some browsers block when non-users actively trigger the opening of a new window. For example, a new window like yours, which is opened by the automatic execution of the program, will certainly be blocked.
you can bind a new window to a user's action, such as a click event.
your request is obviously opened after getting the result. If the request is triggered by the user, the window can be opened when the request is triggered. When the request is completed, the window can be reset to URL as the result of the request.

Let's first say why, because in the past, some rogue web pages popped up a lot of new windows after users entered the page to affect the user experience. Later, in order to avoid this situation, browser developers added judgment that if it was not triggered by the user's active action, it will be blocked by the browser. Allowing open to be put on the timer but not exceeding the 1000ms will also be blocked.

similarly, for example, media auto-play on mobile cannot be called the play method before user interaction is generated.

you can first let the backend create the order, return url after the creation is successful, and then judge on the UI build that if the creation is successful, a modal box will be displayed. For example, "go to pay" and then execute the code.