Getting Started with REST Developer Guide

This section describes how to use this developer guide and where to find further information.

Audience and Purpose: This guide provides information about how to sign up for a sandbox account and set up the Visa Acceptance Solutions REST API.
Customer Support: For support information about any service, visit the Support Center:

http://developer.visaacceptance.com/support/contact-us.html

Recent Revisions to This Document

25.09.01

Added new set up information for enabling Message-Level Encryption (MLE) using JSON Web Tokens (JWTs). See the Overview of MLE Set Up and Java: Enbaling MLE Using JWTs sections in Step 4: Enable Message-Level Encryption.

25.08.03

This revision contains only editorial changes and no technical updates.

25.08.02

This revision contains only editorial changes and no technical updates.

25.08.01

Added information about username and password requirements for creating a Sandbox account. See these topics:

JWT Messaging: Step 1: Sign Up for a Sandbox Account

HTTP Signature Messaging: Step 1: Sign Up for a Sandbox Account

25.06.01

This revision contains only editorial changes and no technical updates.

25.04.01

Updated the Header field from

Date

to

v-c-date

for HTTP Signature Method. See Elements of an HTTP Message section and Update Header Fields section in Step 3: Construct Messages Using HTTP Signature Security.

25.03.01

This revision contains only editorial changes and no technical updates.

25.02.01

Updated the link in Step 6 and added steps about using the JSON Web Token. SeeStep 3: Construct Messages Using JSON Web Tokens, and added the Create the Authorization Header section.

Updated the description of the signature keyid. See the Update Header Fields section in Step 3: Construct Messages Using HTTP Signature Security.

25.01.02

Added testing information in an Important note in the Secure Communication Requirements section. See Overview of REST.

Added information about the purposes of a sandbox account for the JSON web token and HTTP signature messaging implementations. See Sign Up for a Sandbox Account for JSON Web Tokens and Sign Up for a Sandbox Account for HTTP signature messaging.

25.01.01

This revision contains only editorial changes and no technical updates.

Overview of REST

To get started using the Visa Acceptance Solutions payment API, you must first set up your payment processing system to be REST compliant. Visa Acceptance Solutions uses the REST for developing web services. REST enables communication between a client and server using HTTP protocols.

This guide explains how to set up secure communications between your client and server using one of these methods:

JSON Web Token: JSON Web Tokens (JWTs) are digitally signed JSON objects based on the open standard RFC 7519. These tokens provide a compact, self-contained method for securely transmitting information between parties. These tokens are signed with an RSA-encoded public/private key pair. The signature is calculated using the header and body, which enables the receiver to validate that the content has not been tampered with. Token-based messages are best for applications that use browser and mobile clients.
HTTP Signature: Each request is digitally signed, or the entire request is digitally hashed using a private key. Both the client and server have the same shared secret, which enables each request to be validated on either end. If the request transmission is compromised, the attacker cannot change the request or act as a user without the secret. HTTP signatures can be used only with API requests. They cannot be used in browser or mobile applications.

Secure Communication Requirements

REST-compliant machines communicate with each other using stateless messaging
. Stateless messaging is a loosely coupled connection between a client and server, where each message is self-contained. This connection enables the client and server to communicate without first establishing a communication channel and without managing the state between systems.

To ensure secure communications between the client and server, you must provide these security measures:

Sender Authentication:
A receiver needs to know that a message comes from a trusted entity.

Message Encryption:
By encrypting the message before transmission and decrypting the message when received, you prevent man-in-the-middle attacks.

IMPORTANT

When building your connection to the Visa Acceptance Solutions payment gateway, ensure that you have implemented controls to prevent card testing or card enumeration attacks on your platform. For more information, see the best practices guide. When we detect suspicious transaction activity associated with your merchant ID, including a card testing or card enumeration attack, Visa Acceptance Solutions reserves the right to enable fraud management tools on your behalf in order to mitigate the attack. The fraud team might also implement internal controls to mitigate attack activity. These controls block traffic that is perceived as fraudulent. Additionally, if you are using one of our fraud tools and experience a significant attack, our internal team might modify or add rules to your configuration to help prevent the attack and minimize the threat to our infrastructure. However, any actions taken by Visa Acceptance Solutions would not replace the need for you to follow industry standard best practices to protect your systems, servers, and platforms.

Key Features of REST

These are the key features of REST:

Client/Server model:
Clients and servers are independent from each other, enabling portability and scalability.

Stateless Communication:
Each request is independent.

Uniform Interface:
Architecture is simplified through uniform standards.

Components of REST

A REST message consists of these four components:

Endpoint:
The endpoint is a Uniform Resource Identifier (URI) that shows where and how to find the resource on the internet. For example, to test an authorization request, you can send the request to this endpoint:

https://apitest.visaacceptance.com/pts/v2/payments

.

HTTP Method:
The method is the action performed by the resource. There are four basic HTTP methods:

POST: Create a resource.

GET: Retrieve a resource.

PATCH: Modify a resource.

DELETE: Delete a resource.

Headers:
The header is a collection of fields and their associated values. It provides information about the message to the receiver. Think of it as metadata about the message. The header also contains authentication information that indicates that the message is legitimate.

Body:
The request in JSON format.

Set Up Your
Visa Acceptance Solutions
Account

This overview lists the tasks you must to complete in order to set up your

Visa Acceptance Solutions

account for sending and receiving REST API messages using either JSON Web Token messaging or HTTP signature messaging.

To set up JSON web token messaging, see Set Up JSON Web Token Messaging.

To set up an HTTP signature messaging, see Set Up an HTTP Signature Message.

Set Up JSON Web Token Messaging

To set up JSON Web Token messaging, you will complete the tasks described in this section.

Sign up for a sandbox account. See Step 1: Sign Up for a Sandbox Account.

Create a P12 certificate. See Step 2: Create a P12 Certificate.

Construct a message using a JSON web token. See Step 3: Construct Messages Using JSON Web Tokens.

(Optional) Enable the optional message-level encryption (MLE) feature. See Step 4: Enable Message-Level Encryption.

Go live by transitioning your sandbox account into a production account. See Step 5: Going Live.

Step 1: Sign Up for a Sandbox Account

To begin setting up your account, you must first sign up for a sandbox account. A sandbox account enables you to obtain your security keys and test your implementation. After you verify that your system can send and receive REST messages, you can contact customer service to transition your sandbox account to a production account. Your production account is where you process live payments.

