Accepting Payments
Overview
This guide walks you through securely collecting, storing and processing payment data on a third party PSP using VGS to minimize PCI scope. The integration makes secure payment data collection easy with the VGS Collect JavaScript library and mobile SDKs. It automates exchanging aliased data with popular third-party payment vendors and can be customized to exchange data with any payment provider without a lot of code.
Advantages
PCI Compliant. Please, note that anyone involved with the processing, transmission, or storage of card data must comply with the Payment Card Industry Data Security Standards (PCI DSS). With this integration, your application seamlessly achieves PCI regulations, because no sensitive data hits your servers.
Optionality. Exchange payment data with multiple 3rd parties without being locked into one payment provider.
Integration
Step 1: Create a VGS account
Sign up for a free account with VGS Dashboard or login to an existing account. After you’ve signed up, we automatically create an Organization and a first Vault in the Sandbox environment.
Note, if you just signed up or have no routes yet, you can quickly start with downloading our personalized demo application. See how it works by clicking Try it out on your vault homepage and going through a simple 3-step flow.
If you went through the VGS for Payments quick start flow, Steps 2 and Step 3 are already pre-configured. Routes are set up for using them for the demo app and your vault.
Step 2: Securely collect payments data
Firstly, you should secure your inbound traffic, starting with your user interface. For this, use our VGS Collect product suite, JS library for Web or mobile SDKs. That allows you to securely collect data from your users via forms without having to have that data pass through your systems. The form fields behave like traditional input fields while securing access to the sensitive data.
You can always test your setup with Access Logger, where your can see requests statuses, payload diffs, matched information etc.
Step 3: Securely exchange data with payment vendors
After you create your first record with VGS, to exchange it with payment vendors you need to reveal aliased payment data. Choose one of the integrations methods to reveal your data. Please note, for using VGS Outbound connection and revealing data you need to:
Use Access credentials to send any request via VGS and reveal payments data.
{
`curl https://echo.apps.verygood.systems/post -k \
-x https://__ACCESS_CREDENTIALS__@__VAULT_HOST__:8443 \
-H "Content-type: application/json" \
-d '{"card_number": "ALIAS"}'`
}Download and use TLS certificate in your application. The certificate is the same for all Sandbox Vaults.
-----BEGIN CERTIFICATE-----
MIID2TCCAsGgAwIBAgIHAN4Gs/LGhzANBgkqhkiG9w0BAQ0FADB5MSQwIgYDVQQD
DBsqLnNhbmRib3gudmVyeWdvb2Rwcm94eS5jb20xITAfBgNVBAoMGFZlcnkgR29v
ZCBTZWN1cml0eSwgSW5jLjEuMCwGA1UECwwlVmVyeSBHb29kIFNlY3VyaXR5IC0g
RW5naW5lZXJpbmcgVGVhbTAgFw0xNjAyMDkyMzUzMzZaGA8yMTE3MDExNTIzNTMz
NloweTEkMCIGA1UEAwwbKi5zYW5kYm94LnZlcnlnb29kcHJveHkuY29tMSEwHwYD
VQQKDBhWZXJ5IEdvb2QgU2VjdXJpdHksIEluYy4xLjAsBgNVBAsMJVZlcnkgR29v
ZCBTZWN1cml0eSAtIEVuZ2luZWVyaW5nIFRlYW0wggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQDI3ukHpxIlDCvFjpqn4gAkrQVdWll/uI0Kv3wirwZ3Qrpg
BVeXjInJ+rV9r0ouBIoY8IgRLak5Hy/tSeV6nAVHv0t41B7VyoeTAsZYSWU11deR
DBSBXHWH9zKEvXkkPdy9tgHnvLIzui2H59OPljV7z3sCLguRIvIIw8djaV9z7FRm
KRsfmYHKOBlSO4TlpfXQg7jQ5ds65q8FFGvTB5qAgLXS8W8pvdk8jccmuzQXFUY+
ZtHgjThg7BHWWUn+7m6hQ6iHHCj34Qu69F8nLamd+KJ//14lukdyKs3AMrYsFaby
k+UGemM/s2q3B+39B6YKaHao0SRzSJC7qDwbWPy3AgMBAAGjZDBiMB0GA1UdDgQW
BBRWlIRrE2p2P018VTzTb6BaeOFhAzAPBgNVHRMBAf8EBTADAQH/MAsGA1UdDwQE
AwIBtjAjBgNVHSUEHDAaBggrBgEFBQcDAQYIKwYBBQUHAwIGBFUdJQAwDQYJKoZI
hvcNAQENBQADggEBAGWxLFlr0b9lWkOLcZtR9IDVxDL9z+UPFEk70D3NPaqXkoE/
TNNUkXgS6+VBA2G8nigq2Yj8qoIM+kTXPb8TzWv+lrcLm+i+4AShKVknpB15cC1C
/NJfyYGRW66s/w7HNS20RmrdN+bWS0PA4CVLXdGzUJn0PCsfsS+6Acn7RPAE+0A8
WB7JzXWi8x9mOJwiOhodp4j41mv+5eHM0reMh6ycuYbjquDNpiNnsLztk6MGsgAP
5C59drQWJU47738BcfbByuSTYFog6zNYCm7ACqbtiwvFTwjneNebOhsOlaEAHjup
d4QBqYVs7pzkhNNp9oUvv4wGf/KJcw5B9E6Tpfk=
-----END CERTIFICATE-----You can always test your setup with Access Logger, where your can see requests statuses, payload diffs, matched information etc.
What's next?
Last updated