marcopolo Online payment
Sign up

  1. Introduction
  2. Get started
  3. Integrate with Hosted Tokenization Page
  4. Use advanced customisation tools
  5. Use additional possibilities

Introduction

Our Hosted Tokenization Page solution offers you great security and flexibility at once. Boost your conversion rate with little effort by:

  • Leaving the handling of sensitive card data to us!
  • Customising your webshop's look and feel at will!
  • Optimising the payment experience by limiting the fields to fill in on your payment page and taking benefits from dynamic brand detection.
  • Saving your customers' data for their future purchases and recurring payments.

Before you process live transactions, use our test environment. Get to know our solution without costs or any commitments involved! Once you want to go live, check out here how to get a production account or contact us!


Get started

To process transactions on our platform with this solution, make sure that:

Are you all set? Then learn how to use our Hosted Tokenization Page in the next chapter!


Integrate with Hosted Tokenization Page

Your customers have to provide their credit card number at one point during their journey in your webshop. As a merchant, the greatest challenge is to link all steps during this journey into one seamless experience. At the same time, you need to ensure the safe transfer of your customers' data to the financial institutions handling the data.

Therefore, you can either:

  • Outsource the necessary security precautions completely (by using our Hosted Checkout solution). However, this method has limits: Your customers will notice a redirection to an external URL - a noticeable break in the payment flow.
  • Collect the sensitive data on your own (by using our Server-to-server solution). But this requires you to fulfil the highest PCI requirements - which involves a lot of effort.

Our Hosted Tokenization Page solves this dilemma for you by combining the best of both worlds:

  • Let us handle the credit card data without your customers noticing. Just add an iframe to your webshop containing the payment form. As we are the host, the sensitive data come and stay at our end! We exchange the actual payment card number for a token which is not in scope for PCI.
  • At the same time, merge it seamlessly into your webshop's look and feel. Adapt the payment form completely at will!

Target endpoint URLs in test / live

Our platform allows you to send requests either to our Test environment or Live environment:

  • Endpoint URL TEST: https://payment.preprod.anzworldline-solutions.com.au/v2/MERCHANT_ID/hostedtokenizations
  • Endpoint URL LIVE: https://payment.anzworldline-solutions.com.au/v2/MERCHANT_ID/hostedtokenizations

For transactions with no financial impact, use the TEST-URL. The transactions will be sent to our test environment thereby to your test account.

For transactions with a financial impact, use the LIVE-URL. The transactions will be sent to our live environment thereby to your live account.

Build checkout page

Our Hosted Tokenization Page solution requires you to add the following HTML/JavaScript elements on your checkout page:


<div id="div-hosted-tokenization"></div>
<button onclick="submitForm()">submit</button>
<script src="https://payment.preprod.anzworldline-solutions.com.au/hostedtokenization/js/client/tokenizer.min.js"></script> <!-- contains the methods needed for tokenization -->
<script> 
    // to tokenise credit card data. Load it to the form into an existing DOM element on your check-out page
    var tokenizer = new Tokenizer(hostedTokenizationUrl, 'div-hosted-tokenization', {hideCardholderName: false });

    tokenizer.initialize().then(() => {
        // Do work after initialization, if any
    })
    .catch(reason => {
        // Handle iFrame load error
    })
    function submitForm(){ // 
        tokenizer.submitTokenization().then((result) => {
            if (result.success) {
                // Proceed
            } else {
                // displayErrorMessage(result.error.message);
            }
        });
    }
</script>

The individual elements fulfil a specific role during the payment flow:

Element Description
<div id="div-hosted-tokenization"></div>

When invoking the initialize() function, an <iframe> is automatically added to this element. At the same time, the <iframe> opens the hostedTokenizationUrl you have previously requested via CreateHostedTokenization.

The <iframe> loads a page hosting the payment mask on our side your customers use to enter their PCI-DSS-sensitive data. You can customise the elements of this <iframe> freely. Follow the instructions in this dedicated chapter to learn how to create and upload the template.

