Interface WorldlineServerAdapterConfig

v1HMAC API key id (the identifier half — not a secret).

Where Worldline sends the customer back after a 3-D Secure challenge, used when a session carries no returnUrl or an empty one. Worldline lists threeDSecure.redirectionData.returnUrl among the mandatory 3-D Secure properties of every card payment, so with neither, createPaymentSession is refused before anything reaches Worldline. Set it before upgrading from a release that did not require a return URL: sessions that release created without one are otherwise refused at completePayment. Like a session's own URL it must be absolute, with a protocol, and at most 200 characters; the constructor refuses one that is not.

Explicit, never inferred. sandbox -> payment.preprod.direct.worldline-solutions.com, live -> payment.direct.worldline-solutions.com.

Injected for tests.

Automatic retries for transport-level trouble only (network failure, timeout, HTTP 5xx, 429) with exponential backoff. Default 2. Safe because the idempotence key makes money-moving calls idempotent and a tokenization create is amountless. Business errors (declines, validation) are NEVER retried here.

Merchant id (PSPID) — the {merchantId} path segment on every endpoint.

Injected clock (ms since epoch). Also drives the request Date header — Worldline rejects timestamps older than five minutes, so keep it accurate.

Account capabilities vary by contract — override instead of trusting defaults.

Abort a hung Worldline connection after this many milliseconds (default 30000). The timer covers the whole exchange including the response body read. Money-moving calls carry a signed idempotence key, so a timed-out request is safe to retry (a replayed tokenization create merely re-issues an amountless session). Timeouts surface as retryable psp_unavailable.

v1HMAC secret API key (server-side only).

HMAC key for the stateless signed session context (see session-context.ts).

How long a signed session context stays completable, in seconds. Default 3600 (1h). A signed token must not be valid forever — expiry is enforced at completePayment. Worldline gives the Hosted Tokenization session behind it a maximum life span of 3 hours, and the temporary token a card entered there becomes "a lifespan of two hours" (API contract), which a longer TTL outlives. A session living 23 hours or more also outlives what Worldline promises to keep of a failed attempt made at its start or before it, so after one it gets no further attempt (see completePayment).

Injected backoff sleep for retry tests; defaults to real setTimeout.

Worldline webhook signing keys. Each webhook carries an X-GCS-KeyId naming which key signed it; pass several to rotate with no cutover (any active key verifying wins).