# Visa Click to Pay

## Merchants and Payment Service Providers

\
[Start a Project](https://developer.visa.com/portal/#users/new)  \
[API Overview](https://developer.visa.com/capabilities/visa-secure-remote-commerce)  \
[API Reference](https://developer.visa.com/capabilities/visa-secure-remote-commerce/reference)

## API Fundamentals

### Endpoints

| Environment      | URL                                    |
| ---------------- | -------------------------------------- |
| **Sandbox**      | [https://sandbox.api.visa.com/src/v1](https://sandbox.api.visa.com/src/v1) |
| **Certification** | [https://cert.api.visa.com/src/v1](https://cert.api.visa.com/src/v1)     |
| **Production**   | [https://api.visa.com/src/v1](https://api.visa.com/src/v1)                 |

Initialize SRC uses a separate, browser-loaded URL and is not part of the REST base path.
The Initialize SRC URL is a Visa-hosted page loaded in a hidden iframe directly from the
merchant's checkout page.

See [Initialize SRC](https://developer.visa.com/capabilities/visa-secure-remote-commerce/introduction-to-visa-click-to-pay-api#section0) for the endpoint URL and integration details.

### API Authentication Methods

The Click to Pay API requires two authentication mechanisms only:

| **Protocols**                          | **Details**                                                                                                                                                              |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Token Authentication (x-pay-token)** | Session-based authentication using JSON Web Tokens that identify specific transactions and their contents.<br>See [API Key – Shared Secret (X-Pay Token)](https://developer.visa.com/pages/working-with-visa-apis/x-pay-token) in the Visa Developer Center for authentication setup instructions. |
| **API Key Authentication (apikey)**    | Client-specific authentication using persistent API keys [issued during onboarding](https://developer.visa.com/capabilities/visa-secure-remote-commerce/tutorials-guides).<br>Keys identify the connecting client system and remain valid throughout the integration lifecycle. |

### Browser-Based SRC System Initialization

In addition to the REST API endpoints, the Click to Pay integration includes one
browser-based operation: **Initialize SRC**.

Initialize SRC is architecturally different from all other Click to Pay APIs:

|  | REST APIs                                      | Initialise SRC                                         |
| --- | ----------------------------------------------- | ---------------------------------------------------- |
| How it's called | Your server or frontend calls a REST endpoint   | Your frontend loads a Visa-hosted URL in a hidden iframe |
| Authentication   | x-pay-token + API key                          | Parameters passed on the URL                          |
| Response         | HTTP JSON response                              | Asynchronous browser `postMessage`                     |
| Where it runs    | Server or browser                               | Browser only                                          |

Initialize SRC must be implemented on the client (browser) side of your checkout page. It
does not use the `src/v1` REST base URL and does not require x-pay-token
or API key authentication.

See [Initialize SRC](https://developer.visa.com/capabilities/visa-secure-remote-commerce/c_initialize_src.dita#c_initialize_src) for the
complete integration steps.