<button onclick="submitForm()">submit</button>
function submitForm()

Invokes the function to submit the card data from the <iframe> and receiving the token (the unique hostedTokenizationId you create for each session).

Use this hostedTokenizationId to create the actual payment in a subsequent CreatePayment request.

var tokenizer
The instance of the Tokenizer class providing all functionalities you need for the payment process, i.e.
  • Customising your requests using additional arguments.
  • Adding the <iframe> hosting the payment mask.
  • Submitting the card data and receiving the token for the actual payment.

Learn in the following chapter how to implement these elements into the payment flow.

Set up Content Security Policy

If you have set up a Content Security Policy for your website, you need to whitelist our domains. This will allow loading the tokenizer file and let us capture its logs.

To do so, add the domain https://payment.preprod.anzworldline-solutions.com.au/ to the script-src, connect-src and frame-src directives of your Content Security Policy definition.

Understand payment flow

Our Server SDKs come with a Hosted Tokenization Page API. It includes all the methods you need to perform all the steps of a typical payment flow:

  1. Your customers go to your check-out page featuring these HTML/JavaScript elements and finalise the purchase.
  2. You send a CreateHostedTokenization request to our platform. Our platform returns a hostedTokenizationURL
    Use the following code sample for the request:

The only elements you need to adapt in the code are:

We recommend using the hostedTokenizationUrl in your code, as we have deprecated property partialRedirectUrl.

  1. You invoke the initialize() function from the JavaScript code snippet. By doing so, an <iframe> is automatically added to the HTML element <div id="div-hosted-tokenization"></div> . The <iframe> opens the hostedTokenizationURL automatically.
  • Make sure to load the HTML form containing your checkout page and the HTML/JavaScript elements from a local server (i.e. NodeJS http-server). Due to iframe security restrictions, the tokenizer does not work with file-based browser content (i.e. file:///C:/yourfile.html).
  • The constructor of the Tokenizer takes three arguments:
    hostedTokenizationUrl: Tokenization URL obtained from the Server API
    div-hosted-tokenization: id of the element on your check-out page where you place the form.
    {}: Array of various parameters. Make sure to include at least the mandatory parameter hideCardholderName. Check out our dedicated chapter Use advanced customisation tools to learn what else is possible to adapt the payment flow to your needs.
  • The method submitTokenization() accepts two optional arguments:
    cardholderName: If you choose to provide the card holder name on your own, make sure to include it here as a string
    storePermanently: If you choose (not) to keep the token for upcoming recurring payments, store or delete a token by sending true or false.
      1. Your customers enters their credit card data in the <iframe>. Our platform detects the card scheme automatically once your customers start typing in the number. This also works for co-badged cards (where applicable).
        4'(optional). Use our validation function to check whether the cardholder has filled in the form correctly.

      If your customers enter a number from any card scheme that is not available in your account, the payment mask will display "Card number incorrect or incompatible". Therefore, we strongly advise you to inform your customers in your webshop environment about all available card payment methods before opening the tokenization form.

      1. Your customers submit the card data to our platform via the <button> element. This button invokes the submitTokenization() function from the JavaScript code snippet.
      2. Our platform tokenises the card data. A successful response looks like this:
        {
        "success": true,
        "hostedTokenizationId": string
        }

        The hostedTokenizationId points to the tokenised card data on our platform. Use it in the next step to create the actual payment

        In case of an error, the response will look like this:
        {
        "success": false,
        "error": {
        "message": string
        }
        }

        The message contains a human-readable reason for the error

      3. You send a CreatePayment request to our platform using our Server-to-server integration mode, including the mandatory 3-D Secure properties. Replace sensitive card data in the card property with the hostedTokenizationId.
        7'(optional). We perform a Fraud check.

        Use the following code sample for the request:

      The only elements you need to adapt in the code are:

      • "YourAccount": the name of your account on our platform.
      • "YourHostedTokenizationID": The sessionID you received from our server in the previous step.

