API Fundamentals | Visa Click to Pay API | Visa Developer Center
Visa Click to Pay
Merchants and Payment Service Providers
Start a Project
API Overview
API Reference
API Fundamentals
Endpoints
| Environment | URL |
|---|---|
| Sandbox | https://sandbox.api.visa.com/src/v1 |
| Certification | https://cert.api.visa.com/src/v1 |
| Production | https://api.visa.com/src/v1 |
Initialize SRC uses a separate, browser-loaded URL and is not part of the REST base path. The Initialize SRC URL is a Visa-hosted page loaded in a hidden iframe directly from the merchant's checkout page.
See Initialize SRC for the endpoint URL and integration details.
API Authentication Methods
The Click to Pay API requires two authentication mechanisms only:
| Protocols | Details |
|---|---|
| Token Authentication (x-pay-token) | Session-based authentication using JSON Web Tokens that identify specific transactions and their contents. See API Key – Shared Secret (X-Pay Token) in the Visa Developer Center for authentication setup instructions. |
| API Key Authentication (apikey) | Client-specific authentication using persistent API keys issued during onboarding. Keys identify the connecting client system and remain valid throughout the integration lifecycle. |
Browser-Based SRC System Initialization
In addition to the REST API endpoints, the Click to Pay integration includes one browser-based operation: Initialize SRC.
Initialize SRC is architecturally different from all other Click to Pay APIs:
| REST APIs | Initialise SRC | |
|---|---|---|
| How it's called | Your server or frontend calls a REST endpoint | Your frontend loads a Visa-hosted URL in a hidden iframe |
| Authentication | x-pay-token + API key | Parameters passed on the URL |
| Response | HTTP JSON response | Asynchronous browser postMessage |
| Where it runs | Server or browser | Browser only |
Initialize SRC must be implemented on the client (browser) side of your checkout page. It
does not use the src/v1 REST base URL and does not require x-pay-token
or API key authentication.
See Initialize SRC for the complete integration steps.