Secure Card Payment Processing: A Developers Guide

PCI Compliance and Card Security

Processing card payments requires strict adherence to security standards. DGS-Pay handles the heavy lifting by encrypting card data at the source.

How DGS-Pay Protects Card Data

AES-256-GCM Encryption

All sensitive card data is encrypted using military-grade AES-256-GCM encryption before it leaves the customer browser. Your server never sees raw card numbers.

Tokenization

Cards are tokenized after the first transaction, allowing you to charge returning customers without storing card details.

Implementation Steps

1. Get Your Encryption Key

Retrieve your encryption key from the merchant dashboard under Settings → API Settings.

2. Encrypt Card Data Client-Side

const encrypted = await encryptCard("4532123456789010", "12", "2028", "123");
// Use encrypted fields in your API request

3. Handle Authorization

Some transactions require additional verification:

• PIN: Encrypted PIN entry
• OTP: One-time password via SMS
• AVS: Address verification

Testing Card Payments

Use these scenario keys for testing:

"scenario_key": "scenario:auth_pin&issuer:approved" // Success
"scenario_key": "scenario:auth_pin&issuer:insufficient_funds" // Decline

Security Checklist

• Never log or store card numbers
• Use HTTPS for all API calls
• Verify webhook signatures
• Implement idempotency keys