How to integrate Offsite Payments

A Jumpseller store can be integrated with any External Payment Gateway of your choice. Any online payment service, with the ability to accept HTTP requests and capability to process online payment transactions, can be integrated with your Jumpseller store as an offsite payments method.

Contents

1. How It Works
2. Request Parameters
3. Response Parameters
4. Account ID
5. Signature
6. Status Result

How It Works

1. The customer places an Order on your Jumpseller store and selects your External Payment Gateway as a payment method.

2. The customer is redirected to your Payment method URL using a POST request with the following Request Parameters. Your gateway must verify the Signature and display the payment page.

3. The customer proceeds with the transaction on your payment page.

   • If the customer completes the payment flow successfully, he should be redirected (GET) back to x_url_complete with all the required Response Parameters as query parameters, including the Signature
   • If the customer cancels or exits the payment, he should be redirected (GET) back to x_url_cancel with all the required Response Parameters as query parameters, including the Signature

4. It is best practice for your payment gateway to also POST a callback asynchronously to x_url_callback with the same Response Parameters. This ensures that orders can be completed even in cases where the customer's connection to Jumpseller is terminated by a network error.

   • Jumpseller returns an HTTP 200 status on a successful callback, otherwise we recommend to perform at least 3 retries.

Request Parameters

After the customer fills the checkout details and places the order in your store, Jumpseller will make a POST request to the URL from your external payment method settings with the following parameters:

Response Parameters

All responses submitted to the provided asynchronous Callback URL are required to include the following parameters:

Account ID

All requests and responses must include a field for account validation, x_account_id, which must match the Payment Method key field in your payment settings. This is the account identifier that must be provided by your payment gateway account.

Signature

All requests and responses must include a signed field, x_signature, to test the integrity of the requests which is obtained using HMAC-SHA256.

In a Ruby environment, the following would get you a valid signature:

OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha256'), secret, result)

• secret - the Payment Method secret field in your payment settings, this is a value which must be provided by your payment gateway account, and shared with Jumpseller.
• result - the request/response hash amassed in a single string of all key-value pairs that start with x_ prefix, sorted alphabetically, and concatenated without separators. Please make sure to exclude the field x_signature from this calculation when verifying any incoming request from the Jumpseller servers.

Important notes:

• Please make sure you are use the UTF-8 encoding.
• x_message (& x_description) - any newline characters ('\n') must be properly escaped as ('\\n') before calculating the signature.
• x_amount - values are provided as Strings with decimals, even for rounded totals (e.g. 12345.0), so they are not converted unexpectedly.
• x_signature - the parameter should be excluded from the verification for Jumpseller requests
• The parameters

Example (Ruby):

2.5.0 :001 > secret = 'external_payment_gateway_password'
 => "external_payment_gateway_password"
2.5.0 :002 > hash = { x_account_id: '223504', x_amount: '123.0', x_currency: 'EUR', x_reference: '1001', x_result: "completed",  x_timestamp: '2014-03-24T12:15:41Z', x_message: "\\nProducto:\\n1 x Energise EDT 125 ML: 29.500 EUR\\nImpuesto: €6.785,00" }
 => {:x_account_id=>"223504", :x_amount=>"123.0", :x_currency=>"EUR", :x_reference=>"1001", :x_result=>"completed", :x_timestamp=>"2014-03-24T12:15:41Z", :x_message=>"\\nProducto:\\n1 x Energise EDT 125 ML: 29.500 EUR\\nImpuesto: €6.785,00"}
2.5.0 :003 > result = hash.sort.join
 => "x_account_id223504x_amount123.0x_currencyEURx_message\\nProducto:\\n1 x Energise EDT 125 ML: 29.500 EUR\\nImpuesto: €6.785,00x_reference1001x_resultcompletedx_timestamp2014-03-24T12:15:41Z"
2.5.0 :004 > x_signature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha256'), secret, result)
 => "604be3b09fd105e68426017221437a0251c0322aa8c63b8724623ce0f590dea2"

Example (PHP):

#!/usr/bin/env php
<?php

$secretKey = "external_payment_gateway_password";

$params = array( "x_account_id" => "223504", "x_amount" => "123.0", "x_currency" => "EUR", "x_reference" => "1001", , x_result: "completed",  x_timestamp: '2014-03-24T12:15:41Z', "x_message" => "\\nProducto:\\n1 x Energise EDT 125 ML: 29.500 EUR\\nImpuesto: €6.785,00" );

$keys = array_keys($params);
sort($keys);

$toSign = "";
foreach ($keys as $key) { $toSign .= $key . $params[$key]; }

$sign = hash_hmac('sha256', $toSign, $secretKey);
echo $sign . "\xA";

// => 604be3b09fd105e68426017221437a0251c0322aa8c63b8724623ce0f590dea2
?>

Status Result

All responses submitted to the provided Callback URL must include a x_result field with one of the following string values:

• pending - The equivalent to Pending Payment in your Jumpseller Admin Panel, this action will add a message to the Order History without changing Order's status.
• failed - The equivalent to Canceled in your Jumpseller Admin Panel, this action will cancel the order and change its status.
• completed - The equivalent to Paid in your Jumpseller Admin Panel, this action will change the order status.