Server-to-Server

PCI DSS compliance required

With the Server-to-Server integration, your systems collect and send cardholder data (PAN, CVV, expiry, cardholder name) to OneAPI. You must be fully PCI DSS compliant.

Send cardholder data directly to OneAPI via the Payment API when you meet the necessary PCI DSS compliance requirements.

Payment workflow

For the full sequence diagrams (own MPI and gateway 3DS), see Payment workflow on the Card ECOM overview.

Implementation flow

1. Make a Payment API request with card data.
2. Receive API response.
3. If the response contains a client_action, handle it accordingly:
   • postForm: Build a form on your frontend and POST the fields from action_data to the provided url. This redirects the customer to the 3DS authentication page.
   • redirect: Redirect the customer to the url in action_data.
4. After 3DS is completed, the customer is returned to your success_url or error_url.
5. Receive asynchronous postback notification to postback_url with the final transaction status.

For a general walkthrough of credentials, authentication, and postbacks, see Get Started — Server-to-Server Processing.

Payment flows

Choose the payment flow that matches whether you provide your own MPI 3DS results:

Create a payment with MPI (direct)

Pass your own MPI 3DS results directly. The gateway skips its 3DS flow and returns a direct response.

View guide

Create a payment without MPI (3DS required)

Omit MPI fields. The gateway performs 3DS and returns a pending client_action.

View guide