NAV Navbar

Getting Started

The GloballyPaid Payments API is organized around REST.

In order to get started you will need to request a Secret API Key and HMAC Encryption Key from GloballyPaid support. The secret key identifies your application to the GloballyPaid system. The HMAC Encryption Key is used for creating the required HMAC SHA 256 signature header for each request.

Authentication

Example code for generating the HMACSHA256 hash:

// utility method for creating the HMAC signature
public string GenerateHMACSHA256Hash(string message, string secret)
{
    secret = secret ?? "";
    var encoding = new ASCIIEncoding();
    byte[] keyByte = encoding.GetBytes(secret);
    byte[] messageBytes = encoding.GetBytes(message);
    try
    {
        using (var hmacsha256 = new HMACSHA256(keyByte))
        {
            byte[] hashmessage = hmacsha256.ComputeHash(messageBytes);
            return Convert.ToBase64String(hashmessage);
        }
    }
    catch (Exception ex)
    {
        // handle any errors        
    }
}

private async Task ProcessData()
{
    HttpResponseMessage response = new HttpResponseMessage();

    try
    {
        // prepare data
        ProcessorRequest.RawRequest = _data;
        var jsonString = JsonConvert.SerializeObject(_data, Formatting.Indented, new JsonSerializerSettings
        {
            NullValueHandling = NullValueHandling.Ignore
        });
        var signedData = _encryptionService.GenerateHMACSHA256Hash(jsonString, _merchantAccount.Key);
        var client = _clientFactory.CreateClient();
        client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
        client.DefaultRequestHeaders.Add("hmac", signedData);
        var content = new StringContent(jsonString);

        // send data
        response = await client.PostAsync(_pathUrl, content);

    }
    catch (Exception ex)
    {
        // handle any errors
    }
}

GloballyPaid requires that all calls to the Payments API are secured with an HMAC header.

Your application is already identified by your Secret API Key. The HMAC header provides an additional layer of security by insuring that the request that you sent to the GloballyPaid API was not altered by a third party in transit.

Your application takes the request object and encrypts its JSON form using the public key of a keypair that is issued to you by GloballyPaid.

When the GloballyPaid API receives the request, it decrypts the HMAC header content using the private key from the same keypair and then compares the decypted content to the actual request object received in the request body. If the decrypted HMAC header does not match the request object the API request will be rejected with a 401 Unauthorized.

Tokens

The Token Request Object

{
    "payment_instrument": {
      "type": "creditcard",
      "creditcard": {
        "number": "4111111111111111",
        "expiration": "0123",
        "cvv": "123"
      },
      "billing_contact": {
        "first_name": "Test",
        "last_name": "Tester",
        "address": {
          "line_1": "123 Main St",
          "city": "NYC",
          "state": "NY",
          "postal_code": "92657",
          "country": "United States"
        },
        "phone": "614-340-0823",
        "email": "test@test.com"
      }
    }
}

The Token Response Object

{
    "id": "tok_S_AdoYpxnkurNYEx5Xd11g",
    "type": "CreditCard",
    "brand": "Visa",
    "last_four": "1111",
    "expiration": "0123",
    "billing_contact": {
        "first_name": "Test",
        "last_name": "Tester",
        "address": {
            "line_1": "123 Main St",
            "line_2": null,
            "city": "NYC",
            "state": "NY",
            "postal_code": "92657",
            "country": "United States"
        },
        "phone": "614-340-0823",
        "email": "test@test.com"
    },
    "created": "2020-09-18T19:45:05.7845109Z",
    "updated": "2020-09-18T19:45:05.7845109Z"
}

In order to charge a credit or debit card, your application must first tokenize the card data. Typically, this step is performed using our JS SDK. This allows you to tokenize the card data by passing it directly from the client application (a browser in most cases) to the GloballyPaid servers. GloballyPaid will securely store the card data and return a Token to your application.

After a period of time, or after the Token is used in a ChargeRequest, the Token will be automatically deleted. If you wish to store card data for future use, you must create a Customer and a PaymentInstrument associated to that Customer. For your convenience, this can be done very simply, in a single step, by configuring the ChargeRequest object.

