Direct POST Form Fields for Payment Pages 2.0

Obtain the Encrypted Credit Card Information for Direct POST

To obtain the encrypted credit card information for the encrypted_values field, complete the following steps:

1. Construct the credit card information to a string in the following format:
   #field_CreditCardNumber#field_CreditCardSecurityCode#field_CreditCardExpirationMonth#field_CreditCardExpirationYear
2. Use Base64 encoding to encode the formatted string.
3. Encrypt the encoded result from Step 2 with the public key.
4. Use Base64 encoding to encode the encrypted result from Step 3.

Credit card information can be encrypted either on your payment web page directly, or on your own backend before the encrypted value is sent to the Zuora system. Sample codes are provided below for both cases.

Note that if you get NullValue when trying to obtain the encrypted credit card information for Direct POST, it is usually due to one of the following reasons:

• The order of the credit card parameters is incorrect. 
• The Javascript library HPM2Security.js is not used to encrypt.

Sample Codes of Encryption

Option 1: The following sample code uses the encryptText Java function and HPM2Security.js to encrypt credit card information directly on the web page.

The HPM2Security.js file can be loaded on your web page from the websites with the URLs in the <Zuora_Data_Center_URL>/apps/Hosted/lite2/js/HPM2Security.js format, such as https://sandbox.na.zuora.com/apps/Hosted/lite2/js/HPM2Security.js.

function buildEncryptedValues(...) {
  // 1) Construct credit card data to a string in the desired format
  var unencrypted_values = "#" + creditCardNumber + "#" +
                          cardSecurityCode + "#" + creditCardExpirationMonth + "#" +
                          creditCardExpirationYear;

  // 2) Base64 encode the string, 3) Encrypt the Base64 string 
  // and 4) Base64 encode the encrypted data
  return encryptText(unencrypted_values, publicKey);
}

/**
 * encrypt the text using the specified public key.
 * @param text the text to be encrypted.
 * @param key the public key.
 * @returns Base64 encoded encrypted data.
 */
function encryptText(text, key) {
  if (key) {
    try {
      var key = pidCryptUtil.decodeBase64(key);
      var rsa = new pidCrypt.RSA();
      //ASN1 parsing
      var asn = pidCrypt.ASN1.decode(pidCryptUtil.toByteArray(key));
      var tree = asn.toHexTree();
      
      //setting the public key for encryption with retrieved ASN.1 tree
      rsa.setPublicKeyFromASN(tree);
      
      // Base64 encode and encrypt the string
      var crypted = rsa.encrypt(text);

      return pidCryptUtil.encodeBase64(pidCryptUtil.convertFromHex(crypted));
    } catch(e) {
      console.info(e);
    }
  }
  // return origin text if unable to encrypt
  return text;
}

Option 2: The following sample code uses the RsaEncrypter.encrypt Java function to encrypt credit card information on a Java backend. The code below depends on several libraries. You can find those libraries in the Payment Pages 2.0 sample code suite on Zuora GitHub site.

import com.zuora.rsa.security.encrypt.RsaEncrypter;
import org.apache.commons.codec.binary.Base64;

public class HPMUtils {
    public static String buildEncryptedValues(...) {
        // 1) Construct the credit card data to a string in the desired format
        String unencrypted_values = "#" + creditCardNumber + "#" +
                cardSecurityCode + "#" + creditCardExpirationMonth + "#" +
                creditCardExpirationYear;

        // 2) Base64 encode the string
        String base64Data = new String(Base64.encodeBase64(unencrypted_values.getBytes()));
        // 3) Encrypt the Base64 data and 4) Base64 encode the encrypted data
        return RsaEncrypter.encrypt(base64Data, publicKey);
    }
}

Direct POST Fields for Bank Transfer - SEPA

Direct POST Fields for Bank Transfer - Direct Debit (NZ)

Direct POST Fields for Stored Credentials

Zuora gives you the flexibility to perform cardholder initiated transactions (CITs) within or outside Zuora.