FloPay SDK Changelog

v1.8.5 - Provider-first anonymous checkout #

Email-less checkout keeps every eligible Stripe method and starts Direct PayPal before asking Flo for buyer details.

FloPay SDK v1.8.5 restores the provider-first anonymous checkout contract. A checkout can start without buyer email/name while retaining the catalog totals, country gates, and every payment method the session is otherwise eligible to show.

What changed

• Detached email-less creation now claims the known catalog immediately without sending blank accountData. The attached session remains anonymous with buyerIdentified: false and carries the backend's complete Stripe method list.
• createAndFetchSession accepts email-less detached drafts and returns that catalog-attached anonymous session.
• Late buyer identification is an independent, idempotent buyer-only claim.
• Direct PayPal no longer renders a Flo email/name preflight. It starts the Smart Button, consumes payer identity after approval, and shows one manual fallback only when the anonymous provider result is incomplete.
• Default, buttons, custom-child, and PayPal-only checkout surfaces share the same provider-first orchestration. Existing supplied-buyer request bodies and callbacks are unchanged.

Why it matters

Anonymous buyers keep card, Apple Pay, Google Pay, configured APMs, and PayPal when those methods pass their normal device, merchant, cart, currency, country, and subscription eligibility checks. Flo asks for identity only when the selected method cannot return the required values.

Developer notes

• Upgrade all @flopay/* packages to 1.8.5 together.
• Anonymous checkout requires billing API v1.7.12 or newer (backend #1314), where catalog and buyer attachment are independent and provider-authorized identity can be resolved during payment.
• The released regression began with the optional-email architecture in SDK 1.8.3; 1.8.4 widened Direct PayPal's redundant preflight. The confirmed live reproduction for #249 was 1.8.4, embedded/buttons, staging. Production reproduction and deployed backend versions still require environment-level release validation.