Maintenance Work Notice!

We will carry out maintenance work on this documentation on Tuesday, 15.06.2021 between 3 pm and 4 pm CEST. Thank you for your understanding.

Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Published by Scroll Versions from space ENWORK and version Documentation

Table of Contents

Linchpin Teaser
urlEntityId26247172
titleCookie-/session - handling
type0
url/
EN/Third-party-cookies+-+Browser+cookies+and+session+handling
x/BICQAQ



About Hosted Payment Page

General information about Hosted Payment Page

The Hosted Payment Page is a checkout that contains only the step of selecting the payment method. It is a HTML form with responsive design that is displayed properly on all devices.

In the case of payments via Hosted Payment Page, the shop redirects its customers to the

linchpin

Multiexcerpt-

teaser-macro

Include Page

urlEntityId

SpaceWithExcerpt

13407678

ENWORK

title

MultiExcerptName

Cookie-/session - handlingtype0url/x/vpXM

Platform-Kurz
PageWithExcerptWording
HTML form where they selects their payment method. After confirming the selection depending on the payment method 
Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
forwards the customer to a
Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
HTML form or to a form from an external service provider and notifies the shop after completion about the payment result.

Following table contains the payment methods which you can use via Hosted Payment Page:

Payment type

PayType

Credit card

CC

Direct debit

EDD

PayPal

PayPal

iDEAL

iDEAL

Sofort

Sofort

giropay

giropay

paydirekt

paydirekt

Alipay

Alipay

Bancontact

BanconPP

Bank Transfer

BankTranPP

BitPay

BitPayPP

Dragonpay

DragonPP

eNETS

ENETSPP

Finland Online Bank Transfer

FinOBTPP

Indonesia ATM

IndoATMPP

Multibanco

MultibanPP

My Bank

MyBankPP

MyClear FPX

MyClearPP

Przelewy 24

P24PP

POLi

POLiPP

PostFinance

POSTFINPP

paysafecard

PSCPP

QIWI

QIWIPP

RHB Bank

RHBBankPP

SafetyPay

SafetyPPP

7-Eleven

SevenElePP

Skrill

SkrillPP

TrustPay

TrustPayPP

Apple PayApplePay
B4PaymentB4Payment
BoletoBoletoPP
CUPCUPPP
EPSEPS
WechatWechatPP



Following table lists all card brands that can be uses via the Hosted Payment Page. When submitting the value CC in parameter PayTypes all brands are displayed that are configured for a certain merchant. Selecting specific brands can be done by submitting a string of the desired brand names separated by pipe signs.

Kreditkartenmarke, korrekte Schreibweise für CCBrand

AirPlus

AMEX

ARGENCARD

Aura

Bancontact

CABAL

Cartes Bancaires

Maestro

CBN

CENCOSUD

ComfortCard

CUP

Dankort

DINERS

Discover

Elo

Hipercard

JCB

Laser

Maestro

MasterCard

NARANJA

RuPay

SHOPPING

TOTAL

VISA

Process of payment

To make payments via the Hosted Payment Page you send a request to following URL with HTTPS GET or HTTPS POST:

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNameBaseURL
PageWithExcerptENWORK:.Wording vDocumentation
paymentPage.aspx

 

All details required for payment processing are forwarded as parameters. The parameters are encrypted with Blowfish to ensure that neither the customer nor a third party can manipulate the data.

When calling the form

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
decrypts the parameters and shows the HTML page with the payment methods. The customer selects the payment method and triggers the forwarding by clicking the button "Next".

After the payment has been made made

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
redirects the customers back to a shop page via HTTPS GET (URLSuccess, URLFailure) and transmits the result of the payment as a Blowfish-encrypted parameter string to these URLs. In addition addition
Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
transmits the result via HTTPS POST to the shop's Notify page (URLNotify). The shop accepts the payment result and decrypts the data in order to inform the customer about the status.


Calling the Hosted Payment Page

Calling the Hosted Payment Page starts with the correct composition of the parameters which consist of a key and a value and which are separated by an equals sign (=):

MerchantID=Test

 

All parameters are assembled in a character string and separated by the character &:

Amount=100&Currency=EUR&TransID=12345

 

Notice: Since the characters "=" and "&" are used as separating characters, these characters cannot be transmitted as values. All values which you transmit without BlowFish-encryption must be URL-Encoded.

A correct parameter character string for for

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation

c

ontains contains three basic parameters: MerchantID, Len and Data. The parameters MerchantID and Len are unencrypted. Only the Data parameter is Blowfish-encrypted:

MerchantID=Test&Len=67&Data=0A67FE96a65d384350F50FF1

 

The Data parameter contains the sensitive payment details such as amount and currency. The encrypted bytes are Hex-encoded and completed to two characters from the left with a zero. Encryption is via Blowfish ECB and is available to you as source-code and components.

The Len parameter is very important for encryption because it contains the length of the unencrypted(!) character string in the Data parameter. Since the data quantity to be encrypted is increased by a multiple of 8 in the case of the Blowfish encryption, the correct length of the character string must be known for decryption. Otherwise accidental characters emerge at the end of the character string.

