Google Pay ™

For payment flows supporting Google Pay

Google Pay works in web browsers and Apps on mainstream desktop and mobile devices. YabandPay supports debit and credit cards from the following card networks through Google Pay:

• Visa / VPay

• Mastercard / Maestro

• UnionPay

The settlement account must be in the European Economic Area (EEA) or the United Kingdom.

Tip

All merchants using Google Pay must comply with the following terms:

• Google Pay APIs Acceptable Use Policy

• Google Pay API Terms of Service

By integrating Google Pay through YabandPay’s hosted solution, merchants accept and agree to comply with the above terms.

1. Credential types and 3DS requirements

Google Pay supports the following two credential types:

• PAN_ONLY: Returns an encrypted wrapper of the clear-text primary account number (cardInfo.cardDetails) and card network (cardInfo.cardNetwork), without a cryptogram.

• CRYPTOGRAM_3DS: Returns token-based encrypted credentials containing a network token (DPAN) and a cryptogram, for transactions requiring a higher level of security.

3DS requirements:

When you receive PAN_ONLY credentials through the Google Pay API, you must perform 3D Secure verification (set 3ds_initiate=01). YabandPay rejects transactions without 3DS verification.

For compatibility and security, follow these integration recommendations:

• Enable both ["CRYPTOGRAM_3DS", "PAN_ONLY"] in your Google Pay frontend configuration.

• Always set 3ds_initiate=01 when submitting a payment request to YabandPay.

• YabandPay’s backend determines whether to perform 3D Secure based on the credential type.

2. App or web integration (self-hosted)

Merchants can integrate the Google API to start the payment flow in their own website or App. The process and configuration are described below:

Payment flow:

Google Pay uses credentials for a card linked to the device (DPAN, network token) instead of the actual card number (PAN). The payment flow is:

1. The customer selects the Google Pay button on the merchant’s website or App.

2. The customer authorizes using Face ID / Touch ID / a password.

3. Google returns an encrypted token.

4. The merchant submits the token to YabandPay for processing.

Note: in self-hosted mode, merchants must register their own Google Pay merchant account in Google Pay & Wallet Console and obtain a Merchant ID. This Merchant ID is linked to YabandPay’s payment channel.

API configuration example:

"tokenizationSpecification": {
  "type": "PAYMENT_GATEWAY",
  "parameters": {
    "gateway": "yabandpay",
    "gatewayMerchantId": "<Merchant ID assigned by YabandPay>"
  }
}

• Base64-encode the received token and submit it to the YabandPay payment API in payment_token_object.

• gateway: a fixed value that must be "yabandpay".

• Disabling address verification is recommended, as configured below:

billingAddressRequired: false

3. Hosted integration

YabandPay provides a hosted Google Pay solution. Merchants do not need to integrate a Google Pay button or SDK. Submit an order through the standard API and direct the customer to YabandPay’s hosted page at https://pay.yabandpay.com to complete the Google Pay payment.

In hosted mode, Google Pay runs on YabandPay’s page, so merchants do not need to configure CSP, load Google scripts, or set an SDK version.

Integration flow:

1. The merchant submits an order using YabandPay’s Hosted Payment Solution (HPP). YabandPay returns pay_url.

2. The customer is redirected to the hosted page at pay_url.

3. The customer completes Google Pay payment on that page.

4. After payment, the customer is redirected to the configured redirect_url, and an asynchronous notification is sent to notify_url.

Notes:

• Merchants do not need to load Google Pay JavaScript or construct Google Pay requests themselves.

• YabandPay handles all backend decryption and transaction verification for Google Pay.

• Merchants must enable Google Pay in the YabandPay merchant portal.

• The hosted payment page automatically displays the merchant name, order amount, and other information so the customer can identify the payment.

• All transactions are processed using YabandPay’s shared Google Merchant ID.

4. Authorization methods

YabandPay supports the following Google Pay authorization modes:

• One-time transaction authorizations (DPAN + cryptogram) are supported.

• Card-on-File (COF) is not supported.

• FIDO biometric authentication is not supported.

5. Data submission requirements

• Submit the encrypted payment_token_object to YabandPay through HTTPS POST.

• All data is encrypted in transit using TLS 1.2 or later.

• YabandPay uses PCI DSS-compliant HSMs for backend decryption.