Converting Tokens to Permanent Payment Instruments

Set the save_payment_instrument parameter to true in order to convert the Token object into a PaymentInstrument automatically after the authorization is approved.

You will want to store the payment instrument ID that is returned in the response in your applications database for future use with Card On File charges.

Payment Instruments

In most cases, integrated applications will include a backend service that stores information about the application's users and their payment methods. This allows the application to expose user interfaces where the user can add / edit / delete their cards on file, and maintain their user profile.

The GloballyPaid vault allows storing of complete cardholder information, including name and billing address (used for AVS checks).

You may want to use the GloballyPaid vault is the "single source of truth" in your application, rather than trying to keep cardholder profile data in sync between the GloballyPaid vault and your backend system. The GloballyPaid API provides methods to create, get, update, delete, and list PaymentInstruments by customer ID.

You can build a fully functional page for your users to maintain their cards on file without storing any data in your application other than the GloballyPaid Customer ID.

Maintaining Payment Instruments in the Vault

Creating a Customer

{
  "client_customer_id": "123457",
  "first_name": "Jane",
  "last_name": "Doe",
  "address": {
    "line_1": "5555 Main St",
    "line_2": null,
    "city": "Anytown",
    "state": "UT",
    "postal_code": "12345",
    "country": "US"
  },
  "phone": "7145551212",
  "email": "jane.doe@example.com"
}

Updating a Customer

{
    "id": "{{customer_id}}",
    "client_customer_id": "123457",
    "first_name": "Jane",
    "last_name": "Test",
    "address": {
        "line_1": "5555 Main St",
        "line_2": null,
        "city": "Anytown",
        "state": "UT",
        "postal_code": "12345",
        "country": "US"
    },
    "phone": "7145551212",
    "email": "jane.test@example.com"
}

The Customers API allows you to create, update, get, delete, and list all of your Customers.

You get a specific customer with a simple GET request: https://transactions.globallypaid.com/api/v1/customer/{id}

You can list all of your cusotmers by ommitting the customer ID paramenter in the URL: https://transactions.globallypaid.com/api/v1/customer/

Processing Payments

The Charge Request Object

{
  "client_customer_id": null,
  "amount": 1299,
  "fees": [
    {
      "fee_type": "C001",
      "description": "Convenience Fee",
      "amount": "399"
    }
  ],
  "capture": true,
  "recurring": false,
  "currency_code": "USD",
  "country_code": "US",
  "client_transaction_id": "154896575",
  "client_transaction_description": "Burger Joint",
  "client_invoice_id": "758496",
  "avs": true,
  "source": "tok_S_AdoYpxnkurNYEx5Xd11g",
  "shipping_info": null,
  "session_id": "c8960e54409ae096793b15f027afd8d7",
  "user_agent": null,
  "browser_header": null,
  "save_payment_instrument": false
}

Once you have retrieved a Token, you can create a ChargeRequest object in order to charge the credit or debit card. In response, you will receive a ChargeResponse object. All of your original request data will be echoed in the response along with other important information about the result.

The Charge Request

Parameter Type Description
client_customer_id string A unique identifier for the person in the Company’s system.
amount integer A non-negative integer representing the smallest unit of the specified currency (example; 499 = $4.99 in USD)
fees [...] A list of FeeItems Fee Items allow you to specify individual fees that can be exposed in reporting for your accounting purposes
capture boolean When set to true (default), the charge will be immediately captured against the payment method specified. When set to false, performs an authorization only and must be captured explicitly later.
recurring boolean Specifies whether the transaction is a recurring charge (eg: subscription, auto-ship, etc) or not. Setting this property properly positively affects authorization rates.
currency_code string The ISO currency code for this charge request. (eg: USD)
country_code string The two character country code for this charge (eg: US)
client_transaction_id string A unique identifier for the transaction in the Company’s system.
client_transaction_description string A short description for this charge
client_invoice_id string The Company’s invoice number/id for this charge
avs boolean The AVS setting should almost always be true (default)
source string The ID of the payment method to be charged
shipping_info ShippingContact An object of type ShippingContact
session_id string The Kount device session Id used for Kount Fraud Checks. Must be enabled in Company configuration
user_agent string The user-agent string of the browser requesting the charge. Used for enhanced fraud checks.
browser_header string The browser header. Used for enhanced fraud checks.
save_payment_instrument boolean When 'true', GloballyPaid will save the card data for future use and return a PaymentInstrument ID in the response

