Testing and Environments

Environments

Only the Sandbox URL is published. QA and production base URLs are issued to your team directly.

Authentication

Every tokenization endpoint requires both OAuth tokens:

One is not enough. A request with only one will be rejected. See Security Notes.

Your callback endpoint

Administrative messages are pushed to you, so you need an endpoint that:

• accepts XML-RPC POST
• verifies the checksum, an HMAC-SHA256 of the method name concatenated with all argument values, keyed with your terminal password
• responds with resultCode
• responds quickly, and does its real work asynchronously

❗️

Verify the checksum on every message. It is the only thing proving a message came from us. An endpoint that acts on unverified administrative messages will act on anything that reaches it.

Give us the callback URL for each environment separately. They are configured per terminal, not globally.

Build order

You do not have to wait for everything to be ready. Recommended sequence:

Build now

1. Your administrative message endpoint, with checksum verification.
2. Handlers for all eight digitization.* messages, even as stubs that log and return resultCode: 1.
3. Your token store, populated from the callbacks.
4. Your card status to token status mapping. See Token Lifecycle Management.
5. The cardholder notification on digitization.complete.

Build next

6. /token/stop, /token/unstop, /token/delete, /token/activate from your operations tooling.
7. ListActiveTokens and ListAllTokens in your support views.
8. The digitization.activationmethods responder, returning masked contact details.
9. Your OTP delivery path for digitization.activation.

Build when the dependencies land

10. Push provisioning in your mobile app, once the SDK and key material are issued.

Steps 1 to 5 are the ones that must exist before anything can be tested end to end, and none of them is blocked.

Current status

We will tell you when each item changes rather than waiting to be asked. If anything on this page is out of date when you read it, that is our error and worth raising.

Certification

Apple and Google each run their own launch process on top of the technical integration, with their own review gates and criteria. Those sit with UnDosTres as Token Issuer of record, not with you, but they do constrain the launch date. Your programme contact will share the timeline.

Getting help

Raise integration questions through your usual UnDosTres channel. When reporting a problem it saves a round trip if you include:

• the environment
• the card_id
• the token_reference if you have one
• the transactionID and transactionDate from the administrative message
• what you expected and what happened

Related

• Use Cases and Runbook — including a failure triage table
• Tokenization Overview