Bank Submission Notice

This documentation set is being maintained for merchant onboarding, bank review, and production-readiness assessment, with emphasis on sandbox separation, key control, signed webhooks, auditability, and replay-safe transaction handling.

Cards (Visa and Mastercard)

CARD PAYMENTS

Accept debit and credit cards through PaynPlus using either hosted checkout or a tokenization-first flow. Hosted checkout is recommended for most merchants because it keeps card entry away from merchant systems.

Recommended Path

Use PaynPlus Checkout when you want the safest and fastest route to card acceptance. The customer enters the card on a hosted PaynPlus page and your server only processes the final result.

Advanced Path

Use tokenization when you need to start on your own frontend but still want PaynPlus to handle the sensitive card capture screen. Secret keys must always stay on the backend.

Tokenization Flow

1. Create a tokenize session

Your backend requests a tokenization session and receives a PaynPlus-hosted card entry URL.

2. Redirect the customer

Redirect the browser to the hosted tokenize page so card details are entered in the PaynPlus environment.

3. Wait for final confirmation

Use the success redirect only as a customer experience signal. Use the webhook event as the source of truth for payment completion.

Example Request

POST /v1/payment-intents/tokenize

curl -X POST https://api.paynplus.com/v1/payment-intents/tokenize \
  -H "Authorization: Bearer sk_live_your_secret_key" \
  -H "Content-Type: application/json" \
  -d '{
    "reference_id": "ORDER-90210",
    "success_url": "https://merchant.example/success?ref=ORDER-90210",
    "cancel_url": "https://merchant.example/cancel?ref=ORDER-90210"
  }'

Sandbox Testing Notes

Confirm that card data is tokenized or collected on a PaynPlus-hosted page whenever possible.
Verify that your frontend never stores raw PAN, CVV, or expiry in local storage or application logs.
Test a successful authorization, an issuer decline, a customer cancellation, and a webhook retry.
Use the sandbox card profiles issued by PaynPlus during onboarding for success and failure scenarios.

Final Reminder

A successful redirect alone is never enough for final fulfillment. Always verify the signed webhook and then update your order, invoice, or reservation status.