Hosted Forms is an enabler that's available on the Orbipay platform. It provides an easy way to integrate Orbipay payments with client website, thereby obviating the need for PCI compliance. It does so by creating secure tokens for each payment request, that can be used only once. Hosted Forms comes with an SDK that simplifies the client integration. The SDK comes in various languages like Java, Python, C#, Node.js and PHP.

Overview

The requests are authenticated using the api_key which is shared with the client at the time of client on-boarding. The client can only invoke those APIs based on the permissions assigned to the api_key

The HTTP Authorization request header is used to provide authentication information. This header looks like the following.

Authorization : OPAY1-HMAC-SHA256 Credential=...,Signature=...

The constituents of the authorization header are explained in the table below.

Signature Calculation

Signature is calculated as follows.

Base64(HMAC-SHA256(secret,input))

The calculation is explained in detail below.

The string input is computed as follows.

input = method():path():queryString():headers():payload()

Each of the substrings is explained below.

Orbipay Hosted Forms provides server SDKs in Java, Python, C#, Node.js and PHP languages which are used to confirm payment from client's server . Orbipay Hosted Forms application utilizes secure RSA (size 2048) public and private key algorithm to encrypt and decrypt the token information between client server SDKs and Orbipay Hosted Forms. The unique public and private key pair are shared with clients, enabling them to make API requests securely and encrypt the sensitive information at field / parameter level. All requests must pass through key pair validation, and appropriate responses are sent.

Orbipay Hosted Forms uses standard HTTP response codes to return the status of an API call. Additional information, such as errors, may be useful to a caller. An HTTP response code of 2xx indicates success. In this case, additional information pertaining to the request is sent back in the header parameters. An HTTP response code of 4xx or 5xx indicates a processing error. In this case, Orbipay also returns a list of errors in the response body in JSON. Each error has a code, message, and specifics on which field the error pertains to (if applicable.)

API Specific Error codes

Custom fields are useful for storing additional structured information on an object. Orbipay supports custom fields for Customer Accounts and for Payments. For example, you could store the customer’s full name and corresponding unique identifier from your system, on a Orbipay Customer object. Custom fields are only captured and stored by Orbipay and not used for processing of any sort. Please contact support@billerpayments.com for any additional requirement you may have on custom fields.