<p>Elavon downloads and stores cookies on your device when you visit our website. We use these cookies to better understand and improve your browsing experience by identifying most visited pages, personalising content, and measuring site performance.</p>


Essential cookies enable core functionality such as page navigation and access to secure areas. The website cannot function properly without these cookies; they can only be disabled by changing your browser preferences.

These are cookies that support site functionality that is visible or advantageous to you or your experience of the site, they enable websites to remember choices and provide a more personalized experience.   Functional cookies help to provide services that you request, such as language preference or layout.

Performance cookies help us to improve our website by collecting and reporting information on its usage (for example, which of our pages are most frequently visited).

These cookies and similar technologies gather information about your browsing habits. They remember that you've visited a website and share this information with other organisations, such as advertisers and platforms on which we advertise. They do this in order to provide you with ads that are more relevant to you and your interests. Although these cookies and similar technologies can track your visits to other websites, they don't usually know who you are. Without these cookies, online advertisements you encounter will be less relevant to you and your interests.

Cookie Settings

<p>U.S. Bank Europe DAC. Registered in Ireland – Number 418442..  Registered Office: Block F1, Cherrywood Business Park, Dublin 18, D18 W2X7, Ireland.</p>
<p>U.S. Bank Europe DAC, trading as Elavon Merchant Services, is regulated by the Central Bank of Ireland.</p>
<p><br>
U.S. Bank Europe DAC. Registered in Ireland with Companies Registration Office. The liability of the member is limited. United Kingdom branch registered in England and Wales under the number BR022122.</p>
<p>U.S. Bank Europe DAC, trading as Elavon Merchant Services, is a credit institution authorised and regulated by the Central Bank of Ireland.  Authorised by the Prudential Regulation Authority.  Subject to regulation by the Financial Conduct Authority and limited regulation by the Prudential Regulation Authority.  Details about the extent of our regulation by the Prudential Regulation Authority are available from us on request.</p>


Most popular solutions

Additional solutions

Fusebox integration & options

Optional platform features

Documentation

North America

Europe

Regions

Establish an adequate http timeout value to prepare for delays or connection issues. Elavon recommends setting the timeout value to 60 – 120 seconds.

## Step 1: Session token request

Request a session token :magic-link[/transaction_token]{id="api-reference#tag/Request-Session-Token"} using x-www-form-urlencoded key/value pairs. The session token response is only valid for 15 minutes and can only be used once. A session token will be returned.  

| Objects | Description |
|----------------|----------------------------------------|
| Credentials | API user credentials. :magic-link[Contact us]{id="overview#getting-started"} if you need your user credentials. <br>Required |
| Transaction type | Available :magic-link[payment types]{id="transaction-types"}<br>Required |
| Transaction amount | If no amount is provided your customer will be prompted to enter the amount |
| Payment token | See :magic-link[credit card tokens]{id="transaction-types#credit-card-tokens"} |
| Invoice number | This value is passed back to the card issuer and provided to the cardholder on their monthly statement to identify the transaction | 
| Customer name | The cardholder’s / customer’s name - prepopulates your payment page |
| Billing address | The cardholder’s / customer’s billing address to prepopulate your payment page |
| Shipping address | The cardholder’s / customer’s shipping address to prepopulate your payment page |
| Doing Business As | How information should appear on a customer's credit card statement. See :magic-link[DBA]{id="take-a-payment#processing-rates-fraud-and-chargebacks"}. |
| Purchasing cards | For use with corporate or expense cards |

## Step 2: Build your payment page

### Implement Checkout.js function
Your POST transaction request function must be able to: 

- Retrieve the session token response value.  
- Assign the session token response value to `ssl_txn_auth_token.` 
- Retrieve the data from the :magic-link[payment form.]{id="take-a-payment#sample-credit-card-transaction"}
- Your function must also include `ConvergeEmbeddedPayment.pay(paymentData, callback)` to enable your payment page to pass the collected data, process the transaction with Converge, and get the transaction response. 
   -  `paymentData` represents data that you include in the transaction request :magic-link[/hosted-payments/Checkout.js]{id="api-reference#tag/Checkout.js-Transaction-Request"}.
   -  `callback` accommodates the :magic-link[callback response]{id="take-a-payment#callback-transaction-response-sample"} variables for approved and declined requests. The callback function provides a JSON- formatted response. 

