Posts: 6
Registered: ‎02-04-2019

accept hosted form button... with YOUR API LOGIN ID

I'm currently testing and integrating accept.js 

I'm using the form button in the api for integration of the hosted form (below)

But I'm concerned that it exposes my api login and public key?

When I did a source screen it shows my information.   Can't anyone then use it to process a credit card with my credentials ?   


data-apiLoginID="YOUR API LOGIN ID" 




<form id="paymentForm"
<input type="hidden" name="dataValue" id="dataValue" />
<input type="hidden" name="dataDescriptor" id="dataDescriptor" />
<button type="button"
data-billingAddressOptions='{"show":true, "required":false}'
data-apiLoginID="YOUR API LOGIN ID"
data-acceptUIFormHeaderTxt="Card Information"


Trusted Contributor
Posts: 364
Registered: ‎11-05-2018

Re: accept hosted form button... with YOUR API LOGIN ID

That is something else. I’m not the best person to answer this I think, but without knowing any simpler way, I would be tempted to do some sort of encrypt/decrypt function or at least a base64 encode or decode, or something. Your payment script is presumably not visible in the browser, so you could have it decrypt your credentials from the post data.

But I am being far too complicated. There has to be an easier way to fix this. I’m going to stay tuned to this one out of mere curiosity. I’ve never done a js integration but this is a good heads up for when I do.
Posts: 2,724
Topics: 57
Kudos: 237
Blog Posts: 67
Registered: ‎12-05-2011

Re: accept hosted form button... with YOUR API LOGIN ID

Hello @jlhutto


Your API Login is not sensitive information and is used with the public key to encrypt the payment information and return a payment nonce. 


You then submit the nonce to the gateway securely from your server using your API Login and Transaction Key or with OAuth. 



Build modern websites and mobile applications without increasing PCI burden using Authorize.Net Accept

Still using SIM, DPM or AIM? Please check our upgrade guide for details on migrating to our full Authorize.Net API.