IMPORTANT

A sandbox account cannot process live payments and is intended only for testing.

Follow these steps to sign up for a sandbox account:

Go to the Visa Acceptance Solutions Developer Center sandbox account sign-up page:

https://developer.visaacceptance.com/hello-world/sandbox.html

Enter your information into the sandbox account form, and click Create Account
.

Go to your email and find a message titled: Merchant Registration Details
. Click Set up your username and password now
.

Your browser opens the New User Sign Up wizard.

Enter the organization ID and contact email you supplied when you created your account. Follow the wizard pages to add your name, a username, and a password. Your username and password must meet these requirements:

Username and Password Requirements
Username	Password
Length must be 3-36 characters. Can only contain letters, numbers, periods, dashes, or underscores.	Length must be 12–50 characters. Must contain one upper case letter. Must contain one lower case letter. Must contain one number. Cannot contain the username or organization ID.

Log in to the Business Center.

When you log in for the first time, you must verify your identity through a system-generated email sent to your email account.

Check your email for a message titled: Visa Acceptance Solutions Identification Code
. A passcode is included in the message.

Enter the passcode on the Verify your Identity
page.

You are directed to the Business Center home page.

You have successfully signed up for a sandbox account.

IMPORTANT

A sandbox account cannot process live payments. After you verify that your system can send and receive REST messages, you can contact customer service to transition your sandbox account to a production account.

Step 2: Create a P12 Certificate

A P12 certificate and its private key are necessary for JSON Web Token message security. To create a P12 certificate, you must download a .p12
file from the Business Center and extract its private key.

Create a P12 Certificate

Follow these steps to create a .p12
file if you are using JSON Web Tokens to secure communication.

Log in to the Business Center:

Test:

https://businesscentertest.visaacceptance.com

Production:

https://businesscenter.visaacceptance.com

On the left navigation panel, choose

Payment Configuration > Key Management

.

Click

+ Generate

key.

Under REST APIs, choose

REST – Certificate

, and then click

Generate key

.

If you are using a portfolio account, the Key options window appears, giving you the choice to create a meta key. For more information about how to create a meta key, see Meta Key Creation and Management.

Click

Download key

.

Create a password for the certificate by entering the password into the

New Password

and

Confirm Password

fields, and then click

Generate key

.

The .p12
file downloads to your desktop.

If prompted by your system, approve the location for where the key downloads.

You can create or upload another key by clicking Generate another key
. To view all of your created keys, use the Key Management page.

IMPORTANT

Securely store the .p12
file and password in your system. These credentials are required to implement certain products and you must be able to access them.

Extract the Private Key from the P12 Certificate

When you have your P12 certificate, extract the private key from the certificate. Use this key to sign your header when sending an API request.

IMPORTANT

If you are using the SDK to establish communication, you do not need to extract the private key from the P12 certificate.

Prerequisite

You must have a tool such as OpenSSL installed on your system.

Extract the Private Key

Follow these steps to extract the private key using OpenSSL:

Open the command-line tool and navigate to the directory that contains the P12 certificate.

Enter this command:

openssl pkcs12 -in [certificate name] -nodes -nocerts -out [private key name]

Enter the password for the certificate.

You set this password when you created the P12 certificate in the Business Center.

The new certificate is added to the directory using the private key name you supplied in Step 2.

Test the Shared Secret Key Pair

After creating your key certificate, you must verify that it can successfully process API requests. This task explains how to test and validate your key pair in the Developer Center and the Business Center.

Go to the developer center's API Reference page:

https://developer.visaacceptance.com/api-reference-assets/index.html#static-home-section

On the left navigation panel, click API Endpoints & Authentication
.

Under Authentication and Sandbox Credentials, set the Authentication Type drop-down menu to
JSON Web Token
.

Enter your organization ID in the Organization
field.

Enter your Password in the Password
field.

Click Browse
and upload your p12 certificate from your desktop.

Click Update Credentials
.

A confirmation message states that your credentials are successfully updated.

On the developer center's left navigation panel, navigate to Payments >
POST
Process a Payment
.

Under Request: Live Console, click Send
.

A message confirms that your request was successful with the status code 201.

Log in to the Business Center:

https://businesscentertest.visaacceptance.com

On the left navigation panel, navigate to

Transaction Management > Transactions
.

Under Search Results, verify that the request ID from the test authorization response is listed in the Request ID column.

If the test authorization was successful, a success message is present in the corresponding Applications column.

Test Endpoints

When testing an API outside of the Developer Center's API Reference sandbox, send your test API requests to the test server:

https://apitest.visaacceptance.com

For example, to test an authorization request, you can send the request to this endpoint:

https://apitest.visaacceptance.com/pts/v2/payments

Step 3: Construct Messages Using JSON Web Tokens

Follow these steps to construct messages using JWTs:

Generate a hash of the message body. See Generate a Hash of the Message Body.

Optional: Encrypt the message. See Java Example: Enabling MLE Using JWTs.

Populate the header values. See Generate the Token Header.

Generate a hash of the claim set. See Generate a Hash of the Claim Set.

Generate a hash of the token header. See Generate a Hash of the Token Header.

Generate a token signature hash. See Generate a Token Signature.

Populate the

signature

header field. See Generate a JSON Web Token.

Create the JWT header. See Create the Authorization Header.

Elements of a JSON Web Token Message

A JWT Message is built with these elements:

Headers

Your message header must include these header fields:

Header Fields
Header Field	Description
v-c-merchant-id	Your `Visa Acceptance Solutions` organization ID.
Date	The date of the transaction in the RFC1123 format. (Thu, 18 Jul 2019 00:18:03 GMT)
Content-Type	Also known as the Multipurpose Internet Mail Extension (MIME) type, this identifies the media or file type of the resource. (application/json)
kid	The ID of the key used to digitally sign the JWT. The Key ID (kid) must be registered with the authorizing server.
Host	The transaction endpoint. (`api.visaacceptance.com`)
alg	Algorithm used to sign the token header. These are the supported algorithms: RS256 (default) RS384 RS512 PS256 PS384 PS512

Body

The message body. For more information on setting up the body, see Generate a Hash of the Message Body.

Generate a Hash of the Message Body

Generate a Base64-encoded SHA-256 hash of the message, and place the hash in the header's

digest

field. This hash is used to validate the integrity of the message at the receiving end.

