Hi. I'm trying to add a payment form on our site (let's pretend it's an HTML site to keep it simple) and I read that using the accept.js script provided with Authorize.net should keep us PCI compliant, even though we ask for payment information on our website.
I went to this page https://developer.authorize.net/api/reference/features/acceptjs.html and am using the scripts provided, but I have questions. It seems to be working as it should but it's not doing much else.
I know they offer three options:
Option 1: Host your own payment form for a PCI-DSS SAQ A-EP solution that gives you complete control of the customer payment experience.
A good idea, but I think we're going to have to endure a lot of legal stuff if we go this route.
Option 2: Embed our hosted, mobile-optimized payment information form in your page to collect the card information in a PCI-DSS SAQ A compliant way.
Ideal, if I can control the way it looks.
Option 3: For a fully hosted payment solution that you can redirect your customers to or embed as an iFrame within your page, see our documentation for Accept Hosted.
Tried this, and the code provided doesn't do anyhting. Did they miss something?
Therefore, I chose Option 2, but I'm having some issues.
First, is there a way I can make this so it's not a popup form? I would rather have this already on my page when I open it, since I'm going to be using this as a donation script.
Second, where's the amount?? There's no amount field with this form for me to either supply an amount or ask the user to add an amount. Am I supposed to set something in my Authorize.net account?
Third, upon submit, nothing happens. The page refreshes. I think I'm missing something but there isn't anything else documented in the instructions. I took it off test mode and I get the same result.
Fourth, is it safe that we have out API login ID and client Key visible in the code when we take this approach? That seems like something we want to keep secret.
Thanks!
bparker