The Charge Response

The Charge Response Object

{
    "id": "ch_qCJ6ge7PRkivHMHYovRpyg",
    "response_code": "00",
    "message": "Approved",
    "approved": true,
    "source": {
        "id": "tok_S_AdoYpxnkurNYEx5Xd11g",
        "type": "CreditCard",
        "brand": "Visa",
        "last_four": null,
        "expiration": "0627",
        "billing_contact": {
            "first_name": "Test",
            "last_name": "Tester",
            "address": {
                "line_1": "123 Main St",
                "line_2": null,
                "city": "NYC",
                "state": "NY",
                "postal_code": "92657",
                "country": "United States"
            },
            "phone": "614-340-0823",
            "email": "test@test.com"
        },
        "created": "2020-09-18T19:45:05.784+00:00",
        "updated": "2020-09-18T19:45:05.784+00:00"
    },
    "amount": 10,
    "captured": true,
    "recurring": false,
    "currency_code": "USD",
    "country_code": "US",
    "billing_info": {
        "first_name": "Test",
        "last_name": "Tester",
        "address": {
            "line_1": "123 Main St",
            "line_2": null,
            "city": "NYC",
            "state": "NY",
            "postal_code": "92657",
            "country": "United States"
        },
        "phone": "614-340-0823",
        "email": "test@test.com"
    },
    "client_transaction_id": "154896575",
    "client_transaction_description": "ChargeWithToken",
    "client_invoice_id": "758496",
    "save_payment_instrument": true,
    "new_payment_instrument": {
        "id": "card_AAabOY3elk6mU6eOHLCrXQ",
        "type": "CreditCard",
        "brand": "Visa",
        "last_four": "7117",
        "expiration": "0627",
        "billing_contact": {
            "first_name": "Test",
            "last_name": "Tester",
            "address": {
                "line_1": "123 Main St",
                "line_2": null,
                "city": "NYC",
                "state": "NY",
                "postal_code": "92657",
                "country": "United States"
            },
            "phone": "614-340-0823",
            "email": "test@test.com"
        },
        "created": "2020-09-18T20:00:49.9692404Z",
        "updated": "2020-09-18T20:00:49.9692404Z"
    },
    "kount_score": null,
    "completed": "2020-09-18T20:00:50.0167285Z"
}

The ChargeResponse object provides a number of important pieces of information.

Parameter Type Description
id string The ID of the Charge object
response_code string Indicates the success or failure of the transaction
message string Details about the result of the transaction
approved boolean Convenience attribute. Indicates approved / declined.
approval_code string
cvv_result string The result of the CVV check, if one was performed
avs_result string The result of the AVS check, if one was performed
source PaymentInstrumentToken The original Token that was used for the transaction
amount integer($int32) The Amount that was charged to the PaymentInstrument
fees A list of Fee objects For convenience in certain types of billing
captured boolean Indicates whether or not the Charge was captured. The ChargeRequest capture parameter defaults to true. This value will normally be true unless the Charge was declined.
recurring boolean Echoed from ChargeRequest
currency_code string Echoed from ChargeRequest
country_code string Echoed from ChargeRequest
billing_info BillingContact{...} Echoed from ChargeRequest
shipping_info ShippingContact{...} Echoed from ChargeRequest
client_transaction_id string Echoed from ChargeRequest
client_transaction_description string Echoed from ChargeRequest
client_invoice_id string Echoed from ChargeRequest
save_payment_instrument boolean Echoed from ChargeRequest
new_payment_instrument PaymentInstrument If a PaymentInstrument was created, per the save_payment_instrument parameter, it will be returned here so that your application can store it.
completed datetime A timestamp indicating the time that the Charge object was created.

Optimizing Authorizations

Increased authorizations means increased sales, and avoiding fraud helps keep your business's money where it belongs. There are a few things that you can do when integrating to help with both objectives.

