Following table lists all card brands that can be uses via the Hosted Payment Page. When submitting the value CC in parameter PayTypes all brands are displayed that are configured for a certain merchant. Selecting specific brands can be done by submitting a string of the desired brand names separated by pipe signs.

Process of payment

To make payments via the Hosted Payment Page you send a request to following URL with HTTPS GET or HTTPS POST:

All details required for payment processing are forwarded as parameters. The parameters are encrypted with Blowfish to ensure that neither the customer nor a third party can manipulate the data.

When calling the form Cockpit decrypts the parameters and shows the HTML page with the payment methods. The customer selects the payment method and triggers the forwarding by clicking the button "Next".

After the payment has been made Cockpit redirects the customers back to a shop page via HTTPS GET (URLSuccess, URLFailure) and transmits the result of the payment as a Blowfish-encrypted parameter string to these URLs. In addition Cockpit transmits the result via HTTPS POST to the shop's Notify page (URLNotify). The shop accepts the payment result and decrypts the data in order to inform the customer about the status.

Calling the Hosted Payment Page

Calling the Hosted Payment Page starts with the correct composition of the parameters which consist of a key and a value and which are separated by an equals sign (=):

All parameters are assembled in a character string and separated by the character &:

Notice: Since the characters "=" and "&" are used as separating characters, these characters cannot be transmitted as values. All values which you transmit without BlowFish-encryption must be URL-Encoded.

A correct parameter character string for Cockpit contains three basic parameters: MerchantID, Len and Data. The parameters MerchantID and Len are unencrypted. Only the Data parameter is Blowfish-encrypted:

The Data parameter contains the sensitive payment details such as amount and currency. The encrypted bytes are Hex-encoded and completed to two characters from the left with a zero. Encryption is via Blowfish ECB and is available to you as source-code and components.

The Len parameter is very important for encryption because it contains the length of the unencrypted(!) character string in the Data parameter. Since the data quantity to be encrypted is increased by a multiple of 8 in the case of the Blowfish encryption, the correct length of the character string must be known for decryption. Otherwise accidental characters emerge at the end of the character string.

The parameters are transmitted via HTTPS POST or HTTPS GET. The recommended transmit method is HTTPS POST because the parameter character string in the case of GET is attached to the URL, which is limited to 2048 bytes depending on the browser.

Notice: Please note that the maximum length of a payment request is limited to 5120 characters. If you require longer strings please contact Pay-Jet Support.

The following listings show the development of a payment request. The first listing is the unencrypted parameter character string:

Notice: Please note that a value is to be assigned to each parameter. Do not transmit empty parameters, as this can cause the payment to fail.

This character string is encrypted and transmitted as the Data parameter. The HTTPS GET request for the Hosted Payment Page looks like this:

Notice: Please note that parameters like Language or URLBack are transmitted unencrypted. A table with all possible unencrypted parameters can be found also witihn this document.

Cockpit interface

Definitions

Data formats

Abbreviations

Notice: Please note that the names of parameters can be returned in upper or lower case.

Parameters of the Hosted Payment Page

These parameters are mandatory for all payment methods and has to be submitted Blowfish-encrypted within the Data parameter to the Hosted Payment Page.

Notice: Please take all further parameters specifically for a payment method from the manual of that respective payment method.

The following table describes the encrypted payment request parameters:

*

• Add filter
• Reset all filters
• Disable all filters
• Reset column sorting
• Modify Settings

• Copy the filter URL

• Export to PDF
• Export to CSV
• Export to Word
• Print

• Documentation
• What's new
• Rate our app

Showing the first rows

Start adding filters in the filter tools menu.

The filter is disabled at the moment.

• Enable all filters

• Export to PDF
• Export to CSV
• Export to Word
• Print

• Documentation
• What's new
• Rate our app

Oops, it seems that you need to place a table or a macro generating a table within the Table Filter macro.

The table is being loaded. Please wait for a bit ...

Key	Format	CND	Description	Beschreibung
MerchantID	ans..30	M	MerchantID, assigned by Pay-Jet. Additionally this parameter has to be passed in plain language too.	HändlerID, die von Pay-Jet vergeben wird. Dieser Parameter ist zusätzlich auch unverschlüsselt zu übergeben.

Key	Format	CND	Description	Beschreibung
Amount	n..10	M	Amount in the smallest currency unit (e.g. EUR Cent). Please contact the Pay-Jet Support, if you want to capture amounts <100 (smallest currency unit).	Betrag in der kleinsten Währungseinheit (z.B. EUR Cent). Bitte wenden Sie sich an den Pay-Jet Support, wenn Sie Beträge < 100 (kleinste Währungseinheit) buchen möchten.

