Card Collection

The Card Collection API enables you to accept payments from customers via debit and credit cards globally. By using our hosted checkout, you benefit from a secure, PCI-compliant environment without the need for complex certifications.

What This Page Covers

This overview explains the card collection flow at a high level. Detailed implementation material has been split into dedicated pages:

• Integration guide
• API reference
• Testing

Quick Facts

• Supported currencies: NGN, USD
• Base URL: https://api.transfaar.com/api/v1
• Authentication: HMAC (API Key + Signature)
• PCI model: hosted checkout, so raw card data does not pass through your servers

Card Collection Flow

The standard flow is:

1. Initialize a hosted checkout session from your backend.
2. Redirect the customer to the returned checkout_link.
3. Wait for transaction updates through webhooks.
4. Verify manually when needed for reconciliation or support.

Card Collection Overview

Card collection uses hosted checkout so you can accept debit and credit card payments without handling sensitive card data directly.

Why Use It

Use this flow when:

1. you want Transfaar to host the payment UI
2. you want PCI-sensitive card handling kept outside your own application
3. you need a straightforward initialize -> checkout -> webhook confirmation flow

Core Flow

1. Create a checkout session on your backend.
2. Receive a checkout_link.
3. Redirect the customer to the hosted checkout page.
4. Confirm the final status through webhooks or manual verification.

Read This Section In Order

1. Card collection integration guide
2. Card collection API reference
3. Card collection testing

Related Pages

• Collections overview
• Transaction webhook
• HMAC authentication

const { data } = await response.json();

// 2. Redirect customer to checkout if (data.checkout_link) { window.location.href = data.checkout_link; }

---
## Best Practices
1.  **Always use Webhooks:** Network issues can prevent a customer from reaching your `redirectUrl`. Webhooks ensure you never miss a payment.2.  **Verify Amounts:** Before providing service, always verify that the `amount` in the webhook/verify response matches your expected order total.3.  **Idempotency:** Use unique `reference` values for every initialization attempt to prevent duplicate charges for the same order.4.  **Secure Your Keys:** Never perform API calls or HMAC signing on the frontend. These should always happen on your secure backend.