Electronic Payments
EPI
← All guides

Online payments

How do I take card payments on my website or app?

For
A website, web app or mobile app taking cards with no reader.
Key
The merchant's key (m360_live_…), or a platform key with M360-On-Behalf-Of.
Card numbers never touch your server: the customer types them into fields or a page Merchant360 hosts, and you charge the token it gives you.
The steps
  1. 1. Pick how the customer enters the card
  2. 2. Charge the token
  3. 3. Save the card for later(optional)
  4. 4. Void, refund, webhooks
  5. 5. Show the error code
1

Pick how the customer enters the card

RequiredDesign
  • Hosted fields: card fields inside your own page; you get a token.
  • Checkout Session: send the customer to a hosted payment page.
  • Payment link: a link you text or email.
In the API referenceHosted fields →Checkout Sessions →Payment links →
2

Charge the token

RequiredEvery sale (hosted fields)

POST /payments with the amount and the card_token. The answer is final at once: succeeded, or 402 payment_declined.

In the API referencePayments →
3

Save the card for later

OptionalWhen the customer agrees

A saved card always belongs to a customer: send save_card with customer_id or customer, then charge the card_token later.

In the API referenceCards & tokenization →
4

Void, refund, webhooks

RequiredWhen needed

/payments/{id}/void the same day, /refund later. Webhooks (payment.succeeded, checkout.session.completed, payment_link.paid) tell you about hosted-page payments.

In the API referenceRefunds & voids →Webhooks →
5

Show the error code

RequiredAny refused call

Every error is { "error": { "message", "code" } }. Most refusals name a setting, not an outage: show the code to your user instead of “contact support”.

  • 403 no_grant: the merchant is not connected to you.
  • 403 insufficient_scope: your key is not granted that kind of call.
  • 403 billing_tools_off: the merchant’s Billing Tools are off.
  • 403 not_permitted_by_channel: reports or refunds are off for partners on that merchant.
  • 409 terminal_unavailable: no card readers on the account.
  • 422 moto_not_enabled / 422 preauth_not_enabled: keyed sales / pre-auth are off for the merchant.
  • 429 rate_limited: too many requests in the minute.
  • 500: ours. Send us the time and your reference.
In the API referenceErrors →