Decodes the clientToken completePayment receives. The client adapter sends
a JSON envelope, {"hostedTokenizationId":"…","device":{…}}. A token that
does not start with { is a bare hostedTokenizationId — what earlier client
adapters and hand-written callers send — and is used as-is.
An empty or blank token, an envelope that is not valid JSON, or one without
a non-blank string hostedTokenizationId rejects with invalid_request.
Only the device fields a browser can read are kept — locale,
timezoneOffsetUtcMinutes, userAgent and browserData — each checked
against Worldline's API contract: one of the wrong type or beyond its limit
is dropped, and a device with nothing left is omitted. acceptHeader and
ipAddress (request headers the server observes) and deviceFingerprint
(bound to a device-fingerprinting session) are defined by Worldline but
refused from the browser, as is any key Worldline does not define. None of
that is fatal — it is risk data from the browser, not part of the amount.
Decodes the clientToken
completePaymentreceives. The client adapter sends a JSON envelope,{"hostedTokenizationId":"…","device":{…}}. A token that does not start with{is a bare hostedTokenizationId — what earlier client adapters and hand-written callers send — and is used as-is.An empty or blank token, an envelope that is not valid JSON, or one without a non-blank string
hostedTokenizationIdrejects withinvalid_request.Only the device fields a browser can read are kept —
locale,timezoneOffsetUtcMinutes,userAgentandbrowserData— each checked against Worldline's API contract: one of the wrong type or beyond its limit is dropped, and a device with nothing left is omitted.acceptHeaderandipAddress(request headers the server observes) anddeviceFingerprint(bound to a device-fingerprinting session) are defined by Worldline but refused from the browser, as is any key Worldline does not define. None of that is fatal — it is risk data from the browser, not part of the amount.