**Best Practices**
- Your credentials must be kept secure. Elavon strongly recommends passing and storing Converge credentials through server-side code instead of client-side code. 
- Always submit data to Converge through Hyper Text Transfer Protocol Secure (HTTPS) using the POST method. 
- Request parameters should be included in the body of the message.  Do not put request parameters in the request url.

### Processing rates, fraud and chargebacks
There are several options to lower credit card processing rates and minimize fraud/chargebacks.

**Address verification service (AVS)** 

Pass `ssl_avs_address` and `ssl_avs_zip` in the :magic-link[session token]{id="take-a-payment"} request or in the `paymentData` in the pay function on your payment page. AVS information is compared to the cardholder‘s ZIP code and address that the card issuer has on file. Address and ZIP code mismatches help the merchant decide whether to complete the transaction. Refer to the :magic-link[AVS response codes.]{id="response-codes#avs"} section for complete list. 

**Card verification value (CVV)** 

Pass `ssl_cvv2cvc2` and `ssl_cvv2cvc2_indicator` in the :magic-link[session token]{id="take-a-payment"} request or in the `paymentData` in the pay function on your payment page. The CVV field can be set as optional or required based on business needs. When CVV data is passed, it is compared to the cardholder‘s CVV data that the card issuer has on file, a CVV Response Code is then returned. Refer to the :magic-link[CVV2/CVC2 response codes.]{id="response-codes#cvv2cvc2"} section for complete list.  

If the CVV value is set to required: 

- A valid CVV value must be passed along with `ssl_cvv2cvc2_indicator = 1` in the pay function at the time of the authorization. 
- If a CVV indicator isn't passed but a CVV value is, Converge will default to the CVV indicator to `ssl_cvv2cvc2_indicator = 1`.

If the CVV value is set to optional: 

- A CVV value along with the appropriate `ssl_cvv2cvc2_indicator` may be passed to indicate if the CVV is present, bypassed, illegible or not present. 
- The Converge application will set the indicator to `ssl_cvv2cvc2_indicator = 1` if the CVV value is passed or Bypassed (0) if the CVV value is not passed at the time of the authorization. 

**Doing Business As (DBA)**

Dynamic Doing Business As (DBA) provides merchants with the ability to control the descriptor on their customer's credit card statements. It allows the merchant to specify, on a per-transaction basis, wording that may be more recognizable or more service-specific to the customer than their usual business name, preventing chargebacks. As an example, if the merchant sells magazine subscriptions for multiple publications, they may prefer to include the name of the publication in the authorization: `MANYMAG*BAKERS MONTHLY` or `MANYMAG*CAR DIGEST`. 

DBA is up to 25 characters constructed in the following format: 

- Constant/prefix (3, 7, or 12 fixed alphanumeric value) with asterisks (*) delimiter. 
- DBA name passed by the application. The maximum allowable length of the DBA name variable provided by the merchant can be 12, 17, or 21 based on the length setup for the constant. 

With DBA, you can include the `ssl_dynamic_dba` parameter in the :magic-link[session token]{id="take-a-payment"} request of the following transactions:  

- `ccsale` (Credit card sale)
- `ccauthonly` (Credit card authorization only) 
- `ccaddrecurring` (Credit card add recurring)  
- `ccaddinstall` (Credit card add installment) 
- `ccgettoken` (Credit card generate token) 

**Manage Fraud**
Log in to the [Converge demo environment](https://demo.convergepay.com/converge-webapp/#!/login) to review your configuration options.