      Our platform returns a tokenID and paymentProductId for this call. This allows you to process future payments or recurring payments. Read the dedicated chapter to learn how it works.

      1. Our platform sends a response containing a MerchantAction object.
        It instructs you how to proceed with the payment. Based on the response, these scenarios are possible:

        a) 3-D Secure frictionless flow authentication (MerchantAction.ActionType=null): Your customers use a 3-D Secure enrolled card. The 3-D Secure properties in your CreatePayment request prove to be sufficient for the authentication step. We submit the transaction to the acquirer and provide the result in property statusOutput.statusCode. The flow continues at step 14.

        b) 3-D Secure challenge flow authentication (MerchantAction.ActionType=REDIRECT): Your customers use a 3-D Secure enrolled card. They need to identify themselves as the rightful card owner. The flow continues at step 9.

        c) No 3-D Secure authentication (MerchantAction.ActionType=null): Your customers use a non-3-D Secure enrolled card. We submit the transaction to the acquirer and provide the result in property StatusOutput.StatusCode. The flow continues at step 14.

      2. You redirect the customers to their issuing bank to the MerchantAction.RedirectData.RedirectURL.
      3. Your customers perform the 3-D Secure check. Our system receives the result from the issuer. Based on the result, two scenarios are possible:

        a) If the identification was unsuccessful, we redirect your customers to your ReturnUrl, ending the flow. You can request the transaction result as described in step 13.

        b) If the identification was successful, the flow continues at step 11.

      4. We submit the actual financial transaction to the acquirer to process it. We receive the transaction result.
      5. We redirect your customers to your returnUrl.
      6. You request the transaction result from our platform via GetPayment or receive the result via webhooks.
      7. If the transaction was successful, you can deliver the goods / services.
        14'(optional). Delete the token if you do not plan it to use it for recurring payments or if your customers did not agree to store the credentials To do so, use our DeleteToken API.

      You can also instruct our platform to delete a newly created token right after the payment. Add the following line to your request when submitting the card data to our platform:

      tokenizer.submitTokenization({ storePermanently:false })

      Use advanced customisation tools

      We have designed our Hosted Tokenization Page in a way to allow you to customise it as freely as possible. Take a look at these features:

      Create iframe template

      The centrepiece of this solution is an iframe containing the payment form. Adapting the iframe to your corporate identity allows you to merge it seamlessly into your webshop. We have designed it in a way that allows you to

      • Adapt its various HTML elements at your liking.
      • Use your own .css /image files to further modify the payment form.

      Choose language version

      Our Hosted Tokenization Page is available in various languages. Populate locale to display it in your customers’ preferred language. The value is a combination of ISO 639-1 (language) and ISO 3166-1 (country):

      { 
          „locale”:„en_EN”, 
          
          /* other properties omitted */ 
      }


      We support the following languages:

      Arabic
      Catalan
      Chinese
      Czech
      Danish
      Dutch
      English
      Flemish
      Finnish
      French

      German
      Greek
      Hebrew
      Hungarian
      Italian
      Japanese
      Korean
      Lithuanian
      Norwegian
      Polish

      Portuguese
      Romanian
      Russian
      Simplified Chinese
      Slovak
      Slovenian
      Spanish
      Swedish
      Turkish

      Customise template

      We provide two distinct approaches for implementing a customised template:

      Method 1: Create a fully customised template 

      Create a fully customised template from scratch using our powerful Template Builder. This approach offers a high degree of customisation, allowing you to make intricate changes to the payment form's appearance and functionality.

      Method 2: Adapt template from GitHub repository

      You can also download and customise the necessary files directly from our GitHub repository, providing even more flexibility. It is the ideal solution to let your customers choose between local or global brands (i.e. Visa, MasterCard) if they are using a co-badged credit card.

      Once you have created a template that matches your webshop's look and feel, contact us to upload the template to your account.

