Visa Pay

Sandbox Access

Basic Authentication

Access Keys
To test in the sandbox using basic authentication, sign in to the Control Center and create access keys. You will use these keys to call the Visa Pay API. Follow these steps:

1. In the Control Center, set up Access Keys in the Users & permissions drop-down menu.

2. Click Create Key in the top-right corner to make a new key.

You will get this information. Copy it and store it in a safe place:

• Server Key
• Server Secret

After you create and safely store your Server Key and Server Secret, use them to request an Access Token. You will need this token to call the Visa Pay API.

Basic Access Token

This API generates the Bearer Token that you will use in all API requests to PISMO.

1. To create a new account, server_key and server_secret are required.

2. Pass these 2 parameters in the request body for the API.

3. In the API response, the field token returned indicates the Bearer Token for Authorization.

Request Sample:

Response Sample:

The access token has a set lifetime (usually 10 minutes). There is an exp field in the JWT that shows when it expires in Unix Epoch time. After the access token expires, the Pismo platform will reject more requests. If you make a request using an expired token, the request returns Unauthorized. Your code should check for this message and request a new access token when it appears.

You must include the Bearer Token in the Header along with the request body before making calls to the Visa Pay API.

Set-up for Production

Pismo gives each Visa Pay client their own tenant to help with issuer processing. Each Pismo tenant connects to Visa to process transactions and get settlement reports (if needed) for the Visa Pay client. Pismo manages wallet enrollment, credential lifecycle management, and can serve as a Token Requestor for Visa Pay.

A Pismo tenant will be set up within one of Pismo's multi-tenant instances, based on data location requirements.

You need these additional steps for Production:

• mTLS configurations
• Register authorization webhook URLs with Pismo
  Visa Pay clients must verify the transaction authorization payload before processing, as explained in Verifying webhook requests.
• Configure OpenID credentials for Visa Pay access
• Configure event streaming destinations
  Pismo streams only required events to Visa Pay clients by using a default event filter. Clients must use Pismo events to handle error scenarios related to transaction authorization from the wallet, such as timeouts.
• Set up secure file access for getting settlement reports (optional)
  Clients who are not integrated with cloud infrastructure may choose to have an SFTP set up for getting reports – please talk with your Visa representative to request.