  1. Always pass as much information as you can in the Customer and PaymentMethod objects. For user attended transactions (meaning your user is actually typing in their payment method data), always include the CVV.Increased
  2. Including complete billing address information also improves authorizations.
  3. If the transaction is a recurring charge (typically requested by an automated billing system), make sure to include and set the recurring parameter to true. GloballyPaid will look up the original transaction and pass additional information to the card networks that helps improve authorization rates.

Response Codes

Code Description
00 Transaction was Approved
200 Declined or blocked - Call your card bank
201 Do not honor - Call your card bank
202 Insufficient Funds
203 Over Limit
204 Transaction not allowed
220 Invalid payment type or data
221 No such card issuer
222 No card number on file with issuer
223 Expired card
224 Invalid expired date
225 Invalid card security code
240 Call issuer for further information
250 Pick up Lost or Stolen card
251 Lost or Stolen card
252 Stolen card
253 Fraudulent card
260 Declined with further information available
261 Declined - Stop all recurring payment
262 Declined - Stop this recurring program
263 Declined - Update cardholder data available
264 Declined - Retry in few days
300 Rejected
400 Transaction error returned by processor
410 Invalid merchant configuration
411 Merchant account is inactive
420 Communication error
421 Communication error with issuer
430 Duplicate at issuer or processor
440 Processor format error
441 Invalid transaction info or card number
460 Processor feature not available
461 Unsupported card type
24 Decline Test Card
500 Unknown Processor Response

Refunds

The RefundRequest Object

{
  "amount": 1299,
  "charge": "ch_klajsdi81273hjqwde98123iu",
  "reason": null
}

To refund a payment via the API, create a Refund and provide the ID of the charge to be refunded. You can also optionally refund part of a charge by specifying an amount. You can perform refunds with the API or through the Dashboard.

There is no need to track the captured or settled status of transactions in your system. GloballyPaid keeps track of the transaction's status and will perform a void when necessary.

Customers

The Customer object

{
  "id": "cus_AtYaPoX2UECY-37FjNRhtg",
  "client_id": "1128",
  "client_customer_id": "123457",
  "created": "2020-04-18T01:37:09.0726458+00:00",
  "updated": "2020-04-18T01:37:09.0726466+00:00",
  "first_name": "Jane",
  "last_name": "Doe",
  "address": {
    "line_1": "5555 Main St",
    "line_2": null,
    "city": "Anytown",
    "state": "UT",
    "postal_code": "12345",
    "country": "US"
  },
  "phone": "7145551212",
  "email": "jane.doe@example.com"
}

Customer objects allow you to perform recurring charges, and to track multiple charges that are associated with the same customer. The API allows you to create, delete, and update your customers. You can retrieve individual customers as well as a list of all your customers.

Payment Methods

The PaymentMethod Object

{
    "id": "card_oozilotWwkCR88ufcWtTdA",
    "type": "CreditCard",
    "last_four": "6543",
    "expiration": "0422",
    "kount_session_id": null,
    "billing_contact": {
      "first_name": "John",
      "last_name": "Doe",
      "address": {
        "line_1": "123 Any St",
        "line_2": "Apt 23",
        "city": "Anytown",
        "state": "OH",
        "postal_code": "32453",
        "country": "US"
      },
      "phone": "2125551212",
      "email": "jdoe@example.com"
    },
    "created": "2020-04-18T01:37:09.0762289+00:00",
    "updated": "2020-04-18T01:37:09.0762296+00:00"
}

The PaymentMethod object represents your customer's payment instruments. They can be used with ChargeRequests to collect payments or saved to Customer objects to store instrument details for future payments.

In order to protect your business from PCI Compliance issues, PaymentMethods are created from Tokens rather than directly. Your application should never pass unencrypted cardholder data from a browser or mobile application to your servers. Instead, use the GloballyPaid API to create a Token first, by passing the cardholder data directly from the application to the GloballyPaid servers. Then create a PaymentMethod through one of two methods:

  1. Pass the PaymentMethod data in a ChargeRequest and set the save_payment_instrument parameter to true.
  2. Create a PaymentMethod directly via API, by calling the Create endpoint and passing a valid customer ID as well as the token ID. This will create the PaymentMethod and associate it to the Customer.