      Adapt visual style

      Apply CSS style to the iframe dimensions to merge it even more seamlessly into your webshop. Add this bit to your .css file accordingly:

      iframe[name=htpIframe0] {
          border: none;
          width: 800px;
      }

      Manage cardholder name

      Our API allows to either show or hide the cardholder name field in the iframe.
      Pass the boolean hideCardholderName: true or the boolean hideCardholderName: false accordingly in the Tokenizer constructor:

      var tokenizer = new Tokenizer(hostedTokenizationUrl, 'div-hosted-tokenization', { hideCardholderName: false });
      • If not specified, our platform sets hideCardholderName: true by default.
      • The cardholder name is mandatory. If you choose to get the name in your webshop environment, make sure to submit it in the form:
        tokenizer.useCardholderName("Wile E. Coyote") 
        tokenizer.submitTokenization().then((result) => { ... })

      Send additional tokenizer arguments

      The tokenizer call as described in step 3 takes additional arguments on top of hideCardholderName. Add any of them in your request to adapt the payment flow to your needs:

      Argument Description
      hideCardholderName See dedicated chapter
      hideTokenFields

      Boolean

      Set to true if you want to pre-populate the iframe fields (card number, card holder name and expiry date) with the data stored in a token for a recurring payment.

      validationCallback

      See dedicated chapter

      paymentProductUpdatedCallback

      Callback function

      Detect the brand of the card used as it is entered in the payment form:

      var tokenizer = new Tokenizer(hostedTokenizationUrl, 'div-hosted-tokenization', 
      { paymentProductUpdatedCallback: mypaymentProductUpdatedCallback });
      function mypaymentProductUpdatedCallback(result) { /* Display/remove the detected card brand from your checkout page */ }


      Use additional possibilities

      Our Hosted Tokenization Page solution offers many more possibilities. Learn here all about its available features.

      Use existing token

      Our platform allows you to store your customers' credit card data permanently for recurring payments or for 1-Click-Payments, pre-filling in the payment form. It will make your customers’ payment experience even smoother and improve your conversion rate!

      • Using an existing token for 1-Click-Payments conveniently pre-fills your customers' credit card number and expiry date.
      • Due to SCA, your customers might still have to enter their CVC and/or pass a 3-D Secure authentication check. Our payment form displays the mandatory fields to be filled in automatically.

      As the token is already existing at the time of the transaction request, the payment flow is different:

      • Step 1: Instruct our platform you want to use an existing token. To do so, modify the request createHostedTokenizationRequest by adding the property tokens:
      • A successful response looks like this:

        
        Status: 200 OK
        {
            "hostedTokenizationId": "2f4d08d6ddfc411e944e81c54d824a99",
            "invalidTokens": [ "86a44668-5d0f-4e3f-a597-2aa0a4d03fe5" ],
            "hostedTokenizationUrl": "https://payment.preprod.anzworldline-solutions.com.au//hostedtokenization/tokenization/form/2f4d08d6ddfc411e944e81c54d824a99",
        "partialRedirectUrl": "preprod.anzworldline-solutions.com.au//hostedtokenization/tokenization/form/2f4d08d6ddfc411e944e81c54d824a99" }
      If our response contains a value for property invalidTokens, the token sent in your request invalid. Do not use it in the subsequent payment.
      • Step 2: Pre-fill the displayed form with the stored credit card data. Our platform offers you two ways for this:
        1. Pre-fill the form right away as you display it. Achieve this by adding the token as the fourth argument to the tokenizer constructor:

        var tokenizer = new Tokenizer(hostedTokenizationUrl, 'div-hosted-tokenization', { }, '00164fec-32b2-462e-b48b-84a27930b10c');