Follow these steps to generate the hash:

Generate the SHA-256 hash of the JSON payload (body of the message).

Encode the hashed string to Base64.

Add the message body hash to the

digest

payload field.

Add the hash algorithm used to the

digestAlgorithm

payload field.

Example: Digest Header Field

digest: RBNvo1WzZ4oRRq0W9+hknpT7T8If536DEMBg9hyq/4o=

Example: DigestAlgorithm Header Field

digestAlgorithm: SHA-256

Code Example: Creating a Message Hash Using C#

public static string GenerateDigest() {
     var digest = "";
     var bodyText = "{ your JSON payload }";
     using (var sha256hash = SHA256.Create()) {
         byte[] payloadBytes = sha256hash
             .ComputeHash(Encoding.UTF8.GetBytes(bodyText));
         digest = Convert.ToBase64String(payloadBytes);
         digest = digest;
     }
     return digest;
}

Code Example: Creating a Message Using Java

public static String GenerateDigest() throws NoSuchAlgorithmException {
     String bodyText = "{ your JSON payload }";
     MessageDigest md = MessageDigest.getInstance("SHA-256");
     md.update(bodyText.getBytes(StandardCharsets.UTF_8));
     byte[] digest = md.digest();
     return Base64.getEncoder().encodeToString(digest);
}

Generate the Token Header

The token header is encrypted with a URL safe base64 algorithm. These three header fields must be included in the header.

Token Headers
Token Header Field	Description
kid	The ID of the key used to digitally sign the JWT.
alg	Algorithm used to sign the token header.
v-c-merchant-id	Merchant ID used in the request transaction. To obtain the merchant ID, see Step 1: Sign Up for a Sandbox Account.

Token Header

eyJ2LWMtbWVyY2hhbnQtaWQiOiJtZXJjaGFudElEIiwiYWxnIjoiUlMyNTYiLCJraWQiOiI3MDc4NjMzMjg1MjUwMTc3MDQxNDk5In0

Generating the Token Header with Python

Encode the header data and then remove any padding added during the encryption process.

import base64

# open file in binary mode
data = b'{"v-c-merchant-id":"merchantID","alg":"RS256","kid":"7078633285250177041499"}'
encoded = base64.urlsafe_b64encode(data)
stripped = encoded.decode('ascii').strip('=')

print(stripped)

Generate a Hash of the Claim Set

Generate a Base64-encoded SHA-256 hash of these header fields:

Headers
Header Field	Description
iat	The date and time of the message origin. Date formatting is defined by RFC 7231, Section 7.1.1.1.
digest	A Base64 encoded hash of the message payload. The digest field is not included in a GET request.
digestAlgorithm	The algorithm used to hash the message payload. The message payload should be hashed using the SHA-256 algorithm. The digestAlgorithm field is not included in a GET request.

Follow these steps to generate the hash:

Generate the SHA-256 hash of the fields in JSON format.

Encode the hashed string to Base64.

Add the message body hash to the

digest

header field.

Creating a Message Hash Using Command Line Tools

Generate the SHA-256 hash using the

shasum

tool.

echo -n "{"iat":"Thur, 15 June 2017 08:12:31 GMT","digest":"tP7hDajF4f6q0ysBQCHgef5K/PBq8iMASvlEARp8tl=",
					"digestAlgorithm":"SHA-256"}" | shasum -a 256

Base64 Encoding a Message Hash Using Command Line Tools

Generate the SHA-256 hash using the

base64

tool.

echo -n "5995a4f27b4b9256a94cf54489a9ef691d8dc8a590d322780d3b202cfa2f078f" | base64

Add the message body hash to the

digest

header field

NTk5NWE0ZjI3YjRiOTI1NmE5NGNmNTQ0ODlhOWVmNjkxZDhkYzhhNTkwZDMyMjc4MGQzYjIwMmNmYTJmMDc4Zg==

Generate a Hash of the Token Header

Generate a Base64-encoded SHA-256 hash of these header fields:

Token Headers
Token Header Field	Description
kid	The ID of the key used to digitally sign the JWT.
alg	Algorithm used to sign the token header.
v-c-merchant-id	Merchant ID used in the request transaction.

Follow these steps to generate the hash:

Generate the SHA-256 hash of the fields in JSON format.

Encode the hashed string to Base64.

Create a Message Hash Using the

shasum

Command Line Tool

echo -n "{"kid":"cc34c0a0-bd5a-4a3c-a50d-a2a7db7643df",
"alg":"RS256","v-c-merchant-id":"merchant_id"}"
| shasum -a 256

Create a Message Hash Using the

base64

Command Line Tool

echo -n "a9953cdca19433ae5ec1c4eb0dafd41df6de4d20cd47cbace3c316a1ac6d2008" | base64

Example: Token Header Hash

NTc3N2RlOTAyZWEwNWU0NWM2YTBkNTI4Mjg0YTJmOTVlZGYxYWJlMzBjNzk5OTg1YzEzMjNiMDkzMzc0MWEwNA==

Generate the Message Body

Encode the message body (payload) using URL safe Base64 encryption. At a minimum, the body should include these fields:

Message Body Fields
Message Body Field	Description
digest	A base64 encoded SHA-256 has of the claim set.
digestAlgorithm	Algorithm used to sign the JWT.
iat	Time the JWT was issued.

Follow these steps to generate the hash:

Generate the SHA-256 hash of the JSON payload (body of the message).

Encode the hashed string to Base64.

Add the message body hash to the

digest

header field.

Add the hash algorithm used to the

digestAlgorithm

header field.

Encrypted Message Body

Line break added for readability.

digest: eyJkaWdlc3QiOiJSQk52bzFXelo0b1JScTBXOStoa25wVDdUOElmNTM2REVNQmc5aHlxLzRvPSIsImRpZ
2VzdEFsZ29yaXRobSI6IlNIQS0yNTYiLCJpYXQiOiIyMDI0LTA0LTA1VDE2OjI1OjE4LjI1OVoifQ

Encrypting Message Body Using Python

Generate the SHA-256 hash using the

shasum

tool. Line break on line three added for readability.

import base64

data = b'{"digest":"RBNvo1WzZ4oRRq0W9+hknpT7T8If536DEMBg9hyq/4o=","digestAlgorithm":"SHA-256",
    "iat":"2024-04-05T16:25:18.259Z"}'
encode = base64.urlsafe_b64encode(data)
stripped = encode.decode('ascii').strip('=')

print(stripped)

Generate a Token Signature

You can now build the JSON token signature. The token signature is made up of the JWT header and claim set hashes in the following format, and encrypted with the private key.

