
Gateway Developer Guide and Reference 07 February 2013 27
Introducing the Gateway Checkout Solutions
About Security
1
Numbers in the figure correspond to the numbered comments below:
1. The customer clicks Buy to purchase merchandise on your website.
2. You request a secure token by passing a token ID to the Gateway server.
3. The Gateway server returns the secure token and your token ID to your website.
4. You submit the secure token and token ID in an HTTP post to pages hosted on the Gateway
server and redirect the customer’s browser to the hosted pages.
5. The Gateway server uses the secure token to retrieve the amount and other transaction data.
The customer submits their credit card number, expiration date, and other sensitive data
directly to the host pages rather than to your website, easing your PCI compliance
requirements.
6. The Gateway processes the payment through the payment processing network.
7. The Gateway server transparently returns the customer to the location on your website that
you specified in the request to obtain a secure token. You display the results to the
customer on your website.
NOTE: If you do not get a response from the Gateway server, submit an Inquiry transaction,
passing in the secure token to see if the transaction has completed. For details, see
“Submitting Inquiry Transactions” on page 69.
PCI Compliance Without Hosted Pages: Transparent Redirect
PayPal Payments Pro and Payflow Pro merchants who want PCI compliance while
maintaining full control over designing and hosting checkout pages on their website can use
Transparent Redirect. Transparent Redirect posts payment details silently to the Gateway
server, so this sensitive information never goes through the merchant’s website.
Comentarios a estos manuales