Search Developer Site

Mobile In-App Transactions

The Authorize.Net Accept Mobile SDKs allow mobile developers to provide credit card payment functionality in their mobile applications, without having to pass sensitive card data back to their application backend servers. The SDKs allow you to accept the input of credit card data directly, or tie in to Apple Pay or Android Pay to leverage your mobile operating system's secure payment framework.

For in-person payments using a mobile point-of-sale application, see the In-Person SDK.

The three payment options work similarly, using a three-step process. Only step 1 differs, depending on which in-app solution you implement.

Step 1.

The Accept Mobile SDK sends payment and authentication information to Authorize.Net, which returns a payment nonce.

Apple Pay and Android Pay: Send a request using Apple or Google's native SDK to retrieve an encrypted BLOB (Binary Large Object), which identifies the customer's payment information.

Step 2. For all in-app options, you send the encrypted payment data obtained in Step 1 to your server.

Step 3. Your server constructs a transaction request using the Authorize.Net API, placing the encrypted payment information that it received in Step 2 in the opaqueData element.

Accept Mobile SDK

The Accept Mobile SDK for iOS or Android enables you to build your payment app without worrying about card data passing through your server. You retain complete control of the user experience.

Obtaining a Public Client Key

When you send the payment data to Authorize.Net, you use a public client key to secure it.

To obtain a public client key:

Step 1. Log in to the Authorize.Net Merchant Interface using an administrator account.

Step 2. Navigate to Account > Settings > Security Settings > General Settings > Manage Public Client Key.

Step 3. Enter the secret answer to your secret question in the section Create New Public Client Key and click Submit. The client key is shown as a string.

Securing the Payment Data

Use the Accept Mobile SDK to dispatch the payment data and receive a secure payment nonce (one-time-use token). For sample code, see our GitHub page for either iOS or Android.

Using the Secure Payment Nonce

The secure payment nonce can be used anywhere in the Authorize.Net API in place of credit card data. See our API Reference for an example of a payment transaction.

Apple Pay

Creating a Transaction Key

If you have not already done so, you must create an Authorize.Net transaction key. This key is used to create a transaction-specific signature at your server. The signature is cross-checked by Authorize.Net servers when a transaction request is received, ensuring that no transaction is initiated by the consumer without your approval.

NOTE: Ensure that your transaction key is stored securely on your merchant server. Never store it within your app code on the device. If the key is compromised, generate a new key.

To create a transaction key:

Step 1. In the Authorize.Net Merchant Interface, navigate to Account > Settings > Security Settings > General Security Settings > API Login and Transaction Key.

Step 2. Enter the answer to the secret question in the Secret Answer field.

Step 3. Click Submit.

Signing Up for the Service

Apple Pay uses payment network tokenization. If your processor does not support payment network tokenization or if Authorize.Net does not support your payment processor's tokenization interface, you cannot sign up for Apple Pay through Authorize.Net.

To sign up for Apple Pay:

Step 1. Log in to the Authorize.Net Merchant Interface.

Step 2. Navigate to the Digital Payment Solutions section.

Step 3. In the Apple Pay section, click Sign Up.

Obtaining an Apple Merchant ID

You must obtain an Apple merchant ID before you can generate the Certificate Signing Request (CSR) that Apple requires.

To obtain an Apple Merchant ID:

Step 1. Navigate to the Apple World Wide Developer Relations (WWDR) website & Member Center & Certificates, Identifiers, & Profiles.

Step 2. In the Register Merchant IDs section, click Continue. Your Merchant ID is in the Identifier field.

Step 3. Click Done.

Generating the CSR

You must submit a Certificate Signing Request (CSR) to Apple in order to receive a necessary payment entitlement certificate.

To generate the CSR:

Step 1. Log in to the Authorize.Net Merchant Interface

Step 2. Navigate to Home > Digital Payments Solutions > Apple Pay.

Step 3. Enter your Apple Merchant ID in the Apple merchant ID field.

The Apple Merchant ID that you enter must be identical to the one that you created at the Apple site. If it is different, Authorize.Net will not be able to to decrypt the payment data.

Step 4. Click Generate Apple CSR.

Submitting the CSR File to Apple

You must submit the CSR to Apple in order to receive the required payment entitlement certificate.

To submit the CSR file to Apple:

Step 1. Navigate to the Apple World Wide Developer Relations (WWDR) website & Member Center & Certificates, Identifiers.

Step 2. In the Merchant ID page, click Edit.

Step 3. In the iOS Merchant ID Settings page, click Create Certificate.

Step 4. Follow the instructions to submit the CSR.

Apple Pay Transactions

To process an Apple Pay transaction, use createTransactionRequest, using the opaqueData field instead of credit card, bank account, profile, or any other type of payment field. For more information on submitting the payment request, see the Apple Pay section of the API Reference Guide.

Note: Keep the following points in mind when submitting Apple Pay transactions:

  • Both opaque parameters must be specified.
  • You cannot include card number or expiration date.
  • You cannot include track data.
  • Must be an e-commerce transaction. Confirm that your gateway account is set up as a card-not-present account. You can also submit marketType=0 in the createTransactonRequest.
  • The transaction must be an authorization or authorize and capture type of transaction.
  • You cannot include 3D Secure data.
  • You must submit data that can be successfully decrypted.
  • Decrypted data must belong to the merchant submitting the request.
  • The submitted data must be base64 encoded.

Identifying Apple Pay Transactions in the Merchant Interface

You can identify Apple Pay transactions in the Transaction Detail view of the Authorize.Net Merchant Interface.

To identify an Apple Pay transaction:

Step 1. Log in to the Authorize.Net Merchant Interface and navigate to Reports > Transaction Detail.

Step 2. Choose an Item Type and a Date from their respective drop-down menus and click Run Report.

Step 3. Choose a transaction by clicking its Trans ID.

The Transaction Details lightbox appears. Apple Pay information is contained in the Tokenization Information section.

Android Pay

Signing Up for the Android Pay Service

Before you can use Android Pay with Authorize.Net, you must sign up for the service in the Authorize.Net Merchant Interface.

To sign up for Android Pay through Authorize.Net:

Step 1. Log in to the Merchant Interface.

Step 2. Navigate to Account > Digital Payment Solutions.

Step 3. In the Android Pay section, click Sign Up.

Generating and Managing Android Pay Public Keys

Google will send your app a unique Base64-encrypted message via the Android API. Google requires an identifier and public key in order to encrypt sensitive payment credentials. You must already have an Authorize.Net API login ID and transaction key before generating Android Pay public keys.

To generate an Android Pay public key:

Step 1. Log in to the Merchant Interface.

Step 2. Navigate to Account > Digital Payment Solutions > Android Pay.

Step 3. In the Manage Your Android Pay Keys section, click Generate Public Key.

Step 4. After the key generates, you can download it as a text file by clicking Download.

Google-Specific Integration Steps

Before submitting an Android Pay transaction using the Authorize.Net API, follow these steps to integrate Google's Android Pay SDK. For the most part, it is the same as Google's Android Pay integration tutorial. However, there are a few differences, explained below.

Step 1. When you request a token, follow the instructions to request a "network token".

Step 2. The token can be retrieved as a JSON string by using:

Step 3. Base64 encode the JSON string that you obtained in Step 2:

Step 4. Using the Base64 encoded JSON string generated in Step 2, create a new JSON object:

Step 5. Base64 encode the resulting JSON string and you will finish with an encrypted string that you can send to Authorize.Net for processing: