Any framework

Web-standard handlers for Hono, SvelteKit, Remix, Bun, Deno

Every browser-facing integration mounts three routes. The SDK ships them shaped for Express and Next.js, and as web-standard Request in, Response out for everything else.

Route	What it is
GET {basePath}/callback	The consent return
GET {basePath}/approvals/:ref/stream	Live approval state
GET {basePath}/resume/stream	Replays the question after consent

Pick your adapter

Your framework	Use
Express	@paymanai/connect-express: await payman.express.mount(app, { currentUser })
Next.js App Router	@paymanai/connect-next: paymanRoutes()
Hono, SvelteKit, Remix, Bun, Deno	@paymanai/connect/fetch, a subpath of the core package. No extra install.
Fastify, Koa, NestJS	@paymanai/connect/fetch handlers behind a thin route of your own

CI builds every package and the Next.js example and runs the unit suites; the fetch handlers share the same core as the Express and Next.js adapters.

One handler for all three routes

For anything that mounts a prefix rather than a file per route. createPaymanRouter() returns null when the request is not Payman’s, so your own 404 stays yours.

Hono

import { PaymanConnect } from "@paymanai/connect";
import { createPaymanRouter } from "@paymanai/connect/fetch";

const payman = new PaymanConnect();
const route = createPaymanRouter(payman, {
  currentUser: (req) => sessionUserId(req),
});

app.all("/payman/*", async (c) => (await route(c.req.raw)) ?? c.notFound());

One handler per route

For frameworks that map files or explicit paths to handlers.

import { createPaymanHandlers } from "@paymanai/connect/fetch";

const { callback, approval, resume } = createPaymanHandlers(payman, {
  currentUser: (req) => sessionUserId(req),
});

Handler	Route	Notes
callback(req)	GET {basePath}/callback	Redirects back into your app
approval(req, ctx?)	GET {basePath}/approvals/:ref/stream	ctx.params.ref if your framework parsed it; a plain object or a promise both work. Omit ctx and the ref is read from the path.
resume(req)	GET {basePath}/resume/stream	SSE

Options

Option	Required	Default	What it is
currentUser	yes	(none)	(req) => userId | undefined. The only thing the adapter reads from your auth.
basePath	no	/payman	Route prefix. Must match the redirect URI you registered in the developer console.
quiet	no	false	Silences the one-time startup notice. Set it on serverless, where module init runs every cold start.

Both stream routes reject any request whose Sec-Fetch-Site is cross-site. {basePath}/resume/stream is not a read: it runs the stashed instruction, and that can move money. same-origin, same-site, and an absent header pass; the callback is deliberately unfenced because the consent return is cross-site. If you proxy these routes through another origin, this fence is what you hit.

Requirements

Node 22.5 or newer, on a Node-compatible runtime. Not edge: the SDK uses node crypto and node:sqlite.

If more than one instance of your app can serve the same customer, move off the default embedded store to sqlStore() from @paymanai/connect/stores/sql or redisStore() from @paymanai/connect/stores/redis. A connection written by one instance is otherwise missing from the next.

No SDK for your language?

There is no SDK for Go, Python, Ruby, or the JVM yet. The full wire contract is documented in the wire protocol. Build against that, and port the security rules deliberately; none of them are enforced for you.