What ROKI Connect is
It lets a merchant's server accept card payments three ways. In every one, the merchant never receives, transmits or stores the card number: card entry always happens on a ROKI-controlled surface.
| Mode | What it is | Card entry | Frontend needs | Backend needs |
|---|---|---|---|---|
| 1 - Hosted checkout | Redirect the customer to a ROKI page | ROKI page | nothing | sk_* creates the payment |
| 2 - Embedded components | ROKI card fields in an iframe on your own site | ROKI iframe | pk_* |
sk_* confirms with the amount |
| 3A - Tokenized payments | Charge a card the customer already saved | none | nothing | sk_* charges an opaque pm_* |
Mode 3B is not available yet.
Start with mode 1. It is the simplest, needs no frontend work, and every other mode reuses its payment object, its webhooks and its void/refund/receipt endpoints. Reach for mode 2 when the merchant wants the payment step to look like their own site, and mode 3A when you need to charge a returning customer without asking for the card again.
In modes 2 and 3A the customer's browser talks only to your own backend. Your backend is the only
place that holds sk_* and calls ROKI directly. A "pay with saved card" button must call your
server, never a ROKI secret-key endpoint, and sk_* must never appear in browser code.
What that buys, stated narrowly: the card number is entered on ROKI's own domain and never
reaches the merchant's systems. In mode 1 the customer is on a ROKI page. In mode 2 the card
fields are an iframe served from aura.roki.systems, so the merchant's own page cannot read them -
the browser's same-origin policy stops it, and what crosses back is a tok_*, never the number.
That was measured, not assumed: probes/verificar-pci-modo2.mjs types a test card into the real
component and then combs the host page - DOM, input values, attributes, window, localStorage,
sessionStorage, cookies, raw postMessage payloads, SDK events and the hidden token input - and
the number appears in none of them. It is the same model as Stripe Checkout or the payment links of
other processors.
What that does not buy is a compliance conclusion, and this guide will not draw one for you. Which SAQ applies to a merchant, and whether it applies at all, is determined by that merchant with its acquirer or a QSA - and eligibility for the lightest questionnaires also depends on the parties handling the card data being PCI-validated, which is a question for ROKI, not something this document can answer. Card data never transiting merchant systems is the fact. The paperwork that follows from it is the merchant's call to make with the people who sign it off.
Market: Honduras. Usual currency: Honduran lempira (HNL, ISO numeric code 340).