[Token Header].[Claim Set]

Follow these steps to generate the signature:

Concatenate the header and claim set hash strings with a period (.) separating the hashes:

[Token Header].[Claim Set]

.

Generate an encoded version of the text file using your private key.

Base64 encode the signature output.

Example: Token Signature Hash

YjgwNGIxOTMxMzQ2NzhlYjdiMDdhMWZmYjZiYzUzNzliMTk5NzFmNjAzNWRmMThlNzk0N2NhY2U0YTEwNzYyYQ

Code Example: Encoding the Signature File Using OpenSSL

Encode the signature file using the

openssl

tool.

openssl rsautl -encrypt -inkey publickey.key -pubin -in [signature-text-file]
					> [signature-encoded-file]

Code Example: Base64 Encoding the Signature File Using the Command Line

Encode the signature file using the

openssl

tool and remove any padding.

base64 -i [signature-encoded-file]

Generate a JSON Web Token

You can now build the JWT. The JWT is made up of the token header Base64 encoded hash, the payload Base64 encoded hash, and the JWT signature in the following format:

[Token Header].[Payload].[Signature]

To generate the JWT, concatenate the header, payload, and signature strings with a period (.) separating the hashes:

[[Token Header].[Payload].[Signature]

.

Example: JSON Web Token

eyJ2LWMtbWVyY2hhbnQtaWQiOiJtZXJjaGFudElEIiwiYWxnIjoiUlMyNTYiLCJraWQiOiI3M
Dc4NjMzMjg1MjUwMTc3MDQxNDk5In0.eyJkaWdlc3QiOiJSQk52bzFXelo0b1JScTBXOStoa2
5wVDdUOElmNTM2REVNQmc5aHlxLzRvPSIsImRpZ2VzdEFsZ29yaXRobSI6IlNIQS0yNTYiLCJ
pYXQiOiIyMDI0LTA0LTA1VDE2OjI1OjE4LjI1OVoifQ.YjgwNGIxOTMxMzQ2NzhlYjdiMDdhM
WZmYjZiYzUzNzliMTk5NzFmNjAzNWRmMThlNzk0N2NhY2U0YTEwNzYyYQ

Create the Authorization Header

You can now build the transaction header using a JSON Web Token.

Your message header must include these header fields:

JWT Header Fields
JWT Header Field	Description
Authorization	The bearer token generated. (Bearer<JWT>)
Content-Type	Also known as the Multipurpose Internet Mail Extension (MIME) type, this identifies the media or file type of the resource. (application/json)
Host	The transaction endpoint. (`api.visaacceptance.com`)

Example: JSON Web Token Header

Host: api.cybersource.com
Content-Type: application/json
Authorization: Bearer 
eyJ2LWMtbWVyY2hhbnQtaWQiOiJtZXJjaGFudElEIiwiYWxnIjoiUlMyNTYiLCJraWQiOiI3M 
Dc4NjMzMjg1MjUwMTc3MDQxNDk5In0.eyJkaWdlc3QiOiJSQk52bzFXelo0b1JScTBXOStoa2 
5wVDdUOElmNTM2REVNQmc5aHlxLzRvPSIsImRpZ2VzdEFsZ29yaXRobSI6IlNIQS0yNTYiLCJ 
pYXQiOiIyMDI0LTA0LTA1VDE2OjI1OjE4LjI1OVoifQ.YjgwNGIxOTMxMzQ2NzhlYjdiMDdhM 
WZmYjZiYzUzNzliMTk5NzFmNjAzNWRmMThlNzk0N2NhY2U0YTEwNzYyYQ

Step 4: Enable Message-Level Encryption

IMPORTANT

This feature is in the pilot phase. To use message-level encryption, contact your sales representative.

There are additional tasks you must complete before you can enable message-level encryption. For more information, see Prerequisites for MLE.

Message-Level Encryption (MLE) enables you to store information or communicate with other parties while helping to prevent uninvolved parties from understanding the stored information. MLE is optional and supported only for payments services.

MLE provides enhanced security for message payload by using an asymmetric encryption technique (public-key cryptography). The message encryption is implemented with symmetric encryption using Advanced Encryption Standard (AES), Galois Counter Mode (GCM) with 256-bit key size. The encryption of keys is supported using RSA Optimal Asymmetric Encryption Padding (OAEP) with 2048-bit key size. The encryption service is based on JSON Web Encryption (JWE), works on top of SSL and requires separate key-pairs for request and response legs of the transaction.

MLE is required for APIs that primarily deal with sensitive transaction data, both financial and non-financial. These are the types of sensitive transaction data:

Personal identification information (PII)

Personal account number (PAN)

Personal account information (PAI)

MLE is supported when using JSON web tokens.

Each of these authentication schemes uses an encrypted payload, called the JWE
. A JWE token has these five components, with each component separated by a period (.):

JOSE header containing four elements:

"alg": "RSA-OAEP-256", // The algorithm used to encrypt the CEK.
"enc": "A256GCM", // The algorithm used to encrypt the message.
"iat": "1702493653", // The current timestamp in milliseconds.
"kid": "keyId" // The serial number of shared public cert for encryption of CEK.

JWE encrypted key

JWE initialization vector

JWE additional authentication data (AAD)

JWE ciphertext and authentication tag

Prerequisites for MLE

Before enabling message-level encryption (MLE), you must complete these requirements:

Sign the pilot agreement for using MLE.

Confirm that the APIs you are integrating to support MLE.

Retrieve the Visa Acceptance Solutions public key from either the Account Manager or Client Executive services in the Business Center.

Ensure that your system is configured to read the public key and encrypt the API payload.

Overview of MLE Set Up Tasks

Use the information in this section to configure your system with your own custom MLE using JWTs.

If you do not want to set up your own custom MLE, you can use the REST Client SDK instead. For more information, see the REST Client SDKs in GitHub.

Figure:

Overview of MLE Set Up Tasks

Import the required programming libraries for your system.

Import these three certificates:

Signing certificate (REST – Certificate).

