Decrypted Apple Pay and Google Pay Tokens

Overview

If you decrypt Apple Pay or Google Pay tokens yourself, for example because you hold your own Apple Pay certificate or Google Pay keys, you can send the decrypted network token to Ryft in the walletNetworkToken field. Send the cryptogram from the decrypted token in authenticationParameters.

If you would rather Ryft decrypts the token, send the encrypted token in walletDetails instead, see Apple Pay & Google Pay.

Your account must be enabled to send wallet network tokens, and you must be PCI SAQ-D compliant, as with sending cardDetails from your server. Contact Ryft to have this enabled.

Requirements

To send decrypted wallet tokens, you must ensure that the following requirements are met:

Your account is PCI SAQ-D compliant and enabled for Server-To-Server Payments.
Your account is enabled to send wallet network tokens.
You decrypt the Apple Pay or Google Pay token on your own servers and extract the network token (DPAN), its expiry and the cryptogram.

Sending Decrypted Wallet Tokens

You can send walletNetworkToken:

to paymentSessionAttemptPayment, when calling it with your secret API key, alongside authenticationParameters
when creating a payment session with paymentSessionCreate, as attemptPayment.walletNetworkToken, alongside authenticationParameters

Field	Description
`walletNetworkToken.number`	Required. The network token number (DPAN) from the decrypted token.
`walletNetworkToken.expiryMonth`	Required. The 2-digit expiry month of the network token.
`walletNetworkToken.expiryYear`	Required. The 4-digit expiry year of the network token.
`walletNetworkToken.name`	The cardholder's name.
`walletNetworkToken.walletType`	Required. `ApplePay` or `GooglePay`.
`authenticationParameters.authenticationValue`	Required. The cryptogram from the decrypted token.
`authenticationParameters.eci`	The ECI from the decrypted token. Send it when the wallet provides one.
`authenticationParameters.protocolVersion`, `authenticationParameters.dsTransactionId`	Optional. Validated if sent.

Attempt Payment - Wallet Network Token Example

{
    "clientSecret": "ps_01FCTS1XMKH9FF43CAFA4CXT3P_secret_b83f2653-06d7-44a9-a548-5825e8186004",
    "walletNetworkToken": {
        "number": "4444333322221111",
        "expiryMonth": "10",
        "expiryYear": "2028",
        "walletType": "ApplePay"
    },
    "authenticationParameters": {
        "eci": "05",
        "authenticationValue": "AAABBEg0VhI0VniQEjRWAAAAAAA="
    }
}

Create Payment Session - Wallet Network Token Example

{
    "amount": 54550,
    "currency": "GBP",
    "customerEmail": "test@mail.com",
    "attemptPayment": {
        "walletNetworkToken": {
            "number": "4444333322221111",
            "expiryMonth": "10",
            "expiryYear": "2028",
            "walletType": "GooglePay"
        }
    },
    "authenticationParameters": {
        "eci": "05",
        "authenticationValue": "AAABBEg0VhI0VniQEjRWAAAAAAA="
    }
}

Restrictions

walletNetworkToken cannot be used:

with your public API key
with paymentMethodOptions.store set to true
for MOTO or in-person payments

Only one payment option can be sent per payment attempt: one of cardDetails, walletDetails, walletNetworkToken or paymentMethod. When creating a payment session, attemptPayment can only contain one of paymentMethod or walletNetworkToken.

A Google Pay token with the PAN_ONLY authentication method decrypts to the customer's card number, not a network token. Never send it as walletNetworkToken. Send it as cardDetails, either with Ryft performing 3DS or with your own 3DS result in authenticationParameters, see How to Use Your Own 3DS Authentication.

Errors

If a request with walletNetworkToken is not valid, it is rejected with a 400. The errors you are most likely to see are:

Error	Reason
`'walletNetworkToken' cannot be supplied when using your public api key`	`walletNetworkToken` was sent to `attempt-payment` with your public API key. Call it from your server with your secret API key.
`'walletNetworkToken' is not enabled on your account - please contact support`	Your account is not enabled to send wallet network tokens. When creating a payment session, the error refers to `'attemptPayment.walletNetworkToken'`.
`'authenticationParameters' must be provided with 'walletNetworkToken'`	`walletNetworkToken` was sent without `authenticationParameters`. When creating a payment session, the error refers to `'attemptPayment.walletNetworkToken'`.
`authenticationParameters.<field> must be provided with 'walletNetworkToken'`	A field required with a wallet network token is missing, for example `authenticationValue`.
`'paymentMethodOptions.store' cannot be true with 'walletNetworkToken'`	Wallet network tokens cannot be stored.
`'walletNetworkToken' cannot be supplied for payment session '<id>' as it cannot be used for MOTO or in-person payments`	The payment session is a MOTO or in-person payment.
`'attemptPayment' can only contain one of: [cardDetails, walletNetworkToken, paymentMethod]`	More than one payment option was sent in `attemptPayment` when creating a payment session.

Next Steps

To send card details from your server, see Server-To-Server Payments.
To let Ryft decrypt the token instead, see Apple Pay & Google Pay.
To send the result of 3DS you perform yourself, see How to Use Your Own 3DS Authentication.