Payment Gateway Authentication

Question

I am trying to setup B2B Commerce Payments to use a Cyber Source Payment Gateway that I have already implemented but am having issues with the authentication.

The Cyber Source API that my Payment Gateway uses handles authentication in a non trivial way. It requires me to set a Signature header which is a hashed checksum (actually called a Message Authentication Code, or MAC) using a combination of the payload, timestamp, domain, merchant Id, and API key.

I have this part ^ working when I call it outside of the context of B2B Payments. What I mean by this is that I can construct a payload, set the headers, and fire off a HttpResponse response = http.send(request); request and it works. But all the authentication is handled in Apex due to it's complexity. It does not use any of the authentication mechanisms built into a Named Credential.

I built the Payment Gateway using forcedotcom/Core-Payments-Reference-Gateway-Integration-Adapters as a guide. But it wasn't until I got around to trying to use it with B2B Commerce Payments that I noticed it doesn't send the request using System.Http, instead it uses commercepayments.PaymentsHttp which seems to have some side effects.

• For example, since a Payment Gateway Adapter is linked to a Named Credential, the way you specify the request endpoint is slightly different. When setting the endpoint to be used with a commercepayments.PaymentsHttp you do not specify the base domain (not with a callout:CyberSource and not by hard coding it). Instead you only need to specify the relative path to be used after the domain listed on the linked Named Credential. (this took me a long time to figure out and this was the only thing I could find online about this)

I suspect something similar is going on with the authentication. I have traced the request up until it is sent using commercepayments.PaymentsHttp.send(request) & System.Http.send(request). It fails on the former with a 401 unauthorized and succeeds on the latter. I thought about just changing it to use the System.Http method but this seemed like a bad idea. I figured they added this for a reason so it should probably be used. (I did try it for shoots and giggles and got an error about callouts not allowed but never went down that rabbit hole since it seemed like a bad idea)

So I guess my question is, does a Payment Gateway require me to use an API that can be authenticated with using the Named Credential? Or does anyone have any additional information/documentation on CommercePayments.PaymentsHttp? I feel like I'm missing something around the relationship between a Payment Gateway and Named Credential when it comes to authentication.

See my comments at the bottom here.

String nowFormated = Datetime.now().formatGMT('E, dd MMM yyyy HH:mm:ss z');
String payload = '{"key1":"value1", "key2":"value2"}';

HttpRequest req = new HttpRequest();
req.setEndpoint('/pts/v2/payments/');
req.setMethod('POST');
req.setHeader('Content-Type', 'application/json');
req.setHeader('v-c-merchant-id','<cyberSourceMerchantID>');
req.setHeader('Date', nowFormated);
req.setHeader('Host', 'api.cybersource.com');
req.setBody(payload);

String token = CyberSourceHelpers.generateSignatureHeader(
  'POST',
  'api.cybersource.com',
  '/pts/v2/payments/',
  nowFormated,
  '<cyberSourceApiKey>',
  '<cyberSourceApiKeyID>',
  '<cyberSourceMerchantID>',
  payload
);
String digest = 'SHA-256=' + CyberSourceHelpers.generateDigest(payload);
req.setHeader('Digest', digest);
req.setHeader('Signature', token);

// This works
Http http = new Http();
HttpResponse res = http.send(req);

// This returns a 401 unauthorized
commercepayments.PaymentsHttp http = new commercepayments.PaymentsHttp();
HttpResponse res = http.send(req);

Answer 1

Evidently this is a known issue when using CyberSource as the Payment Gateway for the B2B LE Checkout Flow. There is a documented workaround that I found in the B2B Commerce on Lightning Experience group in the Partner Community. See Other Resources > Cybersource Microform. Which just links to a public Quip page: 'Cybersource Custom Credit Card Form'.

FYI the Partner Community group I linked above is private so you would need a login there but the actual Quip docs are public.