MLE request certificate (SJC public certificate)

MLE response certificate (REST – API response MLE)

Encrypt the JSON in your request using a JSON Web Encryption (JWE) that uses the SJC public certificate.

Create the HTTP body in the format of

{"encryptedRequest": "JWE-with-SJC
"}

.

Create the JSON Web Signature (JWS) payload with these JWT payload fields and your signing certificate's private key:

iat

v-c-api-response-kid

from the MLE response certificate.

digestAlgorithm

digest

of the HTTP body

Sign the JWS with your signing certificate and send it as

Authorization: Bearer

, such as a P12 certificate.

Receive an encrypted response and decrypt it with the MLE private key. You will receive the response in this format:

{"encryptedResponse": "JWE-with-ResponseMLECertificate
"}

The JWE contains a JOSE header containing these four default elements:

"alg": "RSA-OAEP-256", // The algorithm used to encrypt the CEK.
"enc": "A256GCM", // The algorithm used to encrypt the message.
"iat": "1702493653", // The current timestamp in milliseconds.
"kid": "keyId" // The serial number of the v-c-api-response-kid from the authentication JWS in step 5.

These are the supported algorithms you can set the

alg

element to:

RS256: SHA256withRSA

RS384: SHA384withRSA

RS512: SHA512withRSA

PS256: RSASSA-PSS

PS256: SHA256withRSAandMGF1

PS384: RSASSA-PSS SHA-384

PS384: SHA384withRSAandMGF1

PS512: RSASSA-PSS SHA512

PS512: SHA512withRSAandMGF1

Java Example: Enabling MLE Using JWTs

The below steps are examples of a way in which you can configure your system to create a custom MLE with JWTs. These example steps use the Java programming language.

Import your preferred libraries to support MLE. In this example, the configuration uses Java leveraging the open source Nimbus JOSE and Bouncy Castle libraries.

// Nimbus JOSE + JWT
import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWEHeader;
import com.nimbusds.jose.JWEObject;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.JWSObject;
import com.nimbusds.jose.JOSEObjectType;
import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.Payload;
import com.nimbusds.jose.crypto.RSADecrypter;
import com.nimbusds.jose.crypto.RSAEncrypter;
import com.nimbusds.jose.crypto.RSASSASigner;

// BouncyCastle (PEM parsing + cert conversion)
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.openssl.PEMKeyPair;
import org.bouncycastle.openssl.PEMParser;
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;

Import the signing, MLE, and SJC certificates. This example uses the P12 certificate as the signing certificate.

public final class KeyPairMaterial {
public final PrivateKey privateKey;
public final X509Certificate cert;
public KeyPairMaterial(PrivateKey k, X509Certificate c) { this.privateKey = k; this.cert = c; }
}

public final class CryptoMaterialDual {
// Merchant: JWS (REST – Certificate)
public final KeyPairMaterial signingCert;
// Merchant: Response decryption (API Response MLE)
public final KeyPairMaterial responseCert;
// Platform encryption cert (SJC)
public final X509Certificate sjcCert;

public CryptoMaterialDual(KeyPairMaterial signingCert, KeyPairMaterial responseCert, X509Certificate sjcCert) {
this.signingCert = signingCert; this.responseCert = responseCert; this.sjcCert = sjcCert;
}
}

Unpack your imported certificates into a usable format for your system.

Create this method for your system to read your P12 file, if you are using the P12 certificate.

static KeyPairMaterial loadKeyPairFromP12(Path p12Path, char[] password, String keyAlias) throws Exception {
KeyStore ks = KeyStore.getInstance("PKCS12");
try (InputStream in = Files.newInputStream(p12Path)) { ks.load(in, password); }
KeyStore.PrivateKeyEntry entry = (KeyStore.PrivateKeyEntry) ks.getEntry(
keyAlias, new KeyStore.PasswordProtection(password));
return new KeyPairMaterial(entry.getPrivateKey(), (X509Certificate) entry.getCertificate());
}

Create this method for your system to read the PEM chain and private key.

static KeyPairMaterial loadKeyPairFromPem(Path certificateChainPem, String privateKeyPem) throws Exception {
X509Certificate leaf = readPemCerts(certificateChainPem).get(0);
PrivateKey key = readPkcs8PrivateKey(privateKeyPem);
return new KeyPairMaterial(key, leaf);
}

Create this method for your system to read the SJC from the P12 file or PEM chain.

static X509Certificate loadSjcFromP12(Path p12Path, char[] password, String sjcAlias) throws Exception {
KeyStore ks = KeyStore.getInstance("PKCS12");
try (InputStream in = Files.newInputStream(p12Path)) { ks.load(in, password); }
return (X509Certificate) ks.getCertificate(sjcAlias);
}

static X509Certificate loadSjcFromPem(Path sjcCertPem) throws Exception {
return readPemCerts(sjcCertPem).get(0);
}

Create this method to include PEM helper functions.

static List<X509Certificate> readPemCerts(Path pemPath) throws Exception {
try (Reader r = Files.newBufferedReader(pemPath);
org.bouncycastle.openssl.PEMParser p = new org.bouncycastle.openssl.PEMParser(r)) {
var xconv = new org.bouncycastle.cert.jcajce.JcaX509CertificateConverter().setProvider("BC");
List<X509Certificate> certs = new ArrayList<>();
Object o; while ((o = p.readObject()) != null) {
if (o instanceof org.bouncycastle.cert.X509CertificateHolder h) certs.add(xconv.getCertificate(h));
}
return certs;
}
}

static PrivateKey readPkcs8PrivateKey(String pem) throws Exception {
try (var parser = new org.bouncycastle.openssl.PEMParser(new StringReader(pem))) {
Object o = parser.readObject();
var conv = new org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter().setProvider("BC");
if (o instanceof org.bouncycastle.asn1.pkcs.PrivateKeyInfo pki) return conv.getPrivateKey(pki);
if (o instanceof org.bouncycastle.openssl.PEMKeyPair kp) return conv.getPrivateKey(kp.getPrivateKeyInfo());
throw new IllegalArgumentException("Expect PKCS#8 private key PEM");
}
}

Create these methods as helpers for encrypting and signing.