        2. Leave the form empty at first as you display it. Let your customers choose in your webshop environment to pay with their stored card. If they choose to, use the following function to populate the form:

        var tokenizer = new Tokenizer(hostedTokenizationUrl, 'div-hosted-tokenization', { });
        ...
        // Later, for instance when a user input triggers a token change
        function tokenChanged () {
        tokenizer.useToken('00164fec-32b2-462e-b48b-84a27930b10c'); //Changes the form to update the selected token, showing only the CVC field if required
        // or
        tokenizer.useToken(); // Resets the form to create a new token
        }

        You can also allow your customers to update the token in the payment form. By initialising the boolean hideTokenFields as follows, your customers can do either.

        a) {hideTokenFields:true}: Hide known fields (card number/expiry date).
        b) {hideTokenFields:false}: Mandatory fields are visible to be filled in / known fields can be changed (only cardholder name/expiry date).

        The request looks like this:
        var tokenizer = new Tokenizer(hostedTokenizationUrl, 'div-hosted-tokenization', {hideTokenFields:true});

      Get validation status

      Your parent page can get the validation status of the payment form anytime. Pass a validation callback function that is called whenever the validity status of the payment form changes. Make sure this function contains a parameter that receives an object with the boolean property valid. This boolean indicates if the form is correctly filled in.

      Use this information to enable/disable the submit button on the parent page if the payment form is correctly/incorrectly filled in. Add this function to your script in step 3:

      var tokenizer = new Tokenizer(hostedTokenizationUrl, 'div-hosted-tokenization', { validationCallback: myValidationCallback });
      function myValidationCallback(result) { document.getElementById('btn-submit').disabled = !result.valid }
      

      Remove form

      You can remove the payment form from the parent page. Calling this function removes the iframe and its event listeners:

      tokenizer.destroy();

      Use tokenId instead of hostedTokenizationId

      Our platform allows you to process transactions with both the hostedTokenizationId and the tokenId. The flow for the former is described in this chapter. Using TokenIDs requires you to modify the flow as follows:

      As steps 1. – 4. and 7. – 12. are identical to the flow using the hostedTokenizationId, we have only added them as stubs here. Check the dedicated chapter for details.
      1. A payment request is initiated.
      2. Get a valid tokenization URL by a Create Hosted Tokenization call.
      3. Add a code snippet to your checkout page, allowing you to display the tokenization form with the valid tokenization URL as an iframe on your check-out page.
      4. Your customer enters her/his credit card data on in the iframe.
      5. Get the token for the actual payment.
        Recover the result of the tokenization by performing a GetHostedTokenization call from your backend
        Use the following code sample for the request:

      For requests to our TEST environment: https://payment.preprod.anzworldline-solutions.com.au/v2/MERCHANT_ID/hostedtokenizations/hostedTokenizationId
      For requests to our LIVE environment: https://payment.anzworldline-solutions.com.au/v2/MERCHANT_ID/hostedtokenizations/hostedTokenizationId 
      1. Create the actual payment with the token. Send a CreatePayment request to our server. Use the following code sample for the request:
      1. You redirect your customers to their issuing bank for a 3-D Secure check. The customers identifies themselves
      2. Our system receives the result from the issuer
      3. We submit the actual financial transaction to the acquirer to process it
      4. We redirect your customer to your ReturnUrl
      5. You request the transaction result from our platform via GetPayment or receive the result via webhooks
      6. If the transaction was successful, you can deliver the goods / services
        12' (optional): Delete the token

      Pre-select available card schemes

      You can exclude or preselect specific card schemes from the iframe using the properties from object paymentProductFilters in your CreateHostedTokenization request:

      • exclude.products: Array of paymentProductIds to be filtered out
      • restrictTo.products: Array of paymentProductIds that should be available

      Find the value for the individual paymentProductIds in column "Payment product id" in this overview.

      • Find detailed information about this object and its properties in our CreateHostedTokenizationAPI.
      • exclude will override any value in restrictTo and thereby ensure exclusion.
      • If your customers enter a number from any card scheme you have made unavailable via exclude, the payment mask will display "Card number incorrect or incompatible".


      Was this page helpful?

      Do you have any comments?

      Thank you for your response.