Need help getting started with Hosted iframe

Question

question

webmaster2 asked Apr 19, '24 webmaster2 published 3 days ago

Need help getting started with Hosted iframe

Hello,

I'm an experienced web developer working on a website for my client, setting up e-commerce with Clover payment processing.

My plan is to integrate the Hosted iframe into an existing shopping cart system – something I have done similarly before with Square, so I am somewhat familiar with the process.

I have followed Clover developer documentation to the point of creating a Developer Account, an app in that account, and the app is now appearing in the "Test Merchant" dashboard.

I am now stuck at the point of "Tokenize a Customer Card", specifically the OAuth part, i.e. getting the API Token.

Specifically, here: https://docs.clover.com/docs/obtaining-an-oauth-token#get-the-api-token

I am following these steps:

Log in to your sandbox Developer Dashboard.
Navigate to the Merchant Dashboard for your test merchant.
From the left navigation menu, select your test application.
Clover redirects to your application.
If you have not yet coded your application server to handle the redirect and obtain an access token, note the client_id and the code in the URL.

For step 4, there is no "code" in the URL. The URL I see is:

https://www.XXXX.com/new/test/?merchant_id=XXXX&client_id=XXXX&packageName=UNKNOWN

So, therefore I cannot do the GET request of Step 5, because I don't have "code"...

5. Send an API token GET request in the following URL format to the Clover /oauth/token server, passing the client_id, your client_secret, and code:

https://sandbox.dev.clover.com/oauth/token?client_id={appId}&client_secret={APP_SECRET}&code={AUTHORIZATION_CODE} https://sandbox.dev.clover.com/oauth/token?client_id={appId}&client_secret={APP_SECRET}&code={AUTHORIZATION_CODE}

As I understand it, the OAuth token is a prerequisite of setting up the payment form and creating a charge...

https://docs.clover.com/docs/using-the-clover-hosted-iframe#set-up-the-payment-form

Also, where can I find sample HTML and curl code that I can use? I see pieces of code in the documentation, but nothing complete enough to actually work it seems. PHP versions of the curl code would also be helpful.

Any help much appreciated.

clover developer community e-commerce api API Token ecommerce

10 |2000

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Welcome to the
Clover Developer Community

Answer 1 · 2024-04-19T02:13:12Z

webmaster2 answered Apr 19, '24

This looks helpful...

https://community.clover.com/questions/56633/oauth-20-driving-me-nuts-no-refresh-token-sent.html?childToView=57301#answer-57301

10 |2000

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 2 · 2024-04-19T17:00:28Z

parquet76 answered Apr 19, '24

For a single merchant integration, you should use a merchant token. You don't need an approved developer account or app. Login to your test developer account and then go to your test merchant and you will see a tokens section for e-commerce.

10 |2000

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 3 · 2024-04-20T02:20:18Z

webmaster2 answered Apr 20, '24

Thanks, parquet76. However, I do need a developer account, and I'm actually not sure about needing an app or not. So, from my developer account, I go to Test Merchant, and I have generated tokens for both "API Tokens" and "Ecommerce API Tokens". I give the tokens ALL permissions.

Now the question becomes, how to test in the sandbox environment, with the Test Merchant token(s), and then after that, generate an OAuth token and use that for the live environment.

For the sandbox, I have been unable to use the REST API because it's returning "401 Unauthorized" no matter what I do. See this thread: https://community.clover.com/questions/62552/testing-rest-api-in-sandbox-always-returns-401-una.html

I get the same result if I try REST API requests from my server, using curl.

Regarding this thread, "Need help getting started...", I need to get an OAuth token, and since the curl requests aren't working, I can't accomplish this.

What am I missing, or are you saying that the "Ecommerce API Token" for the Test Merchant is the OAuth token??

I have these notes, regarding Tokenizing a Customer Card...

> To use REST API endpoint, need PAKMS key.
> Generate PAKMS key by GET request to PAKMS apikey endpoint.
>> Set the "authorization: Bearer" header value as an OAuth-generated auth_token for a test merchant with specific permissions.
>>> Get an OAuth token
>>>> Request merchant authorization (TEST MERCHANT)

thanks for your help.