Errors

The GloballyPaid API uses the following error codes:

Error Code Meaning
400 Bad Request -- Your request is invalid.
401 Unauthorized -- Your API key is wrong.
403 Forbidden -- The endpoint requested is hidden for administrators only.
404 Not Found -- The specified endpoint could not be found.
405 Method Not Allowed -- You tried to access a request with an invalid method.
406 Not Acceptable -- You requested a format that isn't json.
410 Gone -- The endpoint requested has been removed from our servers.
429 Too Many Requests -- Your application is making too many requests! Slow down!
500 Internal Server Error -- We had a problem with our server. Try again later.
503 Service Unavailable -- We're temporarily offline for maintenance. Please try again later.

JS SDK

Installation

Installation

npm install @globallypaid/js-sdk --save
yarn install @globallypaid/js-sdk
<script src="https://unpkg.com/@globallypaid/js-sdk@latest"></script>

You can install SDK using NPM, Yarn or with a script tag.

Note that if you use pre-defined forms they are injected as an iframe. So please be sure to check your CSP (Content Security Policy)

Initialization

Include the Globallypaid.js script on checkout page of your site—it should preferably be loaded directly from unpkg.com, rather than included in a bundle or hosted yourself.

Using Globallypaid.js as a module

We also provide an NPM package that makes it easier to load and use Globallypaid SDK as a module. Facade class for Globallypaid SDK is GloballyPaidSDK(publishableKey)

We also support the first version (GPG). The facade class is GPGSDK(publishableKey). All the facade methods are the same in both v1 and v2 facades.

Initialize API (V2)

import { GloballypaidGateway } from '@globallypaid/js-sdk';

const gpg = new GloballyPaidSDK('pk_live_...');

Initialize API (V1)

import { GPGSDK } from '@globallypaid/js-sdk';

const gpg = new GPGSDK('pk_live_...');

Globallypaid Forms

Globallypaid Forms are customizable UI components used to collect sensitive information in your payment forms.

Create UI form instance

gpg.createForm(type, options?)

const cardForm = gpg.createForm('card-simple');

This method creates an instance of a specific Form. It takes the type of Form to create as well as an options object.

Parameter Type Description
type string The UI form type to display
options? object A set of options to configure the UI Form

Form types:

Type Description
card-simple Simple card with card number, cvv, expiration date and postal code
card-extended Extended card with user personal and card information

Form with options example

const cardSimpleCustomized = gpg.createForm('card-simple', {
    style: {
        base: {
            width: '560px',
            buttonColor: 'white',
            buttonBackground: '#558b2f',
            inputColor: '#558b2f',
            color: '#558b2f'
        }
    }
});

Available options:

Option Type Description
style FrameStyle Add custom user styling

FrameStyle type:

Option Type Description
base object Base styling
invalid object Invalid form styling

Base type:

Option Type Example Description
width string '500px' The width of a form (100% by default)
height string '500px' The height of a form (100% by default)
height string '500px' The height of a form (100% by default)
fontFamily string 'Roboto, sans-serif' Font family of a form (Roboto by default)
fontSize string '16px' Font size of a form
inputColor string '#000' Input element color
color string '#fff' Labels color
border string '1px solid green' Sets frame border
background string '#fafafa' Frame background (transparent by default)
buttonBackground string '#fefefe' Submit button background
buttonColor string '#ffffff' Submit button text color

Invalid type:

Option Type Example Description
color string '#fefefe' Error messages text and input border color

Mount form to a DOM node

form.mount(nodeId)

page.html

<div id="gpg-form-container"></div>

script.js

const cardSimple = gpg.createForm('card-simple');

cardSimple.mount('gpg-form-container');
Parameter Type Description
nodeId string The id of a container where your Form will be mounted.

The mount(nodeId) method attaches your Form to the DOM. Method accepts the id of an element (e.g., 'gpg-form-container);

You need to create a container DOM element to mount a Form.

Form events

The only way to communicate with your Form is by listening to an event. Forms might emit any of the events below. All events have a payload object that has it's own type.

form.on(eventType, callback, errorCallback?)

