Integrating Silent Order Post

The operation of SilentOrderPost occurs in four stages:

1. Merchant authentication through the creation of the OAuth2 access_token for access to the Silent Order Post API;
2. Creation of the SOP AccessToken in the Silent Order Post API to integrate the script;
3. Execution of the script;
4. Sending the transaction authorization request to Gateway de Pagamento informing the PaymentToken.

1. Obtaining the OAuth2 AccessToken

When the buyer accesses the checkout, the store must generate the access_token from the authentication API (OAuth2). If successful, the API will return an access_token that should be used in the next authentication layer of the tool.

To obtain the access_token in the OAuth 2.0 standard, send a request using the HTTP POST VERB to the following URL, formed by the "environment base URL + endpoint", in the server-to-server model:

Note: The value "{base64}" for "Basic" authorization must be obtained as follows:

1. Concatenate the ClientId and ClientSecret (ClientId:ClientSecret).
2. Encode the result of the concatenation in base64.
3. Make a request to the authentication server using the generated alphanumeric code.

Ask the support team to create your merchant's ClientId and ClientSecret for use in the sandbox and production environments. In the ticket, state that you want to integrate Silent Order Post and provide your MerchantId.

Request

--request POST "https://authsandbox.braspag.com.br/oauth2/token"
--header "Authorization: Basic {base64}"
--header "Content-Type: application/x-www-form-urlencoded" 
--data-binary "grant_type=client_credentials"

Response

{
  "access_token": "faSYkjfiod8ddJxFTU3vti_ ... _xD0i0jqcw",
  "token_type": "bearer",
  "expires_in": 599
}

2. Obtaining the SOP AccessToken

Create the Silent Order Post (SOP) AccessToken by sending a POST request. Provide the OAuth2 access_token obtained in the previous step as the Bearer in the request header.

The SOP AccessToken will be provided in the script in step 3.

Request

--request POST "https://transactionsandbox.pagador.com.br/post/api/public/v2/accesstoken"
--header "Content-Type: application/json"
--header "MerchantId: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
--header "Authorization: Bearer faSYkjfiod8ddJxFTU3vti_ ... _xD0i0jqcw"
--data-binary
--verbose

Response

As a response, the store will receive a JSON ("HTTP 201 Created") containing, among other information, the SOP AccessToken.

{
    "MerchantId": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
    "AccessToken": "MzA5YWIxNmQtYWIzZi00YmM2LWEwN2QtYTg2OTZjZjQxN2NkMDIzODk5MjI3Mg==",
    "Issued": "2023-08-05T08:50:04",
    "ExpiresIn": "2023-08-05T09:10:04"
}

3. Implementing the script

Mapping classes

Download the Silent Order Post script and insert the script in JavaScript format on your checkout page. This script will allow our system to process all card information without store intervention.

Parameterize the form elements with the following classes:

*If the bp-sop-cardtype class is not provided, the script will assume that the card used in the purchase is a credit card.

Defining parameters

Script parameters

The script parameters must be inserted in the HTML of the checkout page to reference the script.

* The corresponding service needs to be enabled.

ℹ️

To enable Consulta BIN, VerifyCard or the Cartão protegido, please contact Customer Service.

Using Silent Order Post with Cartão protegido (Card vault)
Cartão protegido is the encrypted card storage service. You can use Silent Order Post to transmit card data and Protected Card to securely and encryptedly store the card, which is PCI DSS certified.

Learn more at Cartão protegido (Card vault)

Script Returns

The script will return a JSON with the PaymentToken (tokenized card that should be sent in the authorization) and card information.

Example of script return JSON

{
  "PaymentToken": "366f8470-54d0-43cb-95f5-c80a502afc27",
  "ForeignCard": false, 
  "BinQueryReturnCode": "00",
  "BinQueryReturnMessage": "Analise autorizada",
  "Brand": "Visa",
  "VerifyCardStatus": 1,
  "VerifyCardReturnCode": "00",
  "VerifyCardReturnMessage": "Transacao autorizada",
  "CardBin": "453202",
  "CardLast4Digits": "4044",
  "CardType": "Multiple",
  "Issuer": "Banco Santander",
  "IssuerCode": "033",
  "Prepaid": false   
}

Script return properties

_In Script Parameters, if enableTokenize is _true*, the script will return the CardToken instead of the PaymentToken. Learn more about CardToken in the Cartão protegido manual.

Implementing events

The provided script offers the following three events for store handling and processing:

Characteristics of the PaymentToken:
For security reasons, the PaymentToken can be used for a single authorization and/or within the period of 20 minutes. After processing, the PaymentToken will be invalidated.

4. Authorizing with PaymentToken

After obtaining the PaymentToken through the script, execute the authorization process, sending the PaymentToken instead of card data.

To submit a credit transaction, send the Payment.CreditCard.PaymentToken parameter instead of Payment.CreditCard. Learn more in the Gateway de Pagamento;
To submit a debit transaction, send the Payment.DebitCard.PaymentToken parameter instead of Payment.DebitCard. Learn more in the Gateway de Pagamento .

See the example below, describing the sending of authentication data for the authorization request to Gateway de Pagamento.

Request

{  
   "MerchantOrderId":"2017051002",
   "Customer":
   {  
     (...)
   },
   "Payment":
   {  
     (...)
     "CreditCard":{  
         "PaymentToken":"eedcb896-40e1-465b-b34c-6d1119dbb6cf"
     }
   }
}

Response

Refer to the Gateway de Pagamento for examples of authorization request responses.

Integration Example

We share a practical example on our GitHub of how you should map the classes and integrate Silent Order Post into your checkout.