Key	Format	CND	Description	Beschreibung
Currency	a3	M	Currency, three digits DIN / ISO 4217, e.g. EUR, USD, GBP. Please find an overview here: A1 Currency table EN	Währung, drei Zeichen DIN / ISO 4217, z.B. EUR, USD, GBP. Hier eine Übersicht: A1 Währungstabelle

Key	Format	CND	Description	Beschreibung
MAC	an64	M	Hash Message Authentication Code (HMAC) with SHA-256 algorithm. Details can be found here: HMAC Authentication (Request) HMAC Authentication (Notify)	Hash Message Authentication Code (HMAC) mit SHA-256-Algorithmus. Details finden Sie hier: HMAC-Authentisierung (Anfrage) HMAC-Authentisierung (Notify)

Key	Format	CND	Description	Beschreibung
TransID	ans..64	M	TransactionID provided by you which should be unique for each payment	Ihre eigene TransaktionsID, die für jede Zahlung eindeutig sein muss

Key		Format	CND	Description	Beschreibung
RefNr		ns..30	O	Unique reference number exact format depends on the available paymethods for your MerchantId. Please choose your format in that way that all paymethods are covered.	eindeutige Referenznummer das genaue Format hängt von den Zahlarten Ihrer MerchantId ab. Wählen Sie das Format so, dass alle möglichen Zahlarten kompatibel sind.
OrderDesc		ans..384	M	Description of purchased goods, unit prices etc. Please note: The first 27 characters appear on the customer-account statement. You can view the full data in Pay-Jet Backoffice.	Beschreibung der gekauften Waren, Einzelpreise etc. Bitte beachten Sie: Die ersten 27 Zeichen erscheinen auf dem Kontoauszug des Kunden. In Pay-Jet Backoffice können Sie die kompletten Daten einsehen.

Key	Format	CND	Description	Beschreibung
UserData	ans..1024	O	If specified at request, Cockpit forwards the parameter with the payment result to the shop.	Wenn beim Aufruf angegeben, übergibt das Cockpit die Parameter mit dem Zahlungsergebnis an den Shop.

Key	Format	CND	Description	Beschreibung
URLSuccess	ans..256	M	Complete URL which calls up Cockpit if payment has been successful. The URL may be called up only via port 443. This URL may not contain parameters: In order to exchange values between Cockpit and shop, please use the parameter UserData. Common notes: We recommend to use parameter "response=encrypted" to get an encrypted response by Cockpit However, fraudster may just copy the encrypted DATA-element which are sent to URLFailure and send the DATA to URLSuccess. Therefore ensure to check the "code"-value which indicates success/failure of the action. Only a result of "code=00000000" should be considered successful.	Vollständige URL, die das Cockpit aufruft, wenn die Zahlung erfolgreich war. Die URL darf nur über Port 443 aufgerufen werden. Diese URL darf keine Parameter enthalten: Um Parameter durchzureichen nutzen Sie stattdessen den Parameter UserData. Allgemeine Hinweise: Wir empfehlen, den Parameter "response=encrypted" zu verwenden, um eine verschlüsselte Antwort von Cockpit zu erhalten Betrüger könnten das verschlüsselte DATA-Element kopieren, welches an URLFailure gesendet wurde, und betrügerisch dasselbe DATA an URLSuccess senden. Überprüfen Sie daher unbedingt den "code"-Wert des DATA-Elements. Nur eine Antwort mit "code=00000000" sollte als erfolgreich angesehen werden.

Key	Format	CND	Description	Beschreibung
URLFailure	ans..256	M	Complete URL which calls up Cockpit if payment has been unsuccessful. The URL may be called up only via port 443. This URL may not contain parameters: In order to exchange values between Cockpit and shop, please use the parameter UserData. Common notes: We recommend to use parameter "response=encrypted" to get an encrypted response by Cockpit However, fraudster may just copy the encrypted DATA-element which are sent to URLFailure and send the DATA to URLSuccess/URLNotify. Therefore ensure to check the "code"-value which indicates success/failure of the action. Only a result of "code=00000000" should be considered successful.	Vollständige URL, die das Cockpitaufruft, wenn die Zahlung gescheitert ist. Die URL darf nur über Port 443 aufgerufen werden. Diese URL darf keine Parameter enthalten: Um Parameter durchzureichen nutzen Sie stattdessen den Parameter UserData. Allgemeine Hinweise: Wir empfehlen, den Parameter "response=encrypted" zu verwenden, um eine verschlüsselte Antwort von Cockpit zu erhalten Betrüger könnten das verschlüsselte DATA-Element kopieren, welches an URLFailure gesendet wurde, und betrügerisch dasselbe DATA an URLSuccess/URLNotify senden. Überprüfen Sie daher unbedingt den "code"-Wert des DATA-Elements. Nur eine Antwort mit "code=00000000" sollte als erfolgreich angesehen werden.

Key	Format	CND	Description	Beschreibung
Response	a7	O	Status response sent by Cockpit to URLSuccess and URLFailure, should be encrypted. For this purpose, transmit Response=encrypt parameter.	Die Status-Rückmeldung, die das Cockpit an URLSuccess und URLFailure sendet, sollte verschlüsselt werden. Dazu übergeben Sie den Parameter Response=encrypt.