Subscribe to token creation event

cardSimple.on('TOKEN_CREATION',
    (token) => {
        cardSimple.showSuccess();
        console.log(token);
        // Do whatever you need with the token.
        // Send a request to yours backend to perform a charge request
    },
    (error) => {
        cardSimple.showFailed();
        console.log(error);
    }
);
Parameter Type Description
eventType string The name of the event. In this case, 'TOKEN_CREATION'
callback function A callback function that you provide that will be called when the event is fired and the result is successful
errorCallback? function A callback function that you provide that will be called when the event error is fired.
Event Callback payload type Description
TOKEN_CREATION TokenResponse or ErrorResponse Subscribe to a form submission and receive token response in a callback payload.

TokenResponse example (V2)

{
    "id": "tok_xLS3xebo1kCHMSn-7HO3pg",
    "type": "CreditCard",
    "brand": "Visa",
    "last_four": "1111",
    "expiration": "1234",
    "billing_contact": {
      "first_name": null,
      "last_name": null,
      "address": {
        "line_1": null,
        "line_2": null,
        "city": null,
        "state": null,
        "postal_code": "12345",
        "country": null
      },
      "phone": null,
      "email": null
    },
    "created": "2020-10-16T12:57:49.4026471Z",
    "updated": "2020-10-16T12:57:49.4026471Z"
}

ErrorResponse example (V2)

{
    "id": "LuXHMy6_-UuD-gZTP43PRw",
    "response_code": "400",
    "message": "InvalidRequestException: Illegal Card expiration format. Must be MMYY. MM is a month (01-12), YY is a year.",
    "approved": false,
    "completed": "2020-10-29T12:27:46.2514732Z", 
    "success": false
}

TokenResponse example (V1)

{
    "Token": "4777770000000012",
    "EmployeeID": "123",
    "CCLastFour": "1111",
    "CCFirstFour": "4111",
    "CCBrand": "Visa",
    "ExpirationDate": "1234",
    "FirstName": "FirstName",
    "LastName": "LastName",
    "Address1": "Address1",
    "Address2": "Address2",
    "City": "City",
    "State": "ca",
    "PostalCode": "36576",
    "Country": "USA",
    "Phone": null,
    "Email": null
}

ErrorResponse example (V1)

{
    "Result": "ERROR",
    "ErrorCode": "400",
    "ErrorMessage": "Invalid cardholder data"
}

Show success form state

cardSimple.showSuccess()

Show success state of a form.

Success state example

cardSimple.showSuccess();

Show error form state

cardSimple.showError(errorMessage)

Show error message under the submit button.

Failed state example

cardSimple.showError('Transaction failed');

Reset form

cardSimple.resetForm()

Reset a form to its default state.

Reset form example

cardSimple.resetForm();

Unmount Form from the DOM

cardSimple.unmount()

Removes Form from the DOM if it is mounted.

Unmount example

cardSimple.unmount();

Custom payment form

There is a possibility to tokenize card without using pre-defined Globallypaid UI forms. SDK provides a function to tokenize input card.

Create token explicitly (V2)

gpg.createToken(cardNumber, cvv, expiration, zipCode).then(response => {
    console.log(response);
    // Do whatever you need with the token.
    // Send a request to yours backend to perform a charge request
}).catch(error => {
    console.log(error);
});

gpg.createToken(cardNumber, cvv, expiration, zipCode)

This method returns a Promise with the TokenResponse

Parameter Type Description
cardNumber string Card number (e.g. 4111111111111111)
cvv string Card CVV (e.g. 123)
expiration string Card expiration date MMYY (e.g. 1224)
zipCode string Zip code (e.g. 12345)

Create token explicitly (V1)

const tokenRequestPayload = { 
    Payload: "4111111111111111",
    Expiration: "1234",
    CVV: "1234",
    FirstName: "efsf",
    LastName: "wefwe",
    Address1: "fdsdgfg",
    Address2: "123",
    City: "fghfphlko",
    State: "ca",
    PostalCode: "36576",
    Country: "USA",
    Phone: "1234256545",
    Email: "fwefw@dasd.com"
};

gpg.createToken(tokenRequestPayload).then(response => {
    console.log(response);
    // Do whatever you need with the token.
    // Send a request to yours backend to perform a charge request
}).catch(error => {
    console.log(error);
});

gpg.createToken(tokenRequestPayload)

This method returns a Promise with the TokenResponseV1

Parameter Type Description
tokenRequestPayload TokenRequestV1 See the full example in the code sample