| Environment | URL |
|---|---|
| Sandbox | https://sandbox.api.visa.com/src/v1 |
| Certification | https://cert.api.visa.com/src/v1 |
| Production | https://api.visa.com/src/v1 |
Initialize SRC uses a separate, browser-loaded URL and is not part of the REST base path. The Initialize SRC URL is a Visa-hosted page loaded in a hidden iframe directly from the merchant's checkout page.
See Initialize SRC for the endpoint URL and integration details.
The Click to Pay API requires two authentication mechanisms only:
| Protocols | Details |
|---|---|
| Token Authentication (x-pay-token) | Session-based authentication using JSON Web Tokens that identify specific transactions and their contents. See API Key – Shared Secret (X-Pay Token) in the Visa Developer Center for authentication setup instructions. |
| API Key Authentication (apikey) | Client-specific authentication using persistent API keys issued during onboarding. Keys identify the connecting client system and remain valid throughout the integration lifecycle. |
In addition to the REST API endpoints, the Click to Pay integration includes one browser-based operation: Initialize SRC.
Initialize SRC is architecturally different from all other Click to Pay APIs:
| REST APIs | Initialise SRC | |
|---|---|---|
| How it's called | Your server or frontend calls a REST endpoint | Your frontend loads a Visa-hosted URL in a hidden iframe |
| Authentication | x-pay-token + API key | Parameters passed on the URL |
| Response | HTTP JSON response | Asynchronous browser postMessage |
| Where it runs | Server or browser | Browser only |
Initialize SRC must be implemented on the client (browser) side of your checkout page. It does not use the src/v1 REST base URL and does not require x-pay-token or API key authentication.
See Initialize SRC for the complete integration steps.
Start a Project
API Overview
API Reference