Product Suggestions
With an Ajax style checkout, we can collect card details on the webpage but NEVER send them to our server, instead send them directly from the single page checkout to sagepay using javascript and secure API calls from the browser. That means that we don't need to bounce to sagepay and back like we used to, but customers (and we) still get to avoid the worst of the credit card certification standards because we and the customer never actually receive or store credit card details.
https://www.sagepay.co.uk/support/12/36/sage-pay-direct
This item is also clearly related to the previous idea I posted about using SagePay tokens. We can use direct method to send payment details to sagepay, with a token=1 property, get the token back, and (if not guest checkout) store the token against the customer (note there could be more than one) alongside the last 4 digits of the card ... then, when the customer checks out next time, we can allow them to re-use one of their existing cards and then again using the direct method, send the token to sagepay to complete the payment without bouncing to sagepay pages.
apart from a smoother, simpler checkout and a more professional looking site for our customers, it means that we don't need to go through the process of styling the sagepay checkout pages - we just use our own single-page checkout plugins that are bootstrap-ready and nicely styled automatically.
We could probably implement this ourselves, but Sagepay also have a javascript library that they now offer to make this super fast:
There are currently two ways you can integrate with PI and collect card details from your customer.
1. use their pre-built form (this is uber quick but probably doesn't let us use bootstrap and a really smooth one-page-checkout
2. use their JavaScript library to do all the hard work and create our form around this... this seems like the ideal for us - a bit more work but total control over the format and styling : http://sagepay2013stg.prod.acquia-sites.com/content/getting-started-integrate-using-your-own-form
This PI integration is new and means we can implement this more easily than we might have done with their old "DIRECT" integration.
The link will below direct you to a micro site with more info on the new PI integration:
http://integrations.sagepay.co.uk/?_ga=1.168179177.977904931.1482919964
The following link will direct you to the API documentation:
https://test.sagepay.com/documentation/
Some of the advantages we see with PI integration include:
- Quicker and easier to set up for developers
- Customers have control over their payment pages without having to see card data
- Can continue to use our iframe solution
- No fixed IP addresses are required
- Developers have a choice of what scripting language they use to send commands
- Lower PCI DSS requirements
- REST and JSON are futureproofed and widely used
