Card not present
Online payments through Hosted Payment Forms, with AVS and CVV validation.
For online payments, the API provides Hosted Payment Forms for payment transactions and secure card data collection for tokenization. Card data is entered into the form, which is hosted outside your environment. It never touches your servers.
There are two ways to render that form:
| Hosted Payment Form | Embed a short-lived iframe URL. Least code, no wallet buttons. | Overview |
| Payment SDK | Mount a web component. Adds Apple Pay and Google Pay, and JavaScript callbacks. | Overview |
Both are driven by the same endpoints and return the same sessionId.
Supported transaction types
The API supports the following Card Not Present transaction types:
- Authorization - Verification with the Issuer if the card is valid for payment. The authorization amount is reserved, but not captured/settled. Includes AVS (Address Verification Service) and CVV validation support.
- Capture - Complete a previously authorized transaction. The cardholder is billed for the transaction, and the transaction is settled to the merchant.
- Sale - Combined authorization and capture in a single step. Includes AVS and CVV validation support.
- Refund - Process reversal of a previous sale transaction (automatically performs a void if the transaction is in the current batch, or a refund if already settled).
- Void - Cancel a previously completed transaction (sale, authorization or capture) if it is still in the current batch (typically same day).
Endpoints
| Operation | Endpoint |
|---|---|
| Sale | POST /transactions/virtual-sale |
| Authorization | POST /transactions/virtual-auth |
| Capture | POST /transactions/capture |
| Refund | POST /transactions/refund |
| Void | POST /transactions/void |
| Tokenize a card or bank account | POST /payment-methods/virtual |
Each of the three session-creating endpoints returns a sessionId, a short-lived iframe URL, and an expiration timestamp.
AVS and CVV
Address Verification Service and CVV validation are supported on card-not-present sales and authorizations. How much address data you collect is controlled by formConfig.billingInfoCaptureLevel - Minimal collects country and ZIP or postal code for basic AVS.
3D Secure
Card-not-present sessions can opt into 3DS2 cardholder authentication, which shifts chargeback liability for fraud to the issuer on successfully authenticated transactions. See 3D Secure.
Testing
See Test cards for the approved, declined, and error-scenario card numbers.