Namith Hosmane's Blog

Did you know how payment works in D365 Commerce for an online channel or eCommerce website? Check out this blog for more understanding.

Before we deep dive, here are some of key terminologies in general to understand about different components & parties involved in the payment flow.

Key Terminologies:

0. Merchant account: The merchant accounts are type of business bank accounts which allows to accept the payments from the customer. The merchant account is a holding account where funds are first landed. The funds are then transferred to actual merchants checking bank account in batches. The merchant accounts are usually provided by the payment providers and its mandatory to have the merchant account.
1. Merchant application: The merchant application is the storefront or the website through the end user shops, process payments from the cart.
2. Payment gateway: The payment gateway is an intermediary between the merchant website and financial institutions to securely transfer the customers payment information. The payment gateways provide an option to accept the payment with different payment method options like credit card, PayPal, Apple pay etc.
3. Payment processor: The payment processors are integrated with payment gateways to communicate between the customers issuing bank and merchants acquiring bank to process the payments requested from payment gateway.
4. Payment providers: The payment providers are those who include both payment gateway and processor features to support end to end transaction flow (For eg: Adyen, Braintree, PayPal)
5. iFrame or payment acceptance page: iFrame or payment acceptance page is a secure HTML front end interface provided by Payment provider to integrate with merchant application. The payment accepting page contains all the credit card fields or other payment option that are required for the industry type and the transaction type.

How it works?

1. The customer shopping on eCom website adds item to the cart and ready to make the payment
2. The D365 Commerce application calls the CRT GetPaymentAccessPoint API with merchant credentials to retrieve the unique payment acceptance URL from Payment provider
3. After the successful retrieval of payment acceptance URL, the payment section will be loaded successfully for the customer to make the payment.
4. The customer enters the payment details (Credit card number, exp date, cvv) and submits the payment.
5. The payment post message from D365 commerce front end application is sent to payment provider. The payment provider generates the result access code and send it back to D365 Commerce application through cross domain messaging.
6. D365 Commerce front end application calls CRT RetrievePaymentAcceptResults API by providing result access code which intern calls payment provider to validate and send the payment results with real card token
7. The customer clicks on checkout or place order, the D365 commerce front end application calls CRT Checkout API with details of order and amount to be authorized from customer bank along with the card token.
8. The payment provider detokenizes the card token required for the bank to process authorization and sends the Authorization code in the response.
9. Once the authorization code received the order will be placed successfully.

Additional notes:

1. The customer payment information (PAN) are sensitive data which should not be sent to merchant application due to PCI compliance. Therefore, the separate payment accepting application is used to take the credit card number and process the payment. The payment provider only sends card tokens (payment results) to D365 commerce application to complete the order.
2. The cross-domain messaging is used to communicate between the (D365 Payment host page Commerce front end) and Payment acceptance page (Payment provider HTML page).
3. The payment capture in OOB Dynamics commerce happens during the invoicing process.

References:

Create an end-to-end payment integration for a payment terminal – Commerce | Dynamics 365 | Microsoft Docs

Regards,

Namith Hosmane

Disclaimer

This is a personal blog. Any views or opinions represented in this blog are personal and belong solely to the blog owner and do not represent those of people, institutions or organizations that the owner may or may not be associated with in professional or personal capacity, unless explicitly stated. All content provided on this blog is for informational purposes only. This blog makes no representations as to the accuracy or completeness of any information on this site.