PostAuth handling in a client-side payment gateway adapter
Key Takeaway
Your payment gateway adapter's PostAuth handler validates and records a payment that the provider's own component handled outside Salesforce.
In client-side payment processing, the payment provider's own UI component authorizes and tokenizes the shopper's payment outside Salesforce. Salesforce still needs to check that result, so the storefront sends the provider's payment token to the Checkout Payment API as a PostAuth request. Your Apex payment gateway adapter then validates the transaction with the gateway and records it.
Parts of a client-side integration
A client-side integration has two halves. A checkout UI component talks directly to the payment provider. A payment gateway adapter in Apex independently validates each transaction. Sensitive card data stays in a cross-domain component owned by the provider, so much of the PCI burden falls on the provider instead of on you.
The integration needs these parts:
- A
PaymentGatewayAdapter, which a server-side integration needs too. The difference is that a client-side adapter must implement aPostAuthrequest handler. The Apex class can implement either a synchronous or an asynchronous adapter. - A custom Checkout UI component, which may wrap or adapt a payment provider component.
- A server-side call that fetches the keys or configuration the component needs to load. You use a standard Salesforce Apex controller to bootstrap it.
The payment provider's client typically handles authorization and tokenization. In that case, a client-side implementation requires these Commerce Payment Connect APIs:
CaptureReferencedRefundAuthorizationReversalPostAuth