Payment tokenization overview

You can integrate HCL Commerce with a payment service provider through payment tokenization. With payment tokenization, the shopper enters payment information through HCL Commerce, and HCL Commerce calls the payment service provider to replace sensitive payment information such as credit card number with a surrogate value (token). In this model, HCL Commerce only saves the token for payment processing, and non-sensitive data such as masked credit card number for display purposes.

Payment tokenization during checkout flow


Image of tokenization flow
  1. Shopper enters checkout flow and submits the payment information.
  2. The store calls POST cart/@self/payment_instruction to create the payment instruction or PUT cart/@self/payment_instruction to update the payment instruction.
  3. The API calls the create_payment_token extension code with the payment information or update_payment_token extension code with existing token data in the protocol data.
  4. The extension code calls the payment service provider to tokenize the protocol data and returns the token and other non-sensitive data in the token data.
  5. The API saves the token data as part of the cart.
  6. The store redirects the shopper to the Order summary page.
  7. Shopper submits the order.
  8. The store calls POST cart/@self/checkout to process the order.
  9. The API calls the approve_payment extension code with the financial transaction.
  10. The extension code calls the payment service provider with the saved token data in the protocol data to process payment.
  11. The extension code returns the updated financial transaction with its state set to 2 (success) or 3 (failed).

Payment tokenization during Quick checkout flow with a quick checkout profile

  1. Shopper enters and submits the Quick checkout profile.
  2. The store calls PUT person/@self/checkoutProfile to update the quick checkout profile.
  3. The API calls the create_payment_token extension code with the payment information or update_payment_token extension code with existing token data in the protocol data.
  4. The extension code calls the payment service provider to tokenize the protocol data and returns payment_token and other non-sensitive data in the token data.
  5. The API saves the token data as part of the quick checkout profile.