# Email — Paystack hosted checkout ready for smoke test

**Subject:** Baskit — secure Paystack hosted checkout

Hi,

Checkout now uses **Paystack hosted checkout**:

1. Baskit requests a secure Paystack checkout URL from `pay/initialize`.
2. Card number, expiry, and CVV are entered only on Paystack, not in the app.
3. The catalogue API verifies the ZAR amount and email before placing the order.
4. Android and web builds pass; the local initialization and callback routes were smoke-tested.

Production must deploy the updated API and set `BASKIT_PAYSTACK_SECRET` before app smoke testing.

Thanks,  
Cursor