payment processing - pylons/python

Question

I'm building an application that eventually needs to process cc #s. I'd like to handle it completely in my app, and then hand off the information securely to my payment gateway. Ideally the user would have no interaction with the payment gateway directly.

Any thoughts? Is there an easier way?

Answer 1

That's something usual to do. Please follow the instructions your payment gateway gives you on how to send info to them, and write the code. If you have some issue, feel free to ask a more specific question.

Answer 2

Most payment gateways offer a few mechanisms for submitting CC payments:

1) A simple HTTPS POST where your application collects the customer's payment details (card number, expiry date, amount, optional CVV) and then submits this to the gateway. The payment parameters are sent through in the POST variables, and the gateway returns a HTTP response.

2) Via an API (often XML over HTTPS). In this case your application collects the customer's payment details, constructs an XML document encapsulating the payment details, and then posts this information to the gateway. The gateway response will be an XML document which your application then has to parse and interpret.

3) Some form of redirect to web pages hosted by the payment gateway. The payment gateway collects the customer's CC number and other details, processes the payment, and then redirects the customer back to a web page hosted by you.

Option 3 is usually the easiest solution but would require the customer to interact with pages hosted by the gateway (although this can usually be made to be almost transparent). 1 and 2 above would satisfy your requirements with 1 being the simplest of the two to implement.

Because your preference is to have your application collect the payment details, you may need to consider whether you need to acquire PCI DSS compliance, but there are many factors that affect this. There is a lot of information about PCI DSS here and on Wikipedia.

Answer 3

You will probably find that it's easier to just let the payment gateway handle it. It's best to leave PCI compliance to the experts.