Hosted Payment Page
1.1 General information about Hosted Payment Page
1.3 Calling the Hosted Payment Page
1 About Hosted Payment Page
1.1 General information about Hosted Payment Page
The Hosted Payment Page is a checkout that contains only the step of selecting the payment method. It is a HTML form with responsive design that is displayed properly on all devices.
In the case of payments via Hosted Payment Page, the shop redirects its customers to the 1cs Online Payment System HTML form where they selects their payment method. After confirming the selection depending on the payment method 1cs Online Payment System forwards the customer to a 1cs Online Payment System HTML form or to a form from an external service provider and notifies the shop after completion about the payment result.
Following table contains the payment methods which you can use via Hosted Payment Page:
| Zahlungsart | PayType |
| Barzahlen | Barzahlen |
| Kreditkarte | CC |
| ClickToPay | ClickToPay |
| Lastschrift | EDD |
| PayPal | PayPal |
| Apple Pay | ApplePay |
| Google Pay | GooglePay |
| EasyCollect | EasyColl |
| EPS | EPS |
| iDEAL | iDEAL |
| Instanea | Instanea |
| Klarna | KlarnaPM |
| Boleto | BoletoPP |
| Chinapay | Chinapay |
| CUP | CUPPP |
| Sofort | Sofort |
| Alipay | Alipay |
| Bancontact | BanconPP |
| Bank Transfer | BankTranPP |
| Bluecode | Bluecode |
| Dragonpay | DragonPP |
| eNETS | ENETSPP |
| Finland Online Bank Transfer | FinOBTPP |
| Indonesia ATM | IndoATMPP |
| MB Way | MBWayPP |
| Multibanco | MultibanPP |
| My Bank | MyBankPP |
| MyClear FPX | MyClearPP |
| Pay by Bank | OpenBank |
| Przelewy 24 | P24PP |
| PostFinance | POSTFINPP |
| paysafecard | PSCPP |
| RHB Bank | RHB BankPP |
| SafetyPay | SafetyPPP |
| Swish | Swish |
| 7-Eleven | SevenElePP |
| Skrill | SkrillPP |
| TrustPay | TrustPayPP |
| Trustly | Trustly |
| TWINT | TWINT |
| WeCatPP | |
| VIPPS | VIPPS |
Following table lists all card brands that can be uses via the Hosted Payment Page. When submitting the value CC in parameter PayTypes all brands are displayed that are configured for a certain merchant. Selecting specific brands can be done by submitting a string of the desired brand names separated by pipe signs.
| Kreditkartenmarke / Scheme Names → values for CCBrand |
| AirPlus |
| AMEX |
| ARGENCARD |
| Aura |
| Bancontact |
| CABAL |
| Cartes Bancaires |
| Maestro |
| CBN |
| CENCOSUD |
| ComfortCard |
| CUP |
| Dankort |
| DINERS |
| Discover |
| Elo |
| Hipercard |
| JCB |
| Maestro |
| MasterCard |
| NARANJA |
| RuPay |
| SHOPPING |
| TOTAL |
| VISA |
1.2 Process of payment
To make payments via the Hosted Payment Page you send a request to following URL with HTTPS GET or HTTPS POST:
https://www.computop-paygate.com/paymentPage.aspx
All details required for payment processing are forwarded as parameters. The parameters are encrypted with Blowfish to ensure that neither the customer nor a third party can manipulate the data.
When calling the form, the OPS decrypts the parameters and shows the HTML page with the payment methods. The customer selects the payment method and triggers the forwarding by clicking the button “Next”.
After the payment has been made the OPS redirects the customers back to a shop page via HTTPS GET (URLSuccess, URLFailure) and transmits the result of the payment as a Blowfish-encrypted parameter string to these URLs. In addition, the OPS transmits the result via HTTPS POST to the shop’s Notify page (URLNotify). The shop accepts the payment result and decrypts the data in order to inform the customer about the status.