#### Fraud prevention rules
- Go to **Settings > Fraud Prevention Rules** to see our standard options. See [fraud rules for eCommerce Converge customers](https://support.convergepay.com/s/article/Fraud-Rules-for-eCommerce-Converge-Customers) for more details.
- To set up customized rules, go to **Settings > Fraud Prevention Rules > Custom Rules.** See [custom fraud rules](https://support.convergepay.com/s/article/Add-Custom-Rules) for additional information. Set up a duplicate check rule in the terminal to prevent processing the same transaction more than one time.

#### HTTP Referrers
- Go to **Settings > System Setup Support** to configure HTTP referrers on terminals to only accept transactions from a pre-approved list of websites. 

#### 3D Secure
Protect from exposure to fraud and prevent unauthorized transactions using :magic-link[3D Secure]{id="3d-secure-2"}. 3D Secure shifts liability for chargebacks for fraudulent transactions from merchants onto the card issuer.

 ## Sample credit card transaction  

### HTML server-side code

```html
<html>
<head>
  <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  <title>Checkout.js Credit Card Demo</title>
  <script src="https://api.demo.convergepay.com/hosted-payments/Checkout.js"></script>
  <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
  <script>
    function initiateCheckoutJS() {
      var tokenRequest = {
        ssl_amount: document.getElementById('ssl_amount').value
      };
      $.post("SecureCredentials.php", tokenRequest, function (data) {
        document.getElementById('token').value = data;
        transactionToken = data;
      });
      return false;
    }
    function pay() {
      var token = document.getElementById('token').value;
      var card = document.getElementById('card').value;
      var exp = document.getElementById('exp').value;
      var cvv = document.getElementById('cvv').value;
      var gettoken = document.getElementById('gettoken').value;
      var addtoken = document.getElementById('addtoken').value;
      var invoice = document.getElementById('invoice').value;
      var firstname = document.getElementById('name').value;
      var lastname = document.getElementById('lastname').value;
      var address1 = document.getElementById('address1').value;
      var address2 = document.getElementById('address2').value;
      var city = document.getElementById('city').value;
      var state = document.getElementById('state').value;
      var zip = document.getElementById('zip').value;
      var paymentData = {
        ssl_txn_auth_token: token,
        ssl_card_number: card,
        ssl_exp_date: exp,
        ssl_get_token: gettoken,
        ssl_add_token: addtoken,
        ssl_invoice_number: invoice,
        ssl_first_name: firstname,
        ssl_last_name: lastname,
        ssl_cvv2cvc2: cvv,
        ssl_avs_address: address1,
        ssl_address2: address2,
        ssl_city: city,
        ssl_state: state,
        ssl_avs_zip: zip
      };
      var callback = {
        onError: function (error) {
          showResult("error", error);
        },
        onDeclined: function (response) {
          console.log("Result Message=" + response['ssl_result_message']);
          showResult("declined", JSON.stringify(response));
        },
        onApproval: function (response) {
          console.log("Approval Code=" + response['ssl_approval_code']);
          showResult("approval", JSON.stringify(response));
        }
      };
      ConvergeEmbeddedPayment.pay(paymentData, callback);
      return false;
    }

    function showResult(status, msg) {
      document.getElementById('txn_status').innerHTML = "<b>" + status + "</b>";
      document.getElementById('txn_response').innerHTML = msg;
    }
  </script>
</head>

<body>
  <br>
  First Name: <input type="text" id="name" name="ssl_first_name" size="25"> <br>
  Last Name: <input type="text" id="lastname" name="ssl_last_name" size="25"> <br>
  Address 1: <input type="text" id="address1" name="ssl_avs_address" size="30"> <br>
  Address 2: <input type="text" id="address2" name="ssl_address2" size="30"> <br>
  City: <input type="text" id="city" name="ssl_city" size="30" value="Atlanta"> <br>
  State: <input type="text" id="state" name="ssl_state" size="2" value="GA"> <br>
  Zip: <input type="text" id="zip" name="ssl_avs_zip" size="25" value="30003"> <br><br>
  Transaction Amount: <input type="text" id="ssl_amount" name="ssl_amount" value="25.00"> <br> 
  <button onclick="return initiateCheckoutJS();">Click to Confirm Order</button> <br> 
  <br>
  <br>
  <br>
  Session Token: <input id="token" type="text" name="token"> <br>
  Card Number: <input id="card" type="text" name="card" value="4124939999999990" /> <br>
  Expiry Date: <input id="exp" type="text" name="exp" value="1230"> <br>
  CVV2: <input id="cvv" type="text" name="cvv" value="123"> <br>
  <input id="gettoken" type="hidden" name="gettoken" value="y">
  <input id="addtoken" type="hidden" name="addtoken" value="y">
  <input id="invoice" type="hidden" name="invoice" value="INV123">
  <button onclick="return pay();">Process Payment</button>
  <br>
  <br>
  <br>
  Transaction Status:<div id="txn_status"></div>
  <br>
  Transaction Response:<div id="txn_response"></div>
</body>
</html>