6. Official Google integration references

General resources:

• Registration and documentation: https://developers.google.com/

• JS button example: https://jsfiddle.net/fw5t6caL/

App integration guides:

• Android integration overview: https://developers.google.com/pay/api/android/overview

• Android integration checklist: https://developers.google.com/pay/api/android/guides/test-and-deploy/integration-checklist

• Brand guidelines: https://developers.google.com/pay/api/android/guides/brand-guidelines

Web integration guides:

• Web integration overview: https://developers.google.com/pay/api/web/overview

• Web integration checklist: https://developers.google.com/pay/api/web/guides/test-and-deploy/integration-checklist

• Brand guidelines: https://developers.google.com/pay/api/web/guides/brand-guidelines

---

• Parameters

Obtaining payment_token_object:

Example token returned by Google Pay:

{
	"signature": "MEUCIC+XtiYdlmjL2/1wEn33qnya8G4POk5jYkRNY5+MkdBlAiEAwoRYQu26ZopwpcOWlwUe/E+i4FKzpunCFZf44mS0cxQ\u003d",
	"intermediateSigningKey": {
		"signedKey": "{\"keyValue\":\"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUJW8LjUtTV7esDMJLtCe8hYjlcQih8g7HP5bgO4ysma4/CwGq0CnZ5G0t0o44D92d9L3SfXS2GyK2PJMtE/NBg\\u003d\\u003d\",\"keyExpiration\":\"1724120515000\"}",
		"signatures": ["MEYCIQC1ZWgFEaSR1pNbwTW6liQL7WXZQZExx1Idj7oQzHvoPQIhAOx1b+9CamfDeZUcHXpU01xTfa6EaaH3TgKaTBnrsuuG"]
	},
	"protocolVersion": "ECv2",
	"signedMessage": "{\"encryptedMessage\":\"y+XA1ltwldTcmVSZwfVayP7b0hPNLODGyi2UgCCJcSSs0iBj73HML5eWcYBiT+T+ZP8SmV54U9E2AmuRwVeVYHai8Z/ajrxE7fM+Fv/e9IXt36WjC4SWhAHM8T/DkOlE6BcuoKAMz6iLkJJ40g0zAkUKijln5YEbhLXHRoh/5l/8wGNDxErI7JdNZ4cA9vh8go/gR2YXKxVngFH4PFHcGyKa4MKnYDATMBDdx/F+MI4vVtPLXruTPpG0HBgLlJct95LZl9T686sOWuwg4pWLLSqcbuqd+MAZZihy2FW+9cdKNXsebL91rRbq7dahtET1K90YzyWzM9CfntcjHf5YqhnssApnE+Jb7OZ+mn5hO27Z93by7G3Fgi7YxJqcW4o/4D+NIANe0BqwbFyhw5Un8rIKkXg//WD9TlFHl2oIgyOKnZLO8NrnfEffoxstvRft1enafD0DadUk2IL5+Q\\u003d\\u003d\",\"ephemeralPublicKey\":\"BFzys/8Oy4iBu0ZYlLcy5SNZUOKFQhTx/985qiMFKGssVm4Fk9hweWlemyClMbI216lbsPS4Sy15ab/75gW1v08\\u003d\",\"tag\":\"jpHUeHrZuI1y77wRisFznOadAzlP2je8RFpT9PFpmHs\\u003d\"}"
}

The payment_token_object field is the base64_encode string of the token data obtained from the Google Pay integration.

Signature example:

