Should I use a community MonCash SDK or call the REST API directly?

The MonCash API surface you need is small: token, create payment, retrieve by transaction, retrieve by order. So writing a thin client yourself is very reasonable, and often the better choice.

If you do consider a package, check before trusting it with payments:

1. Read the source. It's usually one or two files. Look for disabled SSL verification, secrets being logged, or calls to domains other than Digicel's.
2. Maintenance: last release, open issues, and whether it handles token expiry and both environments.
3. Dependencies: a payment helper shouldn't pull in dozens of transitive packages.
4. Pin the exact version and review the diff before upgrading. A compromised update of a payment package is a real supply-chain risk.

A middle path many teams take: copy the few functions you need into your own codebase (respecting the license), add tests, and own them from then on.

Whichever you choose, keep the security-critical parts in your code: verifying payments server-side, comparing amounts, and idempotent fulfilment. No SDK does those for you.