1. Cardholder chooses UnionPay to check out in the merchant APP;

2. The merchant initiates a request message to the acquirer system;

3. The acquirer transfers the request to UnionPay Omnichannel Platform (UPOP);

4. UnionPay SDK collects payment data and sends it to UPOP;

5. UPOP transfers the transaction to UnionPay core processing system;

6. UnionPay core processing system converts FX rate and transfers the transaction to the issuer;

7. The issuer authorizes transaction and the response message goes back to the merchant over the same route.

Step 1 – Certificate Application

Developers need to obtain three certificates – signature certificate, sensitive information encryption certificate and signature verification certificate before calling the interface. 

● Signature Certificate

Signature Certificate is used to sign or verify a transaction message. First create a message digest, and then use the digest to sign or verify the message. 

How to get signature certificate

1) For signature certificate of the testing environment - It can be obtained from ‘assets’ directory in the SDK directly.

2) For signature certificate of the production environment - UnionPay Business Operation Centre will send an email to the contacts in the application form after approval. The required serial number and license key will be presented in the email.

● Signature Verification Certificate

Signature Verification Certificate is used to Verify a Transaction Response

How to get signature verification certificate

1) For UPOP 5.0 signature verification certificate of the testing environment – It can be obtained from ‘assets’ directory in the SDK directly.

2) For UPOP 5.0 signature verification certificate of the production environment - It can be obtained from ‘assets’ directory in the SDK directly.

3) For UPOP 5.1 signature verification certificate of the testing environment – It is carried in the UPOP reply message.

4) For UPOP 5.1 signature verification certificate of the production environment – It is carried in the UPOP reply message.

● Encryption Certificate

Encryption Certificate is used to encrypt the sensitive information in the UPOP request message.

How to get encryption certificate

1)  For UPOP 5.0 encryption certificate of the testing environment – It can be obtained from ‘assets’ directory in the SDK directly.

2)  For UPOP 5.0 encryption certificate of the production environment –It can be obtained from ‘assets’ directory in the SDK directly.

3)  For UPOP 5.1 encryption certificate of the testing environment – It can be obtained from ‘assets’ directory in the SDK directly.

4)  For UPOP 5.1 encryption certificate of the production environment – Merchant imitates inquiry message to UPOP system periodically (one time per day) to retrieve public key certificate update information. During encryption public key certificate updates, the UPOP system supports both new and old certificates, which last for one month. The UPOP system will return the latest encryption public key certificate and merchant server will replace it with local certificate.

Step 2 – SDK Integration and Configuration

To access the UPOP5.0/5.1 interface, we provide back-end SDKs of JAVA, PHP and .NET which package the fundamental functions such as signature & signature verification, HTTP interface request, etc. Please download the SDK of corresponding language and introduce it to your development project.

Notice:

1）Front-end notification is for reference only, the final payment result must be subject to the back-end notification from transaction inquiry interface. 

2) The front-end/back-end notification received by the merchant system must pass the signature verification to ensure its validity. To learn more about the verification method, please refer to the notification.

3) After receiving the front-end/back-end notification and passing the signature verification, please send transaction inquiry request for the transaction result according to 'orderId', 'txnTime', 'merId' in the notification.