Dynamic script/SDK load — only pulled in if this PSP is active.
Renders Worldline's Hosted Tokenization iframe (SAQ-A eligible: card data
never touches the host DOM) into a generated child of container. The
iframe is addressed entirely by the session's clientSecret (the
hostedTokenizationUrl) — no client key is needed.
options.fieldOptions passes through to the Tokenizer untouched (the host
wins), with one adapter default and one adapter-owned key:
hideCardholderName defaults to false. Worldline requires the
cardholder name yet hides its field unless told otherwise, and the
adapter never makes the useCardholderName call that would supply the
name from the host page, so the field stays visible unless the host
overrides it.validationCallback is owned by the adapter: onChange is driven from
the Tokenizer's validity reports. A callback the host passes there still
runs, after onChange, with the same result.
Tokenize-first shape: resolves requires_confirmation plus a clientToken the host passes to the server's completePayment ( /
completionEndpoint wire it automatically). The clientToken is a JSON
envelope,
{"hostedTokenizationId":"…","device":{…}}: the hostedTokenizationId, plus the browser characteristics Worldline lists among the mandatory 3-D Secure properties (order.customer.device), which only the browser can read. A characteristic the browser does not expose is left out;deviceis absent outside a browser. The server adapter release that decodes the envelope must be deployed before this one.The card is tokenized with
storePermanently: false: the adapter never vaults (no saved-payment-method surface), so Worldline keeps no token for later payments.