The parameters are transmitted via HTTPS POST or HTTPS GET. The recommended transmit method is HTTPS POST because the parameter character string in the case of GET is attached to the URL, which is limited to 2048 bytes depending on the browser.

Notice: Please note that the maximum length of a payment request is limited to 5120 characters. If you require longer strings please contact

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNameHelpdesk-Name
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
.

The following listings show the development of a payment request. The first listing is the unencrypted parameter character string:

 

Notice: Please note that a value is to be assigned to each parameter. Do not transmit empty parameters, as this can cause the payment to fail.

This character string is encrypted and transmitted as the Data parameter. The HTTPS GET request for the Hosted Payment Page looks like this:

<a href=

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNameBaseURL
PageWithExcerptENWORK:.Wording vDocumentation
paymentPage.aspx?MerchantID=Test&Len=162&Data=E98D40FFFD622C5FE7414F73539A1852C2CE7C8B09D34DF217E27FA2E194B9968DE9ABAE3B1F44B5485EFE3EF2597C7395BADBAD4340CDFD000DD57129EEFAA0BE904A7E2339DCF9363DA6ACDBE5EF98E169FC3092B160252A037135421FD0CE092C174A7D1D63517BD45099AC2B682F5E3CD2C942A6F0E741A833C0&Language=en&URLBack=https://www.shop.com/canceled”>


Notice: Please note that parameters like Language or URLBack are transmitted unencrypted. A table with all possible unencrypted parameters can be found also witihn this document.


Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
interface

Multiexcerpt include
SpaceWithExcerptDOCCT
MultiExcerptNameDefinition
PageWithExcerptDefinition EN


Parameters of the Hosted Payment Page

These parameters are mandatory for all payment methods and has to be submitted Blowfish-encrypted within the Data parameter to the Hosted Payment Page.

Notice: Please take all further parameters specifically for a payment method from the manual of that respective payment method.

The following table describes the encrypted payment request parameters:

Parameter

Format

CND

Description

MerchantID

ans..30

M

MerchantID, assigned by

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePartner-Name
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
. Additionally this parameter has to be passed in plain language too.

TransID

ans..64

M

TransactionID which should be unique for each payment

RefNr

ns..30

O

Unique reference number

Amount

n..10

M

Amount in the smallest currency unit (e.g. EUR Cent)

Please contact the helpdesk, if you want to capture amounts < 100 (smallest currency unit).

Currency

a3

M

Currency, three digits DIN / ISO 4217

OrderDesc

ans..384

M

Description of purchased goods, unit prices etc.

Please note: The first 27 characters appear on the customer-account statement. You can view the full data in

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNameBackoffice-Name
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
.

MAC

an64

M

Hash Message Authentication Code (HMAC) with SHA-256 algorithm

UserData

ans..1024

O

If specified at request,

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
forwards the parameter with the payment result to the shop

URLSuccess

ans..256

M

Complete URL which calls up

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
if payment has been successful. The URL may be called up only via port 443 This URL may not contain parameters: In order to exchange values between between 
Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
and shop, please use the parameter UserData.

URLFailure

ans..256

M

Complete URL which calls up up 

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
if payment has been unsuccessful. The URL may be called up only via port 443 This URL may not contain parameters: In order to exchange values between between 
Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
and shop, please use the parameter UserData.

Response

a7

O

Status response sent by by 

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
to URLSuccess and URLFailure, should be encrypted. For this purpose, transmit Response=encrypt parameter.

URLNotify

ans..256

M

Complete URL which which 

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
calls up in order to notify the shop about the payment result. The URL may be called up only via port 443 It may not contain parameters: Use the UserData parameter instead.

Parameters for Hosted Payment Page


Following parameters are optional and can be submitted unencrypted to the Hosted Payment Page:

Parameter

Format

CND

Description

Template

ans..20

O

Name of XSLT-file with your own layout for the Hosted Payment Page.

If you don't submit a value the responsive

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePartner-Name
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
template of the Hosted Payment Page is displayed.

CCTemplate

ans..20

O

Name of XSLT-file with your own layout for the credit card form. This is used only if the customer selects a credit card brand and then clicks on „Next“ button.

If you don't submit a value the responsive responsive

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePartner-Name
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
credit card form template is displayed.

SDDTemplate

ans..20

O

Name of XSLT-file with your own layout for the direct debit form. This is used only if the customer selects direct debit as payment method and clicks on „Next“ button.

If you don't submit a value the responsive

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePartner-Name
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
direct debit form template is displayed.

Language

a2 (enum)

O

Language code: <de> German, <al> Albanian, <at> Austrian, <cz/cs> Czech, <dk> Danish, <en> English, <fi> Finish, <fr> French, <gr> Greek, <hu> Hungarian, <it> Italian, <jp> Japanese,  <nl> Dutch, <no> Norwegian, <pl> Polish, <pt> Portuguese, <ro> Romanian, <ru> Russian, <es> Spanish, <se> Swedish, <sk> Slovakian, <sl> Slovenian, <tr> Turkey, <zh> Simplified Chinese.

