# Changelog > For the complete documentation index, see [llms.txt](https://docs.banxa.com/llms.txt). Append `.md` to any page URL for its markdown version. ## 2026-09-04 #### Banxa Hosted Checkout #### Added - **Flutter SDK now available (preview)** — The Banxa Flutter SDK (`banxa_payments_flutter`, 0.1.0) now wraps Banxa Hosted Checkout for Flutter apps, distributed on pub.dev. `BanxaPayments.startPayment` creates the order and presents the native payment sheet when the order supports it, otherwise returning a `BanxaHostedCheckoutView` widget for you to render; outcomes from both routes arrive on one `checkoutEvents` stream. It uses `x-api-key` authentication and requires no backend for core flows. Unlike the other SDKs it also exposes sell order creation through `OrderType.sell`. Note: it does not expose order lookup or KYC sharing — use the API or webhooks for those. Requires Flutter `>=3.44.9`, Dart `>=3.12.2`, iOS 15.0+, and Android minSdk 24+. This is a preview release: pin `0.1.0` rather than a caret range. → [Flutter SDK Guide](/products/hosted-checkout/docs/sdk-integration/flutter-sdk-guide) · [Flutter SDK Reference](/products/hosted-checkout/docs/sdk-integration/flutter-sdk-reference) ## 2026-08-12 #### Banxa Hosted Checkout #### Added - **iOS and Android SDKs now available** — The Banxa iOS SDK and Banxa Android SDK (both `BanxaPaymentSDK`) now wrap Banxa Hosted Checkout for native mobile apps. iOS is distributed through Swift Package Manager and Android as an AAR. Both are headless: `startPayment(request:controller:)` on iOS and the `StartPayment` composable on Android create the order and present checkout in one call, then report the outcome on a delegate or callback lambdas. Both use `x-api-key` authentication and require no backend for core flows. Note: they cover buy orders only, and do not expose order lookup or KYC sharing. Use the API or webhooks for those. → [iOS SDK Guide](/products/hosted-checkout/docs/sdk-integration/ios-sdk-guide) · [Android SDK Guide](/products/hosted-checkout/docs/sdk-integration/android-sdk-guide) ## 2026-08-04 #### Banxa Hosted Checkout #### Changed - **Nonce should now be generated in microseconds (16 digits)** — All HMAC documentation and code examples now generate the nonce as a Unix timestamp in microseconds. Seconds (10 digits) and milliseconds (13 digits) remain accepted, so this is **non-breaking and requires no change to a working integration**. Millisecond nonces collide under concurrent load and are rejected as reused (`40003`); microsecond precision reduces that materially. Note that padding a millisecond timestamp with three zeros does not help — the nonce must come from a clock with genuine sub-millisecond resolution. → [Authentication & Environments](/products/hosted-checkout/docs/getting-started/authentication-and-environments) - **Webhook nonce format documented** — Banxa signs outbound webhooks with a 16-digit microsecond nonce. Webhook pages now state this explicitly, show a worked `Authorization` header, and instruct partners to treat the nonce as an opaque string rather than parsing or length-validating it. → [Webhooks](/products/hosted-checkout/docs/transaction-lifecycle/webhooks) ## 2026-07-29 #### Banxa Hosted Checkout #### Fixed - **Sandbox card name requirement corrected** — The name on the test card was documented as "any name". It must match the name entered at the billing details step, or the payment fails. → [Sandbox Test Data](/products/hosted-checkout/docs/testing/sandbox-test-data) - **Referral parameter reference corrected** — The `email` parameter was documented but is not supported, and has been removed. Three descriptions were also wrong: `fiatAmount` and `coinAmount` can both be passed (`fiatAmount` takes precedence) rather than being mutually exclusive, `blockchain` is optional and falls back to the default configured for the selected `coinType` rather than being required with `walletAddress`, and encoding guidance no longer references email addresses. The parameter list now matches the supported set exactly. Docs only, non-breaking. → [Supported Referral Parameters](/products/hosted-checkout/docs/referral-integration/supported-parameters) ## 2026-07-27 #### Banxa Hosted Checkout #### Fixed - **Sandbox test data corrected** — Verification in sandbox is by email OTP, not mobile number: enter any email address, then code `7203`. The list of Australian test mobile numbers has been removed. Document upload in sandbox accepts any legible image — no test document assets from Banxa are required. → [Sandbox Test Data](/products/hosted-checkout/docs/testing/sandbox-test-data) #### Added - **Third-Party Disclaimer requirement** — Documents the go-live requirement to disclose Banxa as the third-party payment provider before checkout, with acceptable patterns and sample wording. → [Third-Party Disclaimer](/products/hosted-checkout/docs/getting-started/required-disclaimer) - **Geographic & Asset Restrictions** — The list of unsupported countries, jurisdiction-specific asset restrictions, and how restriction errors map to causes. → [Geographic & Asset Restrictions](/products/hosted-checkout/docs/reference/geographic-and-asset-restrictions) - **Refunds & Chargebacks** — How refunds are triggered, flow of funds, chargeback liability and the 120-day window, and common failure reasons. → [Refunds & Chargebacks](/products/hosted-checkout/docs/reference/refunds-and-chargebacks) - **Outbound IP Addresses** — Banxa's outbound IPs per environment for partners that allowlist webhook traffic. → [Outbound IPs](/products/hosted-checkout/docs/reference/outbound-ips) ## 2026-07-08 #### Banxa Hosted Checkout #### Added - **FAQ page** — Answers to the most common integration questions raised by partners: credential types, sandbox