PayFanout API reference
    Preparing search index...

    Interface WorldlineSessionContextV1

    Worldline Direct's Hosted Tokenization is tokenize-first: the browser tokenizes the card into a hostedTokenizationId, and the payment object only exists once the server's completePayment call creates it — yet that call needs amount/currency/capture-method, none of which are sent at tokenization time. PayFanout is stateless, so createPaymentSession encodes that context into the pspSessionId itself: base64url(json) + "." + base64url(hmac).

    The HMAC (sessionSigningKey) makes the context tamper-proof: the token round-trips through the browser, and without the signature a client could inflate/deflate the amount before server completion. The client adapter never needs this token — the tokenization iframe is addressed by the session's clientSecret (the hostedTokenizationUrl), and confirm() returns the hostedTokenizationId produced in the browser.

    Every context carries an expiry (expiresAt, epoch ms): a signed token must not stay completable forever. Enforced at decode time — completePayment rejects expired tokens with code "session_expired" (hosts recover by creating a fresh session).

    Crypto is WebCrypto (async) so this module runs on edge runtimes too.

    interface WorldlineSessionContextV1 {
        amount: number;
        billingDetails?: {
            address?: {
                city?: string;
                country?: string;
                line1?: string;
                postalCode?: string;
            };
            email?: string;
            name?: string;
        };
        captureMethod: "automatic"
        | "manual";
        currency: string;
        expiresAt: number;
        hostedTokenizationId: string;
        id?: string;
        receiptEmail?: string;
        returnUrl?: string;
        shippingDetails?: ShippingDetails;
        statementDescriptor?: string;
        v: 1;
    }
    Index
    amount billingDetails? captureMethod currency expiresAt hostedTokenizationId id? receiptEmail? returnUrl? shippingDetails? statementDescriptor? v
    amount: number
    billingDetails?: {
        address?: {
            city?: string;
            country?: string;
            line1?: string;
            postalCode?: string;
        };
        email?: string;
        name?: string;
    }

    AVS data — order.customer.billingAddress on the payment.

    captureMethod: "automatic" | "manual"
    currency: string
    expiresAt: number

    Epoch milliseconds. Tokens without it are rejected.

    hostedTokenizationId: string

    The Hosted Tokenization id created at session time (POST /hostedtokenizations).

    id?: string

    Host-app internal id (PaymentSession.id), round-tripped via order.references.merchantReference.

    receiptEmail?: string

    Customer email (order.customer.contactDetails.emailAddress on the payment).

    returnUrl?: string

    3-D Secure return URL (sent as both cardPaymentMethodSpecificInput.returnUrl and its threeDSecure.redirectionData form).

    shippingDetails?: ShippingDetails
    statementDescriptor?: string

    Statement text (order.references.descriptor on the payment).

    v: 1

    Settings
    Member Visibility

    On This Page
    Properties