static String kidFromCert(X509Certificate cert) {
String dn = cert.getSubjectDN().getName().toUpperCase();
int i = dn.indexOf("SERIALNUMBER=");
if (i >= 0) { int j = dn.indexOf(",", i); if (j < 0) j = dn.length(); return dn.substring(i + "SERIALNUMBER=".length(), j).trim(); }
return cert.getSerialNumber().toString();
}

static String encryptToJwe(String json, X509Certificate sjcCert) throws Exception {
var header = new com.nimbusds.jose.JWEHeader.Builder(
com.nimbusds.jose.JWEAlgorithm.RSA_OAEP,
com.nimbusds.jose.EncryptionMethod.A256GCM)
.contentType("JWT")
.keyID(kidFromCert(sjcCert))
.build();
var jwe = new com.nimbusds.jose.JWEObject(header, new com.nimbusds.jose.Payload(json));
jwe.encrypt(new com.nimbusds.jose.crypto.RSAEncrypter((RSAPublicKey) sjcCert.getPublicKey()));
return jwe.serialize();
}

static String sha256Base64(String body) throws Exception {
MessageDigest md = MessageDigest.getInstance("SHA-256");
return Base64.getEncoder().encodeToString(md.digest(body.getBytes(StandardCharsets.UTF_8)));
}

static String signAsJws(String payload, KeyPairMaterial signingCert) throws Exception {
var header = new com.nimbusds.jose.JWSHeader.Builder(com.nimbusds.jose.JWSAlgorithm.RS256)
.keyID(kidFromCert(signingCert.cert))
.type(com.nimbusds.jose.JOSEObjectType.JWT) // typ=JWT
.build();
var jws = new com.nimbusds.jose.JWSObject(header, new com.nimbusds.jose.Payload(payload));
jws.sign(new com.nimbusds.jose.crypto.RSASSASigner(signingCert.privateKey));
return jws.serialize();
}

static String decryptJwe(String compactJwe, KeyPairMaterial responseCert) throws Exception {
var jwe = com.nimbusds.jose.JWEObject.parse(compactJwe);
jwe.decrypt(new com.nimbusds.jose.crypto.RSADecrypter((RSAPrivateKey) responseCert.privateKey));
return jwe.getPayload().toString();
}

After setting up the above methods in your system, create a class that uses the methods to encrypt and decrypt your payloads with MLE using JWTs.

// Example mix:
// - REST – Certificate from PKCS#12
// - API Response MLE from PEM
// - SJC from PEM
KeyPairMaterial signingCert = loadKeyPairFromP12(
Paths.get("merchant.p12"), "password".toCharArray(), "merchant");
KeyPairMaterial responseCert = loadKeyPairFromPem(
Paths.get("api_response_mle_chain.pem"), Files.readString(Paths.get("api_response_mle_private_key.pem")));
X509Certificate sjc = loadSjcFromPem(Paths.get("sjc_certificate.pem"));

CryptoMaterialDual mat = new CryptoMaterialDual(signingCert, responseCert, sjc);

// 1) Build your request JSON
String requestJson = new org.json.JSONObject()
.put("amount", "10.00")
.put("currency", "USD")
.put("reference", "ORDER-12345")
.toString();

// 2) Encrypt request body to JWE using SJC public cert
String encryptedJwe = encryptToJwe(requestJson, mat.sjcCert);

// 3) Build the HTTP body (this is what you’ll hash for the digest)
String httpBody = new org.json.JSONObject()
.put("encryptedRequest", encryptedJwe)
.toString();

// 4) Build JWS payload: include iat, response kid, digestAlgorithm, and digest of httpBody
String digestB64 = sha256Base64(httpBody);
String jwsPayload = new org.json.JSONObject()
.put("iat", java.time.Instant.now().getEpochSecond())
.put("v-c-api-response-kid", kidFromCert(mat.responseCert.cert))  // instruct server to encrypt to your API Response MLE key
.put("digestAlgorithm", "SHA-256")
.put("digest", digestB64)
.toString();

// 5) Sign the JWS with the REST – Certificate private key
String signedJws = signAsJws(jwsPayload, mat.signingCert);

// 6) Send the HTTP request
// POST /your/api
// Content-Type: application/json
// Authorization: Bearer <signedJws>
/*
Body:
{ "encryptedRequest": "<encryptedJwe>" }
*/

// 7) Handle the response (decrypt if needed with API Response MLE private key)
String apiResponse = /* http call result as string */;
org.json.JSONObject resp = new org.json.JSONObject(apiResponse);
String finalPayload = resp.has("encryptedResponse")
? decryptJwe(resp.getString("encryptedResponse"), mat.responseCert)
: apiResponse;

Step 5: Going Live

When you are ready to process payments in a live environment, you must transition your account to a live status with a valid configuration for your chosen payment processor. When live, your transaction data flows through the production Visa Acceptance Solutions gateway, to your processor, and on to the appropriate payment network.

To transition your account:

Sign up for a merchant account.

Contact Sales to establish a contract with Visa Acceptance Solutions that enables you to process real transactions and receive support.

Submit a merchant ID (MID) activation request.

It may take up to three business days to complete a MID activation request.

Create a Merchant ID

The merchant ID (MID) is used to identify you and your transactions and is included in the header of each transaction request. When you signed up for a sandbox account, you received a merchant ID for testing purposes. If you choose, you can use that merchant ID as your production ID.

Follow these steps to sign up for a merchant account in order to create a production MID:

Navigate to the Business Center Evaluation Account Sign-up page, enter the required information, and click Create Account
.

Choose your merchant ID name carefully. It cannot be changed. This name is not visible to your customers.

Review your information entered, especially your business email address. Your merchant ID registration information will be sent to the email entered on this form.

Check your email from customer support titled: Visa Acceptance Solutions Merchant Evaluation Account
.

This email will include the Organization ID and contact email associated with your MID.

Go to your email and find a message titled: Merchant Registration Details
. Click the Set up your username and password now
link.

Your browser opens the New User Sign Up wizard.

Enter the Organization ID and Contact email you supplied previously. Follow the wizard pages to add your name, a username, and password.

Log into the Business Center.

When you log in for the first time, you will be asked to identify your identity through a system-generated email that is sent to your email account.

Check your email for a message titled: Visa Acceptance Solutions Identification Code
.

Note the passcode.

Enter the passcode on the Verify your Identity page.

You should be directed to the Business Center home page.

You have successfully created a merchant ID and merchant account.

Activate your Merchant ID

The activation process, also known as going live
, transitions your MID and account from test status to live status, enabling you to process real transactions in production. It may take up to three business days to complete the MID activation request.

