Cybersource

Secure Acceptance hosted checkout

Cybersource is used directly by merchants and also by many banks, particularly in Asia, that give their merchants a Cybersource account. The plugin uses Secure Acceptance Hosted Checkout: the traveller is sent to Cybersource's page and enters their card there, so card details never touch your website or Tourtify. Each payment is a sale, authorised and captured in one step, and is paid into your merchant account.

The payment page opens in the traveller's language where Cybersource has it, and in English otherwise.

Currencies

Tourtify doesn't limit Cybersource to a list of currencies. Each payment is sent in the booking's own currency, so the gateway can appear at checkout for any tour. Your merchant account decides what it actually accepts: check with your bank or acquirer which currencies are enabled before you sell in them.

Signed both ways

At checkout Tourtify builds the payment form with your profile ID and access key, the booking reference, the amount, the currency, the traveller's email and the pages to return to, and signs it with your secret key (HMAC-SHA256). The signed form carries its signing time, so Tourtify keeps it valid for 15 minutes and never hands out an old one.

Cybersource sends the result twice: to the receipt page as the traveller returns to your website, and server to server to the merchant POST URL. Each is checked with your secret key and must belong to this payment before it is kept. A later post never replaces an accepted payment, because both carry the same result.

Decisions

An ACCEPT decision confirms the booking with the amount Cybersource authorised. REVIEW means Decision Manager is holding the payment: the booking is flagged for your team, and you accept or reject the payment in the Business Center. DECLINE, ERROR and CANCEL close the payment, so the traveller can try again.

Secure Acceptance has no status query, so Tourtify relies on those two signed posts. Keep Custom receipt page and Merchant POST URL switched on in your profile. If a payment appears in the Business Center but not on the booking, check those settings first.

Refunds

Secure Acceptance has no refunds of its own. Add the optional REST keys (merchant ID, REST key ID and REST shared secret) and refunds from the booking, full or partial, are sent through Cybersource's REST API. Fill in all three or leave all three empty; when they are filled in, Tourtify checks them with Cybersource as you connect.

Without REST keys, refund the traveller in the Business Center, then choose "I refunded it in the provider's dashboard" on the booking so the traveller's balance and your reports stay correct.

Test and live

In Test mode payments go to Cybersource's test environment (testsecureacceptance.cybersource.com) and no real money moves; Live uses the production environment. Secure Acceptance has no call for checking a profile's keys, so Tourtify checks their form when you connect: the access key has 32 characters and the secret key is much longer. Your first test payment proves them.

Setting up Cybersource

1. 1Create a Hosted Checkout profile. In the test Business Center, open Payment Configuration › Secure Acceptance Settings and create a Hosted Checkout profile. Leave Custom receipt page and Merchant POST URL switched on.
2. 2Create a security key. In the profile's Security section, create a key and copy the access key and secret key. The secret key is shown only once.
3. 3Add REST keys for refunds (optional). In Payment Configuration › Key Management, generate a REST shared secret key and note its key ID, the shared secret and your merchant ID.
4. 4Connect in Test mode. On the Payments page, add Cybersource, paste the keys, choose Test and make a test booking.
5. 5Switch to Live. Repeat the profile and keys in your live Business Center, update them on the Payments page and choose Live.