behaviour, order finality, fee model, `externalCustomerId` semantics, and webhook handling. → [FAQ](/products/hosted-checkout/docs/reference/faq) - **Error code reference** — Documents `4002`, `4005`, `5034`, `422` code `81`, common `401` causes, and checkout errors, none of which were previously documented. → [Error Codes](/products/hosted-checkout/docs/reference/error-codes) - **Sandbox limitations** — The Testing Overview now lists what sandbox does not do: no on-chain transactions, no Sumsub connection, manual order fulfilment, no failure simulation, stale pricing, no emails, no Apple Pay or Google Pay. → [Testing Overview](/products/hosted-checkout/docs/testing/overview) - **Order identifiers section** — Order Statuses now defines the customer-facing numeric order ID vs the API order key, and which to reconcile on. → [Order Statuses](/products/hosted-checkout/docs/transaction-lifecycle/order-statuses) - **JS Native Payments SDK now available (web):** The Banxa JS Native Payments SDK (`@banxa-official/javascript-native-payments-sdk`, v1.0.0) is now available for web apps. A Node-safe `BanxaApiClient` handles order creation and quotes server-side, and the `` web component embeds the checkout in an iframe. A web integration guide and full SDK reference are now published. → [JS Native Payments SDK (Web) Guide](/products/hosted-checkout/docs/sdk-integration/javascript-native-payments-sdk-guide) #### Changed - **Webhook signing secret clarified** — The Securing Webhooks section now states explicitly that webhook signatures are verified with the HMAC key pair, not the v2 `x-api-key`. Previous wording implied a v2 secret that does not exist. Non-breaking, docs only. → [Webhooks](/products/hosted-checkout/docs/transaction-lifecycle/webhooks) - **Order finality warning** — Order Statuses now warns that `paymentReceived` is not a settlement guarantee and that partners must settle on `complete`. → [Order Statuses](/products/hosted-checkout/docs/transaction-lifecycle/order-statuses) - **Quote usage notes expanded** — Get a Quote now states there is no quote ID or validity window, explains the spread-in-rate fee model and why `processingFee` can be `0`, and notes sandbox pricing staleness. → [Get a Quote](/products/hosted-checkout/docs/api-integration/get-a-quote) ## 2026-05-11 #### Added - **React Native SDK now available** — The Banxa React Native SDK (`@banxa-official/react-native-sdk`) is now available. Install a single package to get typed methods for quotes, order creation, and in-app checkout presentation — no backend required for core flows. → [SDK Integration](/products/hosted-checkout/docs/sdk-integration/overview) - **Sumsub Copy Applicant support** — A second Sumsub integration approach is now available alongside Reusable KYC. Copy Applicant retrieves name, DOB, selfie, document, address, and TIN directly from your Sumsub account, reducing the amount of data that needs to be collected separately. Copy Applicant is a separate Sumsub product and must be configured by Banxa — contact Banxa to have it enabled on your account. → [Sumsub Integration](/products/hosted-checkout/docs/identity-compliance/sumsub-integration) ## 2026-05-04 #### Added - **KYC status webhooks** — Banxa now sends a webhook when a customer's identity verification status changes. The payload includes `kyc.status` with values `PENDING`, `UNDER_REVIEW`, `ACTION_REQUIRED`, `VERIFIED`, and `REJECTED`. Use this to track verification progress without polling for order status. → [Webhooks](/products/hosted-checkout/docs/transaction-lifecycle/webhooks) #### Changed - **`mobileNumber` now optional on KYC token share** — Previously required on `POST /v2/identities/token/share`. Note: Interac (Canada) requires a mobile number — if not provided, Banxa collects it from the customer during checkout. ## 2026-02-08 #### Added - **`partnerFee` now included in Quote and Order responses** — Quote and order responses now include `partnerFee`, providing direct visibility of partner fees during pricing and reconciliation. - **KYC token sharing via Sumsub added** — `POST /v2/identities/token/share` is now supported. Share a verified customer's Sumsub token with Banxa to pre-populate KYC and reduce friction at checkout. → [KYC Sharing](/products/hosted-checkout/docs/identity-compliance/kyc-sharing) #### Improved - **Webhook payloads now include full order context** — Webhooks now include full order context for all status transitions, removing the need for a follow-up Get Order call for reporting and reconciliation. ## 2025-05-08 #### Improved - **Base64-encoded images now accepted for identity documents** — Identity document images can now be submitted as Base64-encoded strings in addition to secure HTTPS URLs. ## 2025-01-08 #### Added - **Automated webhook retries** — If Banxa does not receive a `200 OK` response, the webhook is automatically retried. The payload remains unchanged across retry attempts. ## 2024-05-08 #### Added - **`contract_id` added to Get Coins and Get Order(s) responses** — Enables additional reporting on cryptocurrency/blockchain smart contract values. #### Improved - **Webhooks Version 2** — Webhooks are now sent for all order status transitions. Payloads include full order context — no follow-up Get Order call required. ## 2024-01-08 #### Added - **Discount code support** — Available via Get Prices and Create Order endpoints. Commission rate can now be adjusted on a per-quote or per-order basis. - **`X-Request-Id` response header** — Included in all Banxa API responses. Use this value when troubleshooting with Banxa support. #### Improved - **Referral URL theme parameters added** — New URL parameters for visual customisation: `theme`, `primaryColor`, `secondaryColor`, `backgroundColor`, `textColor`.