Visa Click to Pay

Merchants and Payment Service Providers

Start a Project Start a Project API Overview API Overview API Reference API Reference
Navigate to...
keyboard_arrow_down

Use Cases

This section describes how Visa Click to Pay API endpoints can be used to support different consumer checkout scenarios.

Standard Checkout Flow

  1. Identity Lookup

    Determine whether the provided email address or mobile phone number is associated with an existing Visa Click to Pay profile.

  2. Identity Validation

    Verify the consumer’s identity, performed either by the SRCi or by Visa Click to Pay, depending on the scenario.

  3. Profile and Card Retrieval

    Retrieve the consumer’s enrolled Visa Click to Pay cards for display.

  4. Card Selection

    The consumer selects a preferred payment card.

  5. Authentication and Payload Retrieval (if required)

    Additional authentication may be triggered based on transaction risk or card status (for example, 3DS or passkey), followed by retrieval of the appropriate payload for payment processing.

  6. Checkout and Transaction Confirmation

    Complete the payment using the selected card and notify Visa Click to Pay of the transaction outcome.

Common Checkout Use Cases

Depending on the consumer and their prior interactions with Visa Click to Pay, consumers can be categorized into one of the following profiles.

 

Consumer Profile Description Best For
SRCi-Managed Identity Verification Checkout using Existing Visa Click to Pay Profile

The SRCi validates the consumer’s identity independently and accesses the consumer’s existing Visa Click to Pay profile to retrieve enrolled cards for checkout.

 

The SRCi wants full control over identity verification and the end‑to‑end consumer experience

 
Visa-Managed Identity Verification Checkout using Existing Visa Click to Pay Profile

The SRCi delegates consumer identity validation to Visa Click to Pay, which verifies the consumer before allowing access to the existing Click to Pay profile.

 

The SRCi prefers Visa‑managed identity validation

 
Checkout with Card Enrollment during Checkout The SRCi initiates card enrollment during checkout because the consumer does not yet have a Visa Click to Pay profile. Enrollment is completed before proceeding to payment. Supporting first‑time consumers through just‑in‑time enrollment without breaking the checkout flow

Additional Use Cases

The following are use cases that can be performed using the Visa Click to Pay API in addition to the consumer checkout flows.

 

Use Case Description

Endpoint Used
DPA-Scoped Card-on-File (CoF) Token using Visa Click to Pay

Enables a Payment SRCi to enroll a Visa Click to Pay card as a DPA‑scoped card‑on‑file token for future use after consumer consent is obtained.

POST /cards
SRCi-Scoped eCommerce (eCom) Token using Visa Click to Pay

Enables a Payment SRCi to obtain an SRCi‑scoped eCommerce token bound to the SRCi’s TRID for use in subsequent transactions following an initial checkout.

POST /cards

SRCi‑Managed Identity Verification Checkout using Existing Visa Click to Pay Profile

As the SRCi, you can authenticate your consumer using your own identity verification mechanism and retrieve your consumer’s Visa Click to Pay card list for secure payment method presentation and transaction processing.

Scenario Description

Context:

  • Consumer has an existing account with the SRCi
  • Consumer is already verified by the SRCi
  • Consumer has enrolled cards in Visa Click to Pay
  • SRCi performs all identity verification independently

Flow: SRCi verifies the consumer's identity using their own mechanism, then calls Visa Click to Pay to retrieve the consumer's card list for checkout.

Note: An SRCi or SRC Enabler can only perform this flow with their own identity validation solution upon express written approval from Visa.

High-Level Flow

existing-consumer-ctp-profile

Step 1. Identity Lookup

Determine whether the provided consumer identity (email addressor mobile phone number) exists within Visa Click to Pay using the Identity Lookup endpoint.

Expected returned result:

{
  "consumerPresent1": true,
  ...
}

Step 2. Profile Retrieval

Retrieve the consumer’s profile using the Profile Retrieval endpoint. Results in a card list with the srcDigitalCardIds.

Step 3. Card Presentation and Selection

Present the card list to the consumer, resulting in a selected card.

