Integrating Silent Order Post

1. Getting Access Token OAuth2

When the shopper accesses the checkout, the merchant must generate the AccessToken from Braspag Authentication API (oAuth). On success, the API will return an AccessToken that must be populated in the script to load on the page.

To request AccessToken, send a request (POST) to the following endpoint in the server-to-server template:

How to obtain the Base64 value:

1. Concatenate "ClientId" and "ClientSecret" (ClientId:ClientSecret).
2. Code the result in base64.
3. Send a request to the authorization server with the alphanumeric code you just created.

To request your "ClientID" and "ClientSecret", please contact our Support

• MerchantId;
• Describe that you need the credentials "ClientID" e o "ClientSecret" to use Silent Order Post.

Request

--request POST "https://authsandbox.braspag.com.br/oauth2/token"
--header "Authorization: Basic {base64}"
--header "Content-Type: application/x-www-form-urlencoded" 
--data-binary "grant_type=client_credentials"

Response

{
  "access_token": "faSYkjfiod8ddJxFTU3vti_ ... _xD0i0jqcw",
  "token_type": "bearer",
  "expires_in": 599
}

{
  "access_token": "faSYkjfiod8ddJxFTU3vti_ ... _xD0i0jqcw",
  "token_type": "bearer",
  "expires_in": 599
}

2. Getting the SOP AccessToken

After obtaining AccessToken OAuth2, you should send a new request (POST) to the following URL:

Request

--request POST "https://transactionsandbox.pagador.com.br/post/api/public/v2/accesstoken"
--header "Content-Type: application/json"
--header "MerchantId: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
--header "Authorization: Bearer faSYkjfiod8ddJxFTU3vti_ ... _xD0i0jqcw"
--data-binary
--verbose

Response

As a response, you will receive a JSON ("HTTP 201 Created") with the SOP AccessToken and some other data.

{
    "MerchantId": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
    "AccessToken": "MzA5YWIxNmQtYWIzZi00YmM2LWEwN2QtYTg2OTZjZjQxN2NkMDIzODk5MjI3Mg==",
    "Issued": "2021-05-05T08:50:04",
    "ExpiresIn": "2021-05-05T09:10:04"
}

--header "Content-Type: application/json"
--header "RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
--data-binary
{
    "MerchantId": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
    "AccessToken": "MzA5YWIxNmQtYWIzZi00YmM2LWEwN2QtYTg2OTZjZjQxN2NkMDIzODk5MjI3Mg==",
    "Issued": "2021-05-05T08:50:04",
    "ExpiresIn": "2021-05-05T09:10:04"
}

⚠️

To see the legacy authentication process, which used the MerchantId and shopper IP address to create the AccessToken, click here.

3. Implementing the script

Mapping Classes

The merchant must download the script provided by Braspag, and attach it to their checkout page. This script will allow Braspag to process all card information without merchant intervention.

ℹ️

Download the Silent Order Post script at https://www.pagador.com.br/post/scripts/silentorderpost-1.0.min.js

The Merchant must parameterize the form elements with the following classes:

Setting Parameters

SCRIPT PARAMETERS

SCRIPT RESPONSE

Implementing Events

The script provided by Braspag provides three events for handling and managed by the merchant.

⚠️

For security reasons this PaymentToken may only be used for authorization. After processing it will be invalidated.

4. Authorizing with PaymentToken

After obtaining PaymentToken through the script, the authorization process is performed by sending PaymentToken in place of card data.

See example below, describing the submission of authentication data from the Gateway de Pagamento authorization request.

ℹ️

Please refer to the API Reference for the full request and response examples.

Request

{
   "MerchantOrderId":"2017051002",
   "Customer":
   {
     (...)
   },
   "Payment":
   {
     (...)
     "Card":{
         "PaymentToken":"eedcb896-40e1-465b-b34c-6d1119dbb6cf"
     }
   }
}

curl
--request POST "https://apisandbox.braspag.com.br/v2/sales/"
--header "Content-Type: application/json"
--header "MerchantId: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
--header "MerchantKey: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
--data-binary
--verbose
{
   "MerchantOrderId":"2017051002",
   "Customer":
   {
     (...)
   },
   "Payment":
   {
     (...)
     "Card":{
         "PaymentToken":"eedcb896-40e1-465b-b34c-6d1119dbb6cf"
     }
   }
}