Hey jumpfroggy,
I agree. A generic example would help a lot. And since we don't have any generic examples in either the DPM guide or the sample code, I asked our developers to help us out a bit. So here you go:
In a Direct Post Method implementation at a minimum you need to implement two pages.
The first page is a simple form that posts directly to Authorize.Net (https://test.authorize.net/gateway/transact.dll for the test environment). This form contains fields for your customer to input their credit card information as well as some hidden fields that provide instructions to Authorize.Net.
The required hidden fields are listed below. You can learn more about each one in the SIM Guide.
- x_amount (Amount to be charged)
- x_fp_sequence (Any sequential number such as an invoice number)
- x_fp_hash (The fingerprint..see below)
- x_fp_timestamp (Unix Timestamp)
- x_relay_url (Your Relay Response URL)
- x_login (Your API Login ID)
- x_relay_response = true x_show_form = false x_version = 3.1 x_delim_char = ","x_delim_data = "TRUE"
You will need to use a server side scripting language to create the value for x_fp_hash. Besides that, the form can be created using standard HTML.
A very basic generic HTML Form for the DPM Method:
<form method="post" action="https://test.authorize.net/gateway/transact.dll">
<input type="hidden" name="x_amount" value="4.99" />
<input type="hidden" name="x_fp_sequence" value="123" />
<input type="hidden" name="x_fp_timestamp" value="1288912808" />
<input type="hidden" name="x_login" value="your login" />
<input type="hidden" name="x_fp_hash" value="ced28698424a7089818e8f5239cc8976" />
<input type="hidden" name="x_version" value="3.1" />
<input type="hidden" name="x_delim_char" value="," />
<input type="hidden" name="x_delim_data" value="TRUE" />
<input type="hidden" name="x_relay_response" value="TRUE" />
<input type="hidden" name="x_relay_url" value="https://yourdomain.com/relay_url" />
<input type="hidden" name="x_show_form" value="FALSE" />
Credit Card Number: <input type="text" class="text" size="15" name="x_card_num" /><br />
Expiration Date: <input type="text" class="text" size="4" name="x_exp_date" /><br />
<input type="submit" value="Complete Purchase." /> </form>
The second required page for DPM is a page to receive and handle the relay response from Authorize.Net (this page should be accessible at the relay_url you specified in your checkout form).
In a very, very basic implementation, you could simply record the transaction results that Authorize.Net will send to you and return a custom HTML receipt page that Authorize.Net will show to your user.
A more popular method is to execute some business logic (or save the results to execute shortly) and send a code snippet back to Authorize.Net which redirects the user to your site where you can then show your own receipt page to your customer.
Code snippet to send back to Authorize.Net during the relay response step which will redirect the user back to the merchant's site:
<!doctype html>
<html>
<head>
<script language="javascript">
<!--
window.location="http://yourdomain.com/receipt_url";
//-->
</script>
</head>
<body>
<noscript><meta http-equiv="refresh" content="1;url=http://yourdomain.com/receipt_url"></noscript>
</body>
</html>
Whether you execute your business logic before sending a response to Authorize.Net or you wait until the user is back on your site, you'll want to validate that the transaction results you received came from Authorize.Net. To validate this, you'll need to generate an MD5 hash like this psuedocode:
md5(md5_setting + api_login_id + transaction_id + amount)
and compare that to the hash you received from Authorize.Net. If they match, the transaction message came from Authorize.Net and you can execute any business logic.
Hope that helps,
Michelle
Developer Community Manager