To transition your account complete these tasks:

Sign in to the

support center

as an administrator.

Enter your credentials and log in to your test environment.

Enter your MID in the Organization ID text box.

Go to Support Cases > MID Configuration Request
. The MID Configuration Request page should be open.

Select MID Activation
.

In the Description field, enter the Merchant ID that you want to take live.

Select the processor configuration and enter the name of your processor.

If you are unsure of your processor name, contact your merchant service provider or your merchant acquiring bank.

Select the environments that this change applies (test or production).

Select Service Enablement
and list the products and services that you intend to use.

Select Submit
.

Production Endpoints

When sending API request messages using your production account, send your requests to the production server:

https://api.visaacceptance.com

For example, to send a live authorization request, you can send the request to this endpoint:

https://api.visaacceptance.com/pts/v2/payments

Set Up an HTTP Signature Message

To set up your HTTP signature message requires you to follow these steps.

Sign up and register a sandbox account. See Step 1: Sign Up for a Sandbox Account.

Create a shared secret key. See Step 2: Shared Secret Key Pair.

Construct a message using HTTP signature security. See Step 3: Construct Messages Using HTTP Signature Security.

Go live by transitioning your sandbox account into a production account. Step 5: Going Live.

Step 1: Sign Up for a Sandbox Account

To begin setting up your account, you must first sign up for a sandbox account. A sandbox account enables you to obtain your security keys and test your implementation. After you verify that your system can send and receive REST messages, you can contact customer service to transition your sandbox account to a production account. Your production account is where you process live payments.

IMPORTANT

A sandbox account cannot process live payments and is intended only for testing.

Follow these steps to sign up for a sandbox account:

Go to the Visa Acceptance Solutions Developer Center sandbox account sign-up page:

https://developer.visaacceptance.com/hello-world/sandbox.html

Enter your information into the sandbox account form, and click Create Account
.

Go to your email and find a message titled: Merchant Registration Details
. Click Set up your username and password now
.

Your browser opens the New User Sign Up wizard.

Enter the organization ID and contact email you supplied when you created your account. Follow the wizard pages to add your name, a username, and a password. Your username and password must meet these requirements:

Username and Password Requirements
Username	Password
Length must be 3-36 characters. Can only contain letters, numbers, periods, dashes, or underscores.	Length must be 12–50 characters. Must contain one upper case letter. Must contain one lower case letter. Must contain one number. Cannot contain the username or organization ID.

Log in to the Business Center.

When you log in for the first time, you must verify your identity through a system-generated email sent to your email account.

Check your email for a message titled: Visa Acceptance Solutions Identification Code
. A passcode is included in the message.

Enter the passcode on the Verify your Identity
page.

You are directed to the Business Center home page.

You have successfully signed up for a sandbox account.

IMPORTANT

A sandbox account cannot process live payments. After you verify that your system can send and receive REST messages, you can contact customer service to transition your sandbox account to a production account.

Step 2: Shared Secret Key Pair

Key pairs are used with HTTP Signature message security.

Create a Shared Secret Key Pair

Follow these steps to create a shared secret key pair.

Log in to the Business Center:

Test:

https://businesscentertest.visaacceptance.com

Production:

https://businesscenter.visaacceptance.com

On the left navigation panel, choose

Payment Configuration > Key Management

.

Click

+ Generate

key.

Under REST APIs, choose REST – Shared Secret
and then click Generate key
.

The REST API Shared Secret Key page appears.

Click Download key

.

The .pem file is downloaded to your desktop.

You can create or upload another key by clicking Generate another key
. To view all of your created keys, use the Key Management page.

IMPORTANT

Securely store the .p12
file and password in your system. These credentials are required to implement certain products and you must be able to access them.

Test the Shared Secret Key Pair

After creating your key certificate, you must test and verify that your key can successfully process API requests. These tasks explain how to test and validate your key certificate using the developer center and the Business Center.

Go to the developer center's API Reference page:

https://developer.visaacceptance.com/api-reference-assets/index.html#static-home-section

On the left navigation panel, click API Endpoints & Authentication
.

Under Authentication and Sandbox Credentials, set the Authentication Type drop-down menu to HTTP Signature.

Enter your organization ID in the Organization ID field.

Enter your key, also known as your private key, in the Key field.

Enter your secret key, also known as your public key, in the Shared Secret Key field.

Click Update Credentials
.

On the developer center's left navigation panel, navigate to Payments >
POST
Process a Payment
.

Under Request: Live Console, click Send
.

A message confirms that your request was successful with the status code 201.

Log in to the Business Center:

https://businesscentertest.visaacceptance.com

On the left navigation panel, navigate to

Transaction Management > Transactions
.

Under Search Results, verify that the request ID from the test authorization response is listed in the Request ID column.

If the test authorization was successful, a success message is present in the corresponding Applications column.

Step 3: Construct Messages Using HTTP Signature Security

HTTP signatures use a digital signature to enable the receiver to validate the sender's authenticity and ensure that the message was not tampered with during transit. For more information about HTTP signatures, see the IETF Draft that is maintained by the IETF HTTP Working Group (https://httpwg.org).

Follow these steps to implement HTTP signatures:

Create the shared secret key pair. See Create a Shared Secret Key Pair.

Generate a hash of the message body. See Generate a Hash of the Message Body.

Generate a signature hash. See Generate the Signature Hash.

Populate the

signature

header field. See Update Header Fields.

Elements of an HTTP Message

A HTTP Message is built with the following elements:

Headers

Your message header must include these header fields:

HTTP Header Fields
HTTP Header Field	Description
v-c-merchant-id	Your `Visa Acceptance Solutions` organization ID.
v-c-date	The date of the transaction in the RFC1123 format. (Thu, 18 Jul 2019 00:18:03 GMT)
Content-Type	Also known as the Multipurpose Internet Mail Extension (MIME) type, this identifies the media or file type of the resource. (application/json)
Host	The transaction endpoint. (`api.visaacceptance.com`)

Body

The message body. For more information on setting up the body, see Generate a Hash of the Message Body.

Generate a Hash of the Message Body

This hash is used to validate the integrity of the message at the receiving end.

Follow these steps to generate the hash:

Generate the SHA-256 hash of the JSON payload (body of the message).

Encode the hashed string to Base64.