No details means the language is German.

Multiexcerpt include
MultiExcerptNameName
PageWithExcerptURLBack

Multiexcerpt include
MultiExcerptNameFormat
PageWithExcerptURLBack

Multiexcerpt include
MultiExcerptNameCND
PageWithExcerptURLBack

Multiexcerpt include
MultiExcerptNameEN
PageWithExcerptURLBack

PayTypes

ans..256

O

With this parameter you can override the payment methods to be displayed, i.e. you can decide within this parameter separated by pipe which of the available payment methods are displayed.

Take the possible values from the column PayType within the table of payment methods given above.

Example: …&PayTypes=CC|EDD|Alipay

Optional parameters for Hosted Payment Page



Corporate PaymentPage: XSLT layout for forms

You can change the parameter Template to create an individual layout for your Hosted Payment Page form which exactly matches the shop layout To this end your graphic designer can design an HTML-template in the shop-design based on XSLT (Extensible Stylesheet Language Transformation). 

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNameHelpdesk-Name
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
copies this XSLT-template to our our 
Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
Server. If you enter the name of your XSLT-file in the Template parameter, the
Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNamePlatform-Kurz
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
form will appear in your layout.

The XSLT templates for the Hosted Payment Page form have several advantages:

  1. Merchants can bypass the costly PCI-security authorisation
  2. The Hosted Payment Page is responsive, i.e. it works on Smartphones, Tablets or on the Laptop

For general information about XSLT see www.w3.org.


The subsequent conventions apply for the use of the Corporate Paypage with XSLT:

File names

A XSL file designed by you defines your individual layout. The associated XML file contains the texts that are to be displayed on the form. Hence, multilingualism is easy. Always use your MerchantID in the names of the files.

XSL template:             MerchantID_PaymentPage.xsl
XML text file:              MerchantID_PaymentPage.xml
Sub folder for pictures, CSS- and JS-files:       Templates/imagesMerchantID_PaymentPage

In order not to receive safety notices, please ensure that external image sources are retrieved via SSL.

In order to call the individual layout, use the ‘Template’ parameter with your MerchantID and attach it unencrypted to the call of the form of Hosted Payment Page, for example:

Multiexcerpt include
SpaceWithExcerptENWORK
MultiExcerptNameBaseURL
PageWithExcerpt
ENWORK:.
Wording
vDocumentation
paymentPage.aspx?MerchantID=IhreMID&Len=123&Data=AGSDJ…ASDF&template=IhreMerchantID


Hidden Fields

The following hidden fields must be implemented so that the values can be passed on when sending the form:

MerchantID:               „MerchantID“
Request length:          „Len“
Request data:             „Data“
Template:                   „Template“
Language:                  „Language“
URL for back button:  „URLBack“
Payment method:      „PaymentMethod“
Credit card brand:      „CreditCardBrand“

Language selection

The language selection on the Hosted Payment Page form occurs automatically depending on the parameter Language. Other language areas are filtered out. If you wish to access the field of another language area e.g. with JavaScript, you can do so via the following path: paygate/language/@name.

XML structure

The ‘Language’ parameter controls which section of the XML text file is read out. German ‘de’ is always used as standard.

The XML file should have the following basic structure:

<?xml version="1.0" encoding="utf-16"?>

      </languages>

            <language name="de">

                  <title>Zahlung</title>

                  ...

            </language>

            <language name="en">

                  <title>Payment</title>

                  ...

            </language>

      </languages>


‘UTF-8’ is also possible for the coding.

With <xsl:variablename=““ select=“paygate/language/@name”/> you can directly address an XML language section from the XSL file.

For an overview of which parameters are rendered by the Hosted Payment Page, please examine the following structure (XSL file is rendered against the following XML string):

strXML = "<?xml version='1.0' encoding='windows-1252'?>" & _

<paygate>

      <merchantID>...</merchantID>

      <len>257</len>

      <data>E98D4...F7065</data>

      <template>

      <urlBack><![CDATA[http://www.google.de]]></urlBack>

      <paymentMethods>

            <VISA type="CC" displayName="Visa"/>

            <MasterCard type="CC" displayName="MasterCard"/>

            <AMEX type="CC" displayName="American Express"/>

            <DINERS type="CC" displayName="Diners Club International"/>

            <Discover type="CC" displayName="Discover"/>

            <JCB type="CC" displayName="JCB"/>

            <EDD lowercase="edd">

            <PayPal lowercase=="paypal">

            <iDEAL lowercase=="ideal">

      </paymentMethods>

      <language name="de">

            <title>Zahlung</title>

            ...

      </language>

</paygate>


In your XSL file you can access each single value within this XML structure which is rendered in the backend based on the XML language file and additional values.

JavaScript

You can find individual JavaScript methods either in the HEAD section of your XSL file or within the file main.js that can be found in the images folder at Templates/imagesMerchantID_PaymentPage/js.

Notice: Please do not use any external links to your JavaScript!