0👍
Both expire after 400sec and must be send together within Payment Registration POST authenticated with your vendor/account IntegrationKey and IntegrationPassword from your server which IP is whitelisted by Sage Pay. MSK is required to authenticate card tokenization call from customer’s browser to Sage Pay endpoint. As a result you receive cardIdentifier/Token. This method keeps your server free of cardholder details but all (MSK,Token, PAN and CV2) are allowed to exist in customer browser.
IntegrationKey and IntegrationPassword can’t be stored in the customer browser.
If you decide to use your own payment pages instead of drop-in checkout, you can’t reference files from 3rd-party non-PCI DSS server to archive PCI DSS SAQ A-EP attestation.
I’ve reviewed it with QSA
- [Vuejs]-How to import lodash single function and use on Vue.js template?
- [Vuejs]-Extra margin in PWA – can't stretch full height