Key	Format	CND	Description	Beschreibung
URLNotify	ans..256	M	Complete URL which Cockpit calls up in order to notify the shop about the payment result. The URL may be called up only via port 443. It may not contain parameters: Use the UserData parameter instead. Common notes: We recommend to use parameter "response=encrypted" to get an encrypted response by Cockpit However, fraudster may just copy the encrypted DATA-element which are sent to URLFailure and send the DATA to URLSuccess/URLNotify. Therefore ensure to check the "code"-value which indicates success/failure of the action. Only a result of "code=00000000" should be considered successful.	Vollständige URL, die das Cockpit aufruft, um den Shop zu benachrichtigen. Die URL darf nur über Port 443 aufgerufen werden. Sie darf keine Parameter enthalten: Nutzen Sie stattdessen den Parameter UserData. Allgemeine Hinweise: Wir empfehlen, den Parameter "response=encrypted" zu verwenden, um eine verschlüsselte Antwort von Cockpit zu erhalten Betrüger könnten das verschlüsselte DATA-Element kopieren, welches an URLFailure gesendet wurde, und betrügerisch dasselbe DATA an URLSuccess/URLNotify senden. Überprüfen Sie daher unbedingt den "code"-Wert des DATA-Elements. Nur eine Antwort mit "code=00000000" sollte als erfolgreich angesehen werden.

Parameters for Hosted Payment Page

Following parameters are optional and can be submitted unencrypted to the Hosted Payment Page:

Optional parameters for Hosted Payment Page

Corporate PaymentPage: XSLT layout for forms

You can change the parameter Template to create an individual layout for your Hosted Payment Page form which exactly matches the shop layout To this end your graphic designer can design an HTML-template in the shop-design based on XSLT (Extensible Stylesheet Language Transformation). Pay-Jet Support copies this XSLT-template to our Cockpit Server. If you enter the name of your XSLT-file in the Template parameter, the Cockpit form will appear in your layout.

The XSLT templates for the Hosted Payment Page form have several advantages:

1. Merchants can bypass the costly PCI-security authorisation
2. The Hosted Payment Page is responsive, i.e. it works on Smartphones, Tablets or on the Laptop

For general information about XSLT see www.w3.org.

The subsequent conventions apply for the use of the Corporate Paypage with XSLT:

File names

A XSL file designed by you defines your individual layout. The associated XML file contains the texts that are to be displayed on the form. Hence, multilingualism is easy. Always use your MerchantID in the names of the files.

In order not to receive safety notices, please ensure that external image sources are retrieved via SSL.

In order to call the individual layout, use the ‘Template’ parameter with your MerchantID and attach it unencrypted to the call of the form of Hosted Payment Page, for example:

https://www.payjet-cockpit.de/paymentPage.aspx?MerchantID=IhreMID&Len=123&Data=AGSDJ…ASDF&template=IhreMerchantID

Hidden Fields

The following hidden fields must be implemented so that the values can be passed on when sending the form:

Language selection

The language selection on the Hosted Payment Page form occurs automatically depending on the parameter Language. Other language areas are filtered out. If you wish to access the field of another language area e.g. with JavaScript, you can do so via the following path: paygate/language/@name.

XML structure

The ‘Language’ parameter controls which section of the XML text file is read out. German ‘de’ is always used as standard.

The XML file should have the following basic structure:

<?xml version="1.0" encoding="utf-16"?>
      </languages>
            <language name="de">
                  <title>Zahlung</title>
                  ...
            </language>
            <language name="en">
                  <title>Payment</title>
                  ...
            </language>
      </languages>

‘UTF-8’ is also possible for the encoding.

With <xsl:variablename=““ select=“paygate/language/@name”/> you can directly address an XML language section from the XSL file.

For an overview of which parameters are rendered by the Hosted Payment Page, please examine the following structure (XSL file is rendered against the following XML string):

strXML = "<?xml version='1.0' encoding='windows-1252'?>" & _
<paygate>
      <merchantID>...</merchantID>
      <len>257</len>
      <data>E98D4...F7065</data>
      <template>
      <urlBack><![CDATA[http://www.google.de]]></urlBack>
      <paymentMethods>
            <VISA type="CC" displayName="Visa"/>
            <MasterCard type="CC" displayName="MasterCard"/>
            <AMEX type="CC" displayName="American Express"/>
            <DINERS type="CC" displayName="Diners Club International"/>
            <Discover type="CC" displayName="Discover"/>
            <JCB type="CC" displayName="JCB"/>
            <EDD lowercase="edd">
            <PayPal lowercase=="paypal">
            <iDEAL lowercase=="ideal">
      </paymentMethods>
      <language name="de">
            <title>Zahlung</title>
            ...
      </language>
</paygate>

JavaScript

You can find individual JavaScript methods either in the HEAD section of your XSL file or within the file main.js that can be found in the images folder at Templates/imagesMerchantID_PaymentPage/js.

Notice: Please do not use any external links to your JavaScript!