Integration and Testing

[jlhutto]

I'm currently testing and integrating accept.js 

I'm using the form button in the api for integration of the hosted form (below)

But I'm concerned that it exposes my api login and public key?

When I did a source screen it shows my information.   Can't anyone then use it to process a credit card with my credentials ?   

data-apiLoginID="YOUR API LOGIN ID" 
data-clientKey="YOUR PUBLIC CLIENT KEY"

<form id="paymentForm"
method="POST"
action="https://YourServer/PathToExistingPaymentProcessingScript">
<input type="hidden" name="dataValue" id="dataValue" />
<input type="hidden" name="dataDescriptor" id="dataDescriptor" />
<button type="button"
class="AcceptUI"
data-billingAddressOptions='{"show":true, "required":false}'
data-apiLoginID="YOUR API LOGIN ID"
data-clientKey="YOUR PUBLIC CLIENT KEY"
data-acceptUIFormBtnTxt="Submit"
data-acceptUIFormHeaderTxt="Card Information"
data-responseHandler="responseHandler">Pay
</button>
</form>

[Renaissance]

That is something else. I’m not the best person to answer this I think, but without knowing any simpler way, I would be tempted to do some sort of encrypt/decrypt function or at least a base64 encode or decode, or something. Your payment script is presumably not visible in the browser, so you could have it decrypt your credentials from the post data.

But I am being far too complicated. There has to be an easier way to fix this. I’m going to stay tuned to this one out of mere curiosity. I’ve never done a js integration but this is a good heads up for when I do.

[RichardH Administrator]

Hello @jlhutto

Your API Login is not sensitive information and is used with the public key to encrypt the payment information and return a payment nonce. 

You then submit the nonce to the gateway securely from your server using your API Login and Transaction Key or with OAuth. 

Richard