
Gateway Developer Guide and Reference 07 January 2014 33
2
Secure Token
This section describes the secure token.
“Secure Token” on page 33
“Integrating the Secure Token With the Hosted Checkout Pages” on page 34
“Integrating the Secure Token Without the Hosted Checkout Pages: Transparent Redirect”
on page 34
“Posting To the Hosted Checkout Page” on page 36
“Using the PARMLIST Parameter” on page 46
IMPORTANT: Use only the Payflow parameters described in this guide with the Secure
Token. If you are using the legacy Payflow Link HTML input tag integration,
refer to the
Payflow Link User’s Guide for information on legacy Payflow Link
features supported by your integration.
About the Secure Token
Use a secure token to send non-credit card transaction data to the Gateway server for safer
storage. The secure token prevents anyone from intercepting or manipulating the data. You
must use a secure token if you use hosted checkout pages. The token is good for a one-time
transaction and is valid for 30 minutes.
NOTE: PayPal Payments Pro and Payflow Pro merchants who do not use a secure token must
host their own payment pages. When hosting your own pages, you are responsible for
meeting PCI requirements by handling data securely. PayPal Payments Advanced and
Payflow Link merchants must use a secure token with hosted checkout pages.
To obtain a secure token, pass a unique, 36-character secure token ID and set
CREATESECURETOKEN=Y in a request to the Gateway server. The Gateway server associates
your ID with a secure token and returns the token as a string of up to 32 alphanumeric
characters.
To pass the transaction data to the hosted checkout page, you pass the secure token and secure
token ID in an HTTP form post. The token and ID trigger the Gateway server to retrieve your
data and display it for customer approval.
NOTE: You cannot modify the data sent with a secure token, with one exception. You can
configure PayPal Manager to allow you to modify billing and shipping information.
Comentários a estes Manuais