The Three Step Redirect is the preferred payment processing API solution for a custom website. Web developers programming with this integration method will significantly reduce a merchants PCI footprint without sacrificing end user look and feel.
Step One : Submit all transaction details to the payment gateway except the customer's sensitive payment information. The payment gateway will return a variable form-url.
Step Two : Create an HTML form that collects the customer's sensitive payment information and use the form-url that the payment gateway returns as the submit action in that form.
Step Three : Once the customer has been redirected, obtain the token-id and complete the transaction through an HTTPS POST including the token-id which abstracts the sensitive payment information that was collected directly by the payment gateway.
Step 1 : your payment application will submit a behind-the-scenes HTTPS direct POST that includes transaction variables, including an additional variable redirect-url, which is a URL that must exist on your web server that handles a future browser redirect. Sensitive payment information such as cc-number, cc-exp, and cvv cannot be submitted during step one. The payment gateway will generate and return the form-url variable containing a unique URL to be used in Step 2.
Step 2 : you must develop an HTML form that collects at least the customer's sensitive payment information such as cc-number, cc-exp, and cvv. You must use the form-url obtained in step one as the action in the HTML of your payment form. When the customer submits the form, the customer's browser will transparently POST the contents of the payment form directly to the payment gateway. This methodology keeps your web server and payment application from seeing or transmitting any credit card data or other sensitive data. Once the payment gateway has collected the cardholder data, the customer's browser will be instructed to return to the redirect-url on your web server. Furthermore, the payment gateway will generate and append a unique variable named token-id to the redirect-url in the GET query string. This token-id is an abstraction of the customer's sensitive payment information that the payment gateway collected. Your redirect-url script must parse the token-id for use in step three.
Step 3 : To complete the transaction, you will submit another behind-the-scenes HTTPS direct POST including only the token-id and api-key. This token-id is used to "tie" together the initial customer information with the sensitive payment information that the payment gateway collected directly.
Every merchant account will have to stay compliant by completing a SAQ Self Assessment Questionnaire every year or they will be charged a monthly PCI non compliance fee. PCI monthly & annual fees may still apply to a merchant account based on PCI Tier level of business.
