialog when parentContainerId is omitted. uiConfig sets styles, text, per-field settings, and an optional "save this account" checkbox (showSaveAccountCheckbox, off by default, reported as shouldRetain). The form never retains anything — retain from your backend if shouldRetain is true. Optional contact/billing fields are hidden by default; show them with isHidden: false. Events: ready, tokenGenerated, error, close; plus close()/destroy(). SpreedlyExpressCheckout is unchanged.
Both ACH classes have updateAuthDetails(authDetails): when Spreedly reports the auth details as already used (errors.replayed_tokenization_nonce) or expired (errors.invalid_tokenization_timestamp), pass new ones from your backend and submit again.
ACH demo (/ach-payments): a sample-app flow for both ACH options, with a config panel for the options and methods in each mode.

Deprecated

The merchant-collected ACH API (setupACHPayment, submitACHPayment, clearACHPayment on the base SDK) is deprecated in favor of SpreedlyACHFields (Hosted Fields) and SpreedlyACHForm (Express Checkout). The old API has the merchant collect routing and account numbers in its own inputs, so they pass through the merchant's application state. It still works, but a future release will remove it; older versions keep it.

Security

Enable secure tokenization (required): the integration guides now explain how to turn on secure tokenization for your environment (Environment settings → Security → Enhanced Security → Enable secure tokenization). Until it's on, Spreedly doesn't check the nonce, timestamp and signature, so tokenization requests from your payment page aren't authenticated. The setting is per environment; once on, every Create payment method call in that environment needs authentication. Spreedly also recommends setting Payment method submission to iFrame or Spreedly Express. Non-secure tokenization was deprecated on October 31, 2026 (end of life December 31, 2028).
The links for generating auth credentials now point to Generating authentication credentials.