Prepend SHA-256=
to the front of the hash.

Add the message body hash to the

digest

header field.

Creating a Message Hash Using the Command Line

shasum

Tool

echo -n "{"clientReferenceInformation":{"code":"TC50171_3"},"paymentInformation":{"card":{"number":
				"4111111111111111","expirationMonth":"12","expirationYear":"2031"}},"orderInformation":{"amountDetails":
				{"totalAmount":"102.21","currency":"USD"},"billTo”:{“firstName":"John","lastName":"Doe","address1":
				"1MarketSt","locality":"sanfrancisco","administrativeArea":"CA","postalCode":"94105","country":"US",
				"email":"[email protected]","phoneNumber":"4158880000"}}}" | shasum -a 256

echo -n "6ae5459bc8a7d6a4b203e8a734d6a616725134088e13261f5bbcefc1424fc956" | base64

Creating a Message Hash Using the Command Line

base64

Tool

echo -n "6ae5459bc8a7d6a4b203e8a734d6a616725134088e13261f5bbcefc1424fc956" | base64

Creating a Message Hash Using C#

public static string GenerateDigest() {
				var digest = "";
				var bodyText = "{ your JSON payload }";
				using (var sha256hash = SHA256.Create()) {
				byte[] payloadBytes = sha256hash
				.ComputeHash(Encoding.UTF8.GetBytes(bodyText));
				digest = Convert.ToBase64String(payloadBytes);
				digest = "SHA-256=" + digest;
				}
				return digest;
				}

Creating a Message Using Java

public static String GenerateDigest() throws NoSuchAlgorithmException {
				String bodyText = "{ your JSON payload }";
				MessageDigest md = MessageDigest.getInstance("SHA-256");
				md.update(bodyText.getBytes(StandardCharsets.UTF_8));
				byte[] digest = md.digest();
				return "SHA-256=" + Base64.getEncoder().encodeToString(digest);
				}

Digest Header Field

digest: SHA-256=NmFlNTQ1OWJjOGE3ZDZhNGIyMDNlOGE3MzRkNmE2MTY3MjUxMzQwODhlMTMyNjFmNWJiY2VmYzE0MjRmYzk1Ng==

Generate the Signature Hash

The signature hash is a Base64-encoded HMAC SHA-256 hash of the header fields and their values. The following information must be included in the signature hash:

Header Fields
Header Field	Description
Date	From the header, the date and time in the RFC1123 format. For example: Date: Thu, 18 Jul 2023, 22:18:03.
Digest	The Base64-encoded SHA-256 hash of the message body. For more information, see Generate a Hash of the Message Body. For example: Digest: SHA-256=gXWufV4Zc7VkN9Wkv9jh/JuAVclqDusx3vkyo3uJFWU= . Do not include the digest with GET requests.
Host	From the header, the endpoint host. For example: `apitest.visaacceptance.com` .
v-c-merchant-id	From the header, the merchant ID associated with the request. For example: v-c-merchant-id: mymerchantid .
request-target	The HTTP method and endpoint resource path. For example: request-target: post /pts/v2/payments/ .

Follow these steps to generate the signature hash value:

Generate a byte array of the secret key generated previously. For more information, see Create a Shared Secret Key Pair.

Generate the HMAC SHA-256 key object using the byte array of the secret key.

Concatenate a string of the required information listed above.

For more information, see Creating the Validation String
below.

Generate a byte array of the validation string.

Use the HMAC SHA-256 key object to create the HMAC SHA-256 hash of the validation string byte array.

Base64 encode the HMAC SHA-256 hash.

Signature Hash

signature=”OuKeDxj+Mg2Bh9cBnZ/25IXJs5n+qj93FvPKYpnqtTE=”

Creating the Validation String

To create the validation string, concatenate the required information in the same order as listed in the signature header field parameter. Each item must be on a separate line, and each line should be terminated with a new line character

\n

.

Validation String Example

host: apitest.visaacceptance.com\n
date: Thu, 18 Jul 2019 00:18:03 GMT\n
request-target: post /pts/v2/payments/\n
digest: SHA-256=gXWufV4Zc7VkN9Wkv9jh/JuAVclqDusx3vkyo3uJFWU=\n
v-c-merchant-id: mymerchantid

Generating a Signature Hash in C#

private static string GenerateSignatureFromParams(string signatureParams, string secretKey) {
var sigBytes = Encoding.UTF8.GetBytes(signatureParams);
var decodedSecret = Convert.FromBase64String(secretKey);
var hmacSha256 = new HMACSHA256(decodedSecret);
var messageHash = hmacSha256.ComputeHash(sigBytes);
return Convert.ToBase64String(messageHash);
}

Generating a Signature Hash in Java

public static String GenerateSignatureFromParams(String keyString, 
String signatureParams) throws InvalidKeyException, NoSuchAlgorithmException {
byte[] decodedKey = Base64.getDecoder().decode(keyString);
SecretKey originalKey = new SecretKeySpec(decodedKey, 0, decodedKey.length, "HmacSHA256");
Mac hmacSha256 = Mac.getInstance("HmacSHA256");
hmacSha256.init(originalKey);
hmacSha256.update(signatureParams.getBytes());
byte[] HmachSha256DigestBytes = hmacSha256.doFinal();
return Base64.getEncoder().encodeToString(HmachSha256DigestBytes);}

Update Header Fields

When the signature is generated, you can populate the

signature

header field. The

signature

header field includes these parameters:

Signatures
Signature Parameter	Description
keyid	The serial number of the signing certificate/key pair. Obtain this in the `Business Center` Key Management area. For more information, see Create a Shared Secret Key Pair.
algorithm	The HMAC SHA256 algorithm used to encrypt the signature. It should be formatted: HmacSHA256 .
headers	This ordered list of the fields included in the signature: host v-c-date request-target digest v-c-merchant-id
signature	The signature hash.

Signature Header Field Format

Signature:"keyid:"[keyid]",algorithm="[encryption algoritm]",headers="field1" "field2" "field3" "etc.", signature="[signature hash]"

Signature Header Example

Signature:"keyid="123abcki-key1-key2-key3-keyid1234567", 
algorithm="HmacSHA256", headers="host date request-target digest v-c-merchant-id", 
signature="hrptKYTtn/VfwAdUqkrQ0HT7jqAbagAbFC6nRGXrNzE="

Step 4: Going Live