```

### PHP client-side code (SecureCredentials.php)

```php
<?php 

 // Set variables 

$merchantID = "xxxxxx"; //Converge 6 or 7-Digit Account ID *Not the 10-Digit Elavon Merchant ID* 
$merchantUserID = "convergeapi"; //Converge User ID *MUST FLAG AS HOSTED API USER IN CONVERGE UI* 
$merchantPIN = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; //Converge PIN (64 CHAR A/N) 
$vendorID = "xxxxxx"; //Vendor ID 

 $url = "https://api.demo.convergepay.com/hosted-payments/transaction_token"; // URL to Converge demo session token server 
//$url = "https://api.convergepay.com/hosted-payments/transaction_token"; // URL to Converge production session token server 

// Read the following querystring variables 

$firstname=$_POST['ssl_first_name']; //Post first name 
$lastname=$_POST['ssl_last_name']; //Post last name 
$amount= $_POST['ssl_amount']; //Post Tran Amount 


$ch = curl_init();// initialize curl handle 
curl_setopt($ch, CURLOPT_URL,$url); // set url to post to 
curl_setopt($ch,CURLOPT_POST, true); // set POST method 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 

// Set up the post fields. If you want to add custom fields, you will add them in Converge and add the field name in the curlopt_postfields string. 
curl_setopt($ch,CURLOPT_POSTFIELDS, 
"ssl_merchant_id=$merchantID". 
"&ssl_user_id=$merchantUserID". 
"&ssl_pin=$merchantPIN". 
"&ssl_transaction_type=ccsale". 
"&ssl_first_name=$firstname". 
"&ssl_last_name=$lastname". 
"&ssl_get_token=Y". 
"&ssl_add_token=Y". 
"&ssl_amount=$amount" 
); 

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); 
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); 
curl_setopt($ch, CURLOPT_VERBOSE, true); 
// curl_setopt($ch, CURLOPT_PROXY, "http://your.proxy.server:port"); // proxy server config 

$result = curl_exec($ch); // run the curl process 
curl_close($ch); // Close cURL 

echo $result; //shows the session token. 

 ?> 
```
### Callback transaction response sample

A JSON-formatted response will be provided to callback functions. You can use information from the response to populate messages to the shopper and update backend records.  

```html
var callback = { 
onError: function (error) { 
    // An Error happened during transaction processing. 
    // Checkout JS will expire session tokens after 5 declines and return an error. The user should write the onError function in their callback object to initiate a new session token to avoid failed transactions. 
}, 
onDeclined: function (responseFields) { 
    // The Transaction declined, responseFields contains fields returned by Converge. 
}, 
onApproval: function (responseFields) { 
    // Transaction approved, responseFields contains fields returned by Converge. 
}, 
onCancelled: function () { 
    // For Digital Wallets only. Customer cancelled transaction. 
}, 
onDCCDecision: function (responseFields) { 
    // DCC eligible, responseFields contains DCC related fields, 
    // merchant should show DCC option, call ConvergeEmbeddedPayment.dccDecision based on customer selection 

};
```

Take a payment