Accepting Credit Card Payments at U of I

1
Accepting Credit Card Payments at U of I

• Implementation and BestPractices

2
Welcome!
3
New Features

• Updated look and feel (customizable)
• American Express and Discover
• AVS enforcement
• Multiple reconciliation accounts
• Server to Server messaging
• Message Validation (HMAC)
• Direct Payments (with restrictions)

4
Demo
5
Implementation

• 3 messages
• 1. RegisterCCPayment
• 2. QueryCCPayment
• 3. CaptureCCPayment
• And a transaction database on your side

6
Sending a Message

• Always use HTTPS
• Send as a Form post
• SiteID Store Number in CyberCash
• Timestamps must be in UTC
• Generating a certification

7
Receiving a Response

• Payload is in Entity-body
• Response pairs separated by a CRLF
• Only ResponseCode 0 is signed
• First parse each line, then parse each name/value
  pair
• Web services? XML? Not yet, but

8
Odds and Ends

• Send key and receive key are different
• Generate a new ReferenceID each time
• Check how your system expects the key
• Check how your system outputs the hash
• Give them a receipt

9
Pitfalls to Avoid

• Beware of multiple browser windows
• Dont send a second capture request
• Dont send customers through test site
• Dont re-use ReferenceIDs

10
Other Best Practices

• Keep reports in sync with business day
• Triple check your CFOAPALs
• Watch logs
• Validate user input
• Keep server patched, etc.
• Policy link http//www.obfs.uillinois.edu/manual/
  central_p/sec5-11.html

11
Questions?