10 |2000

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 4 · 2024-04-20T07:41:18Z

webmaster2 answered Apr 20, '24

So I think I am starting to understand this.

I want to "Create a charge" in the sandbox, and to do that, I don't need a PAKMS key, because the Test Merchant public and private keys are already available (Ecommerce token, IFRAME). This allows me to create a charge using authorization: Bearer {access_token}, where access_token is the Test Merchant public key.

So, I see a clear path now to creating a card token, creating a charge, and testing the payment in the sandbox.

What I am still not clean on how to generate an OAuth auth_token in the live environment.

I gather a new OAuth token needs to be generated each time I create a charge, on the fly.

I'm trying to write some code now, based on the info at "Get the API token" (i.e. the auth_token) as described here: https://docs.clover.com/docs/obtaining-an-oauth-token

Any help much appreciated.

10 |2000

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 5 · 2024-04-20T09:16:53Z

webmaster2 answered Apr 20, '24 webmaster2 published 3 days ago

Please help ~

From my server's shell, when I curl to the Clover documented URL for sandbox oauth endpoint, I get a 302 error...

[I'm omitting my actual client_id, which is passed when the app is clicked from the Test Merchant. So, imagine the actual client_id is in place of 13DIGITCODEXX.]

%curl -v -XPOST -H 'client_id: 13DIGITCODEXX' -H "Content-type: application/json" 'https://sandbox.dev.clover.com/oauth/v2/authorize'

Returns:

* About to connect() to sandbox.dev.clover.com port 443 (#0)
* Trying 34.117.169.22...
* Connected to sandbox.dev.clover.com (34.117.169.22) port 443 (#0)
• • •
> POST /oauth/v2/authorize HTTP/1.1
> User-Agent: curl/7.29.0
> Host: sandbox.dev.clover.com
> Accept: */*
> client_id: 13DIGITCODEXX
> Content-type: application/json
>
< HTTP/1.1 302 Moved Temporarily
< date: Sat, 20 Apr 2024 08:55:05 GMT
< Content-Type: text/html
< Content-Length: 154
< location: https://sandbox.dev.clover.com/not-found
• • •
<html>
<head><title>302 Found</title></head>
<body bgcolor="white">
<center><h1>302 Found</h1></center>
<hr><center>nginx</center>
</body>
</html>

When I curl to the Clover documented URL for production oauth endpoint, I get a 302 error...

%curl -v -XPOST -H 'client_id: 13DIGITCODEXX' -H "Content-type: application/json" 'https://www.clover.com/oauth/v2/authorize'

Returns:

* About to connect() to www.clover.com port 443 (#0)
* Trying 166.73.4.193...
* Connected to www.clover.com (166.73.4.193) port 443 (#0)
• • •
> POST /oauth/v2/authorize HTTP/1.1
> User-Agent: curl/7.29.0
> Host: www.clover.com
> Accept: */*
> client_id: 13DIGITCODEXX
> Content-type: application/json
>
< HTTP/1.1 301 Moved Permanently
< Content-Length: 0
< location: /oauth/v2/authorize?

10 |2000

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 6 · 2024-04-20T14:39:31Z

parquet76 answered Apr 20, '24 parquet76 edited Apr 20, '24

I meant you do not need an approved developer account in prod or an app. Yes, of course you need a developer account in sandbox when you are testing. You have the tokens mixed up. You don't need an oauth token, the private key is your API token. And no, you don't generate one per request. It is a secret token that your merchant will securely provide to you. If it becomes compromised you must have the merchant create a new one. Keep it secure. You will use that to make the charge API call (serves same function as an oauth token, but prevents you from having to have a custom clover app, getting it approved, etc.). The public key is the PAKMS, which is used for tokenization (iframe configuration).

10 |2000

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 7 · 2024-04-20T20:38:01Z

webmaster2 answered Apr 20, '24

OK, great. I will try that out. Thanks for your help.

From what I could gather from the API documentation, this was not covered. That's why I was trying to acquire an OAuth token.

10 |2000

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

question