Sorted parameters concatenated into a URL-style query string

"3ds_initiate=01&amount=0.1&cardinfo={"card_holder":"John Smith","email":"JohnSmith@gmail.com"}&currency=EUR&description=test&method=v3.GooglePayment&notify_url=https://www.yabandpay.com/notify&operation=1&order_id=1723517503&pay_method=online&payment_token_object=eyJzaWduYXR1cmUiOiJNRVVDSUMrWHRpWWRsbWpMMi8xd0VuMzNxbnlhOEc0UE9rNWpZa1JOWTUrTWtkQmxBaUVBd29SWVF1MjZab3B3cGNPV2x3VWUvRStpNEZLenB1bkNGWmY0NG1TMGN4UVx1MDAzZCIsImludGVybWVkaWF0ZVNpZ25pbmdLZXkiOnsic2lnbmVkS2V5Ijoie1wia2V5VmFsdWVcIjpcIk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRVVKVzhMalV0VFY3ZXNETUpMdENlOGhZamxjUWloOGc3SFA1YmdPNHlzbWE0L0N3R3EwQ25aNUcwdDBvNDREOTJkOUwzU2ZYUzJHeUsyUEpNdEUvTkJnXHUwMDNkXHUwMDNkXCIsXCJrZXlFeHBpcmF0aW9uXCI6XCIxNzI0MTIwNTE1MDAwXCJ9Iiwic2lnbmF0dXJlcyI6WyJNRVlDSVFDMVpXZ0ZFYVNSMXBOYndUVzZsaVFMN1dYWlFaRXh4MUlkajdvUXpIdm9QUUloQU94MWIrOUNhbWZEZVpVY0hYcFUwMXhUZmE2RWFhSDNUZ0thVEJucnN1dUciXX0sInByb3RvY29sVmVyc2lvbiI6IkVDdjIiLCJzaWduZWRNZXNzYWdlIjoie1wiZW5jcnlwdGVkTWVzc2FnZVwiOlwieStYQTFsdHdsZFRjbVZTWndmVmF5UDdiMGhQTkxPREd5aTJVZ0NDSmNTU3MwaUJqNzNITUw1ZVdjWUJpVCtUK1pQOFNtVjU0VTlFMkFtdVJ3VmVWWUhhaThaL2FqcnhFN2ZNK0Z2L2U5SVh0MzZXakM0U1doQUhNOFQvRGtPbEU2QmN1b0tBTXo2aUxrSko0MGcwekFrVUtpamxuNVlFYmhMWEhSb2gvNWwvOHdHTkR4RXJJN0pkTlo0Y0E5dmg4Z28vZ1IyWVhLeFZuZ0ZINFBGSGNHeUthNE1LbllEQVRNQkRkeC9GK01JNHZWdFBMWHJ1VFBwRzBIQmdMbEpjdDk1TFpsOVQ2ODZzT1d1d2c0cFdMTFNxY2J1cWQrTUFaWmloeTJGVys5Y2RLTlhzZWJMOTFyUmJxN2RhaHRFVDFLOTBZenlXek05Q2ZudGNqSGY1WXFobnNzQXBuRStKYjdPWittbjVoTzI3WjkzYnk3RzNGZ2k3WXhKcWNXNG8vNEQrTklBTmUwQnF3YkZ5aHc1VW44cklLa1hnLy9XRDlUbEZIbDJvSWd5T0tuWkxPOE5ybmZFZmZveHN0dlJmdDFlbmFmRDBEYWRVazJJTDUrUVx1MDAzZFx1MDAzZFwiLFwiZXBoZW1lcmFsUHVibGljS2V5XCI6XCJCRnp5cy84T3k0aUJ1MFpZbExjeTVTTlpVT0tGUWhUeC85ODVxaU1GS0dzc1ZtNEZrOWh3ZVdsZW15Q2xNYkkyMTZsYnNQUzRTeTE1YWIvNzVnVzF2MDhcdTAwM2RcIixcInRhZ1wiOlwianBIVWVIclp1STF5Nzd3UmlzRnpuT2FkQXpsUDJqZThSRnBUOVBGcG1Ic1x1MDAzZFwifSJ9&redirect_url=https://www.yabandpay.com/redirect_url&request_id=g77ur3oqhkqd348iljrb04pbj412rka3&sub_pay_method=Google Pay&time=1723517503&timeout=0&user=YOUR_CASHIER_UID"

Sign stringA using secret_key

The resulting signature is:

"YOUR_SIGNATURE"

Request example (operation=1 Sales):