1.3 Calling the Hosted Payment Page
Calling the Hosted Payment Page starts with the correct composition of the parameters which consist of a key and a value and which are separated by an equals sign (=):
MerchantID=Test
All parameters are assembled in a character string and separated by the character &:
Amount=100&Currency=EUR&TransID=12345
Notice: Since the characters “=” and “&” are used as separating characters, these characters cannot be transmitted as values. All values which you transmit without BlowFish-encryption must be URL-Encoded..
A correct parameter character string for the OPS contains three basic parameters: MerchantID, Len and Data. The parameters MerchantID and Len are unencrypted. Only the Data parameter is Blowfish-encrypted:
MerchantID=Test&Len=67&Data=0A67FE96a65d384350F50FF1
The Data parameter contains the sensitive payment details such as amount and currency. The encrypted bytes are Hex-encoded and completed to two characters from the left with a zero. Encryption is via Blowfish ECB and is available to you as source-code and components.
The Len parameter is very important for encryption because it contains the length of the unencrypted(!) character string in the Data parameter. Since the data quantity to be encrypted is increased by a multiple of 8 in the case of the Blowfish encryption, the correct length of the character string must be known for decryption. Otherwise accidental characters emerge at the end of the character string.
The parameters are transmitted via HTTPS POST or HTTPS GET. The recommended transmit method is HTTPS POST because the parameter character string in the case of GET is attached to the URL, which is limited to 2048 bytes depending on the browser.
Notice: Please note that the maximum length of a payment request is limited to 5120 characters. If you require longer strings please contact First Cash Solution Support.
The following listings show the development of a payment request. The first listing is the unencrypted parameter character string:
MerchantID=Test&TransID=100000001&Amount=11&Currency=EUR&URLSuccess=https://www.shop.com/ok.html&URLFailure=https://www.shop.com/failed.html&URLNotify=https://www.shop.com/notify.cgi&OrderDesc=My order
Notice: Please note that a value is to be assigned to each parameter. Do not transmit empty parameters, as this can cause the payment to fail.
This character string is encrypted and transmitted as the Data parameter. The HTTPS GET request for the Hosted Payment Page looks like this:
Notice: Please note that parameters like Language or URLBack are transmitted unencrypted. A table with all possible unencrypted parameters can be found also witihn this document.
2 1cs OPS interface
2.1 Definitions
2.1.1 Data formats
| Format | Description |
| a | alphabetical |
| as | alphabetical with special characters |
| n | numeric |
| an | alphanumeric |
| ans | alphanumeric with special characters |
| ns | numeric with special characters |
| bool | boolean expression (true or false) |
| 3 | fixed length with 3 digits/characters |
| ..3 | variable length with maximum 3 digits/characters |
| enum | enumeration of allowed values |
| dttm | ISODateTime (YYYY-MM-DDThh:mm:ss) |
2.1.2 Abbreviations
| Abbreviation | Description | Comment |
| CND | condition | |
| M | mandatory | If a parameter is mandatory, then it must be present |
| O | optional | If a parameter is optional, then it can be present, but it is not required |
| C | conditional | If a parameter is conditional, then there is a conditional rule which specifies whether it is mandatory or optional |
Notice: Please note that the names of parameters can be returned in upper or lower case.
2.2 Parameters of the Hosted Payment Page
These parameters are mandatory for all payment methods and has to be submitted Blowfish-encrypted within the Data parameter to the Hosted Payment Page.
Notice: Please take all further parameters specifically for a payment method from the manual of that respective payment method.
The following table describes the encrypted payment request parameters:
| Key | Format | CND | Description |
| MerchantID | ans..30 | M | MerchantID, assigned by First Cash Solution. Additionally this parameter has to be passed in plain language too. |
| Amount | n..10 | M | Amount in the smallest currency unit (e.g. EUR Cent) Please contact the helpdesk, if you want to capture amounts < 100 (smallest currency unit). |
| Currency | a3 | M | Currency, three digits DIN / ISO 4217 |
| MAC | an64 | M | Hash Message Authentication Code (HMAC) with SHA-256 algorithm. Details can be found here: HMAC Authentication (Request) HMAC Authentication (Notify) |
| TransID | ans..64 | M | TransactionID which should be unique for each payment |
| RefNr | ns..30 | O | Unique reference number -> exact format depends on the available paymethods for your MerchantId. Please choose your format in that way that all paymethods are covered. |
| OrderDesc | ans..384 | M | Description of purchased goods, unit prices etc. Please note: The first 27 characters appear on the customer-account statement. You can view the full data in the Merchant Cockpit. |
| UserData | ans..1024 | O | If specified at request, the OPS forwards the parameter with the payment result to the shop |
| URLSuccess | ans..256 | M | Complete URL which calls up the OPS if payment has been successful. The URL may be called up only via port 443 This URL may not contain parameters: In order to exchange values between the OPS and shop, please use the parameter UserData. -> Common notes: – We recommend to use parameter “response=encrypted” to get an encrypted response by Paygate – However, fraudster may just copy the encrypted DATA-element which are sent to URLFailure and send the DATA to URLSuccess. Therefore ensure to check the “code”-value which indicates success/failure of the action. Only a result of “code=00000000” should be considered successful. |
| URLFailure | ans..256 | M | Complete URL which calls up the OPS if payment has been unsuccessful. The URL may be called up only via port 443 This URL may not contain parameters: In order to exchange values between the OPS and shop, please use the parameter UserData. -> Common notes: – We recommend to use parameter “response=encrypted” to get an encrypted response by Paygate – However, fraudster may just copy the encrypted DATA-element which are sent to URLFailure and send the DATA to URLSuccess/URLNotify. Therefore ensure to check the “code”-value which indicates success/failure of the action. Only a result of “code=00000000” should be considered successful. |
| Response | a7 | O | Status response sent by the OPS to URLSuccess and URLFailure, should be encrypted. For this purpose, transmit Response=encrypt parameter. |
| URLNotify | ans..256 | M | Complete URL which the OPS calls up in order to notify the shop about the payment result. The URL may be called up only via port 443 It may not contain parameters: Use the UserData parameter instead. -> Common notes: – We recommend to use parameter “response=encrypted” to get an encrypted response by Paygate – However, fraudster may just copy the encrypted DATA-element which are sent to URLFailure and send the DATA to URLSuccess/URLNotify. Therefore ensure to check the “code”-value which indicates success/failure of the action. Only a result of “code=00000000” should be considered successful. |
| ExpirationDate | ans..19 | O | Timestamp for the end time of the PaymentPage call, currently specified in European time (CET/DST). Time zone evaluation will be changed to UTC uniformly soon. Format: YYYY-MM-ddTHH:mm:ss |
Following parameters are optional and can be submitted unencrypted to the Hosted Payment Page:
| Key | Format | CND | Description |
| Template | ans..20 | O | Name of XSLT-file with your own layout for the HPP pay form. |
| CCTemplate | ans..20 | O | Name of XSLT-file with your own layout for the pay form. If you want to use the redesigned and downwards compatible 1cs OPS template, please transfer the template name “ct_compatible”. If you want to use the responsive 1cs OPS template for mobile devices, please transfer the template name “ct_responsive”. The payment method “Bancontact” can also be called via payssl.aspx. Therefore “template=ct_bcmc” has to be submitted mandatory, in order to the special Bancontact template will be used. It should be noted that Bancontact must already be selectable as a payment method in the checkout process. The template cannot be modified and must be used in exactly the same way, as it is based on strict Bancontact guidelines. This is only valid for integration with Omnipay: EMS payment solutions. |
| SDDTemplate | ans..20 | O | Name of XSLT-file with your own layout for the direct debit form. This is used only if the customer selects direct debit as payment method and clicks on „Next“ button. If you don’t submit a value the responsive First Cash Solution direct debit form template is displayed. |
| ECTemplate | ans..20 | O | Name of a XSLT template to get an individual layout for your EasyCollect form which matches with your shop layout. This is used only if the customer selects EasyCollect as payment method and clicks on „Next“ button. If you don’t submit a value the standard EasyCollect form template is displayed. |
| Language | a2 (enum) | O | Language code: <de> German, <al> Albanian, <at> Austrian, <cz/cs> Czech, <dk> Danish, <en> English, <fi> Finish, <fr> French, <gr> Greek, <hu> Hungarian, <it> Italian, <jp> Japanese, <nl> Dutch, <no> Norwegian, <pl> Polish, <pt> Portuguese, <ro> Romanian, <ru> Russian, <es> Spanish, <se> Swedish, <sk> Slovakian, <sl> Slovenian, <tr> Turkey, <zh> Simplified Chinese. No details means the language is German. The supported languages may vary depending on the selected template. |
| URLBack | ans..256 | O | Complete URL which Paygate calls in case that Cancel is clicked by the customer. The parameter “URLBack” can be sent – either as plain parameter (unencrypted) (compatibility mode) – or be part of encrypted payment request parameters (preferred mode) In order to exchange values between Paygate and shop you may use something like this: URLBack=https://your.shop.com/back.php?param1%3Dvalue1%26param2%3Dvalue3%26status%3Dcancelled When user cancels payment this URL is called exactly like this and you may use URL Decode to extract parameter and values. |
| PayTypes | ans..256 | O | With this parameter you can override the payment methods to be displayed, i.e. you can decide within this parameter separated by pipe which of the available payment methods are displayed. Take the possible values from the column PayType within the table of payment methods given above. Example: …&PayTypes=CC|EDD|Alipay |
2.3 General response parameters of the Hosted Payment Page
These parameters are equally for all payment methods. With the parameter pt you can see which payment method the customer used. Please take all further parameters specifically for a payment method from the manual of that respective payment method.
The following table gives the result parameters which Computop Paygate transmits to URLSuccess or URLFailure and URLNotify. If you have specified the Response=encrypt parameter, the following parameters are sent Blowfish encrypted to your system:
pls. be prepared to receive additional parameters at any time and do not check the order of parameters
the key (e.g. mid, RefNr) should not be checked case-sentive
| Key | Format | CND | Description |
| MID | ans..30 | M | MerchantID, assigned by First Cash Solution. |
| pt | ans..256 | O | Information about the used paytype according to the table of payment types above |
| PayID | an32 | M | ID assigned by 1cs OPS for the payment, e.g. for referencing in batch files as well as for capture or credit request. |
| XID | an32 | M | ID for all single transactions (authorisation, capture, credit note) for one payment assigned by 1cs OPS |
| TransID | ans..64 | M | TransactionID provided by you which should be unique for each payment |
| Status | a..50 | M | OK or AUTHORIZE_REQUEST (URLSuccess) as well as FAILED (URLFailure) |
| Description | ans..1024 | M | Further details in the event that payment is rejected. Please do not use the Description but the Code parameter for the transaction status analysis! |
| Code | an8 | M | Error code according to 1cs OPS Response Codes |
| MAC | an64 | M | Hash Message Authentication Code (HMAC) with SHA-256 algorithm. Details can be found here: HMAC Authentication (Request) HMAC Authentication (Notify) |
| UserData | ans..1024 | O | If specified at request, Paygate forwards the parameter with the payment result to the shop. |
| Plain | ans..50 | O | A single value to be set by the merchant to return some information unencrypted in response/notify, e.g. the MID. “Plain”-parameter is part of encrypted “Data” in 1cs OPS and therefore protected against manipulation. |
| Custom | ans..1024 | O | “Custom”-parameter is added to the request data before encryption and is part of encrypted “Data” in 1cs OPS request. By this they are protected against manipulation by a consumer. The Custom-value is added to the 1cs OPS response in plain text and the “|” is replaced by a “&”. By this you can put a single value into Custom-parameter and get multiple key-value-pairs back in response for your own purpose. |
