Direct Payments

What is this?
A direct (host-to-host) card charge where the Merchant collects card data in its own UI, encrypts it with a key from PlexyPay, and creates a payment via POST /v1/payments/direct. 3-D Secure may be required by the Bank/ACS.

Actors

User — payer in the merchant’s UI

Merchant — frontend + backend that collects and encrypts card data

PlexyPay — payment API/orchestrator (routes, 3-DS handling, webhooks)

Bank / ACS — issuer/acquirer side (authorization & 3-D Secure)

When to use

You need a fully API-only flow (no hosted checkout UI).

You control the entire user experience and PCI scope.

You can handle 3-D Secure redirects/challenges.

Security & Prerequisites

Encryption key: obtain via GET /v1/keys; encrypt card data client-side.

PCI DSS: Host-to-Host requires merchant-side PCI DSS compliance.

Idempotency: send an Idempotency-Key header for every charge attempt.

Webhooks: expose an HTTPS endpoint to receive asynchronous status updates.

DANGER

Do not send raw PAN/CVV to your backend unless you are PCI DSS certified. Encrypt card data on the client, and send only encrypted fields to your server/API.

Direct Payment Integration Flow

Client-side encryption (JavaScript example)

Use this script to encrypt card fields with PlexyPay public key from GET https://api.plexypay.com/v1/keys, and then send encrypted values in your POST /v1/payments/direct request payload.

Node.js script (ready to run)

How to run

Output (example)

INFO

Encryption details (from the script):

RSA public key fetched from /v1/keys

Field-by-field encryption

Padding: RSA_PKCS1_PADDING (PKCS#1 v1.5)

Next steps

1) Generate encrypted card fields

Use the JS snippet above on the client (or in your PCI-compliant environment).

2) Create payment

Call POST /v1/payments/direct with encrypted fields, amount, currency, and your order reference.

3) Handle 3‑D Secure (if required)

If API returns a challenge/redirect URL, present it to the user and complete the flow.

4) Confirm final status via webhooks

Always rely on webhooks for final state (success/failure), and treat client responses as intermediate.

Direct Payments

Actors#

When to use#

Security & Prerequisites#

Client-side encryption (JavaScript example)#

Next steps#

Actors

When to use

Security & Prerequisites

Client-side encryption (JavaScript example)

Next steps