{
    "user": "YOUR_CASHIER_UID",
    "sign": "YOUR_SIGNATURE",
    "method": "v3.GooglePay",
    "time": 1721979693,
    "data": {
        "description": "test",
        "timeout": "0",
        "pay_method": "online",
        "sub_pay_method": "Google Pay",
        "order_id": 1721979693,
        "amount": "0.1",
        "currency": "EUR",
        "operation": "1",
        "redirect_url": "https://www.yabandpay.com/redirect_url",
        "notify_url": "https://www.yabandpay.com/notify",
        "3ds_initiate": "01",
        "payment_token_object": "eyJzaWduYXR1cmUiOiJNRVVDSVFDOEJmbDJrSkttUjVvOUxNc3RCYnA0MGtBRW9FQnh4SlQ4VTl2UVgyc1JMd0lnTUJTOWpidDFxR0NoVmxmeElDUTdYOHBKM3VYN1lkY0M5UFd1eEVubmo5b1x1MDAzZCIsImludGVybWVkaWF0ZVNpZ25pbmdLZXkiOnsic2lnbmVkS2V5Ijoie1wia2V5VmFsdWVcIjpcIk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRVdabXZVODU3SnlOV2ZEbFFuVzBaRG1MUEpoSG91dlpsT09aZk5ORm9nWElJVlRVTnNYNGJ0MEZFakdpVEs4QTNGb094a0d5NStrQ0ZCWDUyL0hhcS93XHUwMDNkXHUwMDNkXCIsXCJrZXlFeHBpcmF0aW9uXCI6XCIxNzIwNTg5NjI3MTk5XCJ9Iiwic2lnbmF0dXJlcyI6WyJNRVVDSVFDbWpKSmFMYzUxWEo3T3dEaUY5QVVIVloyVytGMFJSVWdnNmI5YUc0S2hiUUlnVDBKeVdjRHNlcEpyc2ZyM0xzekdtTUpUNkxZSitzRmZ5YWtmYlIweHg1c1x1MDAzZCJdfSwicHJvdG9jb2xWZXJzaW9uIjoiRUN2MiIsInNpZ25lZE1lc3NhZ2UiOiJ7XCJlbmNyeXB0ZWRNZXNzYWdlXCI6XCJBaVhPT3BJYitNdGxSWnV3MW9nL3ZLVVdvT3FmVEcwZndMcG14WCtuSkFPRXJPQkFYa3dWWG8zd01DaVpQaEppZVN3dHZBNnFaVXpWVTBOVWJaWTVSdE1qZWxUWnVHV3dKcjdRVU9Ob3NXRzFXSmd4bjRHVVRPL2g2Nzdpd2ROajgzbVRDdWNPZnNHeDVMcTZCdXZXT1F0a21Gdk9qSnVSN1daQ2k3QTl4S2tWckxvVEsyWEpBNmNxb0pZMERpa1NMOU1WQW5JWVNyenpCakFwWVc0SGxXTm14ZnJYUUUzYTFKTW95UlRDWWR4azZwUGVzNi9xOG5zN2Fid1RHUGNicmNVZndaN0hiSnFWRVd1aFZxTWpxZW50RHgvRXd3SHFYd0s0YUhMc0hvOGVkc09jbEdMTXBNeFVVOHc0MHJ2ZFNxc3NyUEFmN0RnSGoydkNBNUt2amMrcnBaaGY0Wnl1UkFacHpHSmNvYXNTV3JVeXNqUG5FcFNyVnpzbWV3ejB1K2JyYmNFOTlFNnd0cHhnWVZwUVl0d3FmY2FRY3ZJWUZaT3FXaEJGNFpXcUZoUmdGSkZlQVJSQU1ndnlURmhDaVhObExqcFZcIixcImVwaGVtZXJhbFB1YmxpY0tleVwiOlwiQk83SUpTMVNBanlqWG9EUTVOblBqZmk3dWJ3UVB0Mkx1OFZVQm9SVlh0Q2pWV3h4UUNLWm9sbmc0cnBmUEdaVlRyQzNwOWRUMEtveWhBc2NsR0Z5ZFhFXHUwMDNkXCIsXCJ0YWdcIjpcImtoT1dIRUlSSzBuWVBiWU1OdnhkZVNUTzlsYWJRdlBYZWQrQ1NLZTFyZ1FcdTAwM2RcIn0ifQ==",
        "cardinfo": "{\"card_holder\":\"John Smith\",\"email\":\"JohnSmith@gmail.com\"}",
        "request_id": "2cwmm7wubqkgtzbtzjhvhkaubev81a0r"
    }
}

Response example (PAN_ONLY):

Note: for PAN_ONLY, redirect to the returned url to complete 3DS verification. After 3DS, the customer is redirected to redirect_url:

{
    "status": true,
    "code": "200",
    "data": {
        "order_id": "YOUR_ORDER_ID",
        "trade_id": "e684679e-658b-ac70-fd9e-e4959e147e00",
        "amount": "0.10",
        "currency": "EUR",
        "sub_pay_method": "Google Pay",
        "state": "processing",
        "url": "https://pay.yabandpay.com/dispose_shift4_googlepay_3ds?data=eyJwc3QiOiJlNjg0Njc5ZS02NThiLWFjNzAtZmQ5ZS1lNDk1OWUxNDdlMDAiLCJzaWduX3RyYWRlX2lkIjoiNWZkNzc5Zjg0MmY1ZTc2ZjVmNGQzNGQyNGQ5MGZkMzYyZWMyZGY5ZjU0ODk5ZjBlZDgxYTRkYWUxODM2MmEwNCIsInVzZXIiOiIwMTY2ODMifQ=="
    },
    "message": "",
    "response_id": "202408131051432400124088"
}

Response example (CRYPTOGRAM_3DS):

Note: for CRYPTOGRAM_3DS, no further 3DS verification is required, and state is returned directly:

{
    "status": true,
    "code": "200",
    "data": {
        "order_id": "YOUR_ORDER_ID",
        "trade_id": "e684679e-658b-ac70-fd9e-e4959e147e00",
        "amount": "0.10",
        "currency": "EUR",
        "sub_pay_method": "Google Pay",
        "state": "paid"
    },
    "message": "",
    "response_id": "202408131051432400124088"
}

Additional information:

Response result:

1. A successful request returns "status": true.

2. A failed request returns "status": false.

Evaluate the returned information: if it contains url, redirect to it; if it does not contain url, read state directly.

For PAN_ONLY, after the user completes 3DS verification at url, they are redirected back to redirect_url synchronously. We strongly recommend using both Order Query and Asynchronous Notifications to synchronize and update the payment status and keep payment information accurate in real time. a) If the order status state is paid, payment succeeded; b) if the order status state is authorized, authorization succeeded. To capture funds after successful authorization, call the authorization capture API.

Response codes: