Developer's Guide

Gateway Developer Guide and Reference 31 July 2012 23
Introducing the Gateway Checkout Solutions
About Security
1
Secure Token
The secure token stores request transaction data on the Gateway server. It eliminates the need
to resend the parameter data for display in a hosted checkout page where the data might be
subject to compromise.
Hosted Checkout Pages
The Gateway enables the use of hosted checkout pages, which help you achieve PCI
compliance. The hosted checkout pages enable you to pass transaction data securely to the
server and to collect credit card acceptance data.
NOTE: You are required to use hosted pages with PayPal Payments Advanced and Payflow
Link.
The following figure shows the transaction flow when using hosted pages and a secure token.
Numbers in the figure correspond to the numbered comments below:
1. The customer clicks Buy to purchase merchandise on your website.
2. You request a secure token by passing a token ID to the Gateway server.
3. The Gateway server returns the secure token and your token ID to your website.
4. You submit the secure token and token ID in an HTTP post to pages hosted on the Gateway
server and redirect the customer’s browser to the hosted pages.
5. The Gateway server uses the secure token to retrieve the amount and other transaction data.
The customer submits their credit card number, expiration date, and other sensitive data
directly to the host pages rather than to your website, easing your PCI compliance
requirements.