PaymentMethod

Source: api.ts:504

How an order is paid for — the code the orders API accepts on payment_detail.payment_method and reports back on Order.payment_method.

card_token is a card, and it is a token rather than a number: the card itself is entered in the payment provider's own hosted fields and never reaches this page, this SDK, or this request. There is no plain "credit card" code here. A page writes data-next-payment-method="credit_card" and the checkout store calls it credit-card, but what goes on the order is only ever the token. The rest name the wallet or scheme the shopper used.

Every one of them except a directly-charged card sends the shopper away to pay and brings them back (a card only when the bank asks for 3-D Secure), so an order created with any of these can come back carrying Order.payment_complete_url.

Three of these are read-only. external (a payment taken outside the platform), saved_card (a card already on file) and any method the merchant has not enabled arrive on a fetched order but are never something the SDK sends: it has no flow that produces them.

SEPA Direct Debit is sepa_debit, the name the orders API field lists. The platform's payment-methods guide calls the same method sepa_direct, which is not a value here.