` and a ` ``` | Environment | CDN URL | | ----------- | -------------------------------------------------------------- | | Sandbox | `https://payments.sandbox.lemmax.com/forte-payments-widget.js` | | Production | `https://payments.prod.lemmax.com/forte-payments-widget.js` | ### SRI Compliance (Recommended) If your application enforces a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) with Subresource Integrity, fetch the versioned filename and integrity digest from the manifest endpoint first. **Fetch the manifest** ```text theme={null} GET /payments/v1/widget/manifest Authorization: Bearer {{access_token}} ``` Response: ```json theme={null} { "data": { "file_name": "forte-payments-widget-6.6.2.js", "integrity": { "type": "sha384", "digest": "sha384-+YZhTk4vMk5059Z1nwH7wn5uWhnILu7OGOnyxxV86ofK0WA0rpDci1dcxRjJdMe+" } } } ``` **Embed with versioned filename and integrity attribute** Use `data.file_name` to construct the `src` URL, and `data.integrity.digest` as the `integrity` attribute on the ` ``` Fetch the manifest on every new widget session. This ensures the `integrity` digest matches the version currently being served from the CDN. *** ## Step 2 — Initialize the Widget After embedding the widget script, initialize it by passing the full `data` object from your intent response. Add this ` ``` Always use a fresh `data` object from your most recent intent API response. Do not cache or reuse previous values. The widget session expires after **30 minutes** of inactivity. If the session expires, re-initiate the intent and re-initialize the widget. *** *** ## Next Steps Handle client-side events from the Payments widget Handle client-side events from the Compliance widget