Prerequisites:

  • Card list retrieved
  • srcCorrelationId stored
  • maskedCards[] available

Workflow:

  1. Parse Card Data: SRCi extracts key fields from the MaskedCard and DigitalCardData schemas. See Card Display Data below.

    Card Display Data

     

    Schema Field Type Description
    maskedCard srcDigitalCardId string Digital card identified for checkout
    maskedCard panLastFour string Last four digits of card
    maskedCard.digitalCardData descriptorName string Presentation text defined by the SRC program that describes the PAN presented as a digital card
    maskedCard.digitalCardData artUri string Image URL and dimensions
    maskedCard dateOfCardCreated string Required
    maskedCard dateOfCardLastUsed string Optional, provided if available

     

     

  2. Format Cards for Display: Cards prepared with brand, type, last four digits, card art, and description.
  3. Display Card List: Consumer views available cards in ascending order from last used; if unavailable or only available for some cards, sort all or any remaining cards based on the date they were added to Visa Click to Pay, with earliest on top.

    SRCis must present the card brand, last four digits, card art, and descriptor in association with each card.

  4. Consumer Selects Card: Consumer clicks or taps desired card.
  5. Confirm Selection: SRCi provides visual confirmation to consumer.

 

Step 4. Checkout

Call the Checkout endpoint with optional additional authentication. This step includes two POST calls to the checkout endpoint.

Step 5. Payload Retrieval (Conditional)

If the payloadTypeIndicator from the previous step is NON_PAYMENT or SUMMARY, call the Payload Retrieval endpoint to retrieve the payment payload.

Step 6. Transaction Confirmation

Once the transaction has been processed, notify Visa Click to Pay of the checkout or payment authorization results with the Transaction Confirmation endpoint.

Step 7. SRCi Token Usage (Optional)

See SRCi-Scoped eCommerce (eCom) Token using Visa Click to Pay.

Visa‑Managed Identity Verification Checkout using Existing Visa Click to Pay Profile

User Story

As an SRCi, you want Visa Click to Pay to perform consumer identity validation so that you can retrieve the Visa Click to Pay card list for consumers who have a Visa Click to Pay profile but do not have an existing account with you. This enables guest checkout without requiring SRCi account creation, while still allowing you to optionally present an account creation flow.

Scenario Description

Context:

  • Consumer does NOT have an existing account with the SRCi
  • Consumer has enrolled cards in Visa Click to Pay
  • SRCi wants Visa to perform identity verification
  • SRCi wants to enable checkout for new consumers

Flow: SRCi checks if the consumer exists in Visa Click to Pay, then delegates identity verification to Visa using OTP validation. After successful verification, Visa returns the consumer's card lists for checkout.

High-Level Flow

new-consumer-ctp-profile

Step 1. Identity Lookup

Determine whether the provided consumer identity (email addressor mobile phone number) exists within Visa Click to Pay using the Identity Lookup endpoint.

Expected returned result:

{
  "consumerPresent1": true,
  ...
}

See for more details.

Step 2. Identity Validation

On confirmation that a Visa Click to Pay profile exists, call the Initiate Identity Validation endpoint Initiate Identity Validation endpoint to receive an idValidationSessionId, corresponding to the OTP that is sent in parallel.

Capture the OTP from the consumer and send it to the Complete Identity Validation to receive an idToken on a successful response.

Step 3. Profile Retrieval

Retrieve the consumer’s profile using the Profile Retrieval endpoint. Results in a card list with the srcDigitalCardIds.

Step 4. Card Presentation and Selection

Prerequisites:

  • Card list retrieved
  • srcCorrelationId stored
  • maskedCards[] available

Workflow:

  1. Parse Card Data: SRCi extracts key fields from the MaskedCard and DigitalCardData schemas. See Card Display Data below.

    Card Display Data

     

    Schema Field Type Description
    maskedCard srcDigitalCardId string Digital card identified for checkout
    maskedCard panLastFour string Last four digits of card
    maskedCard.digitalCardData descriptorName string Presentation text defined by the SRC program that describes the PAN presented as a digital card
    maskedCard.digitalCardData artUri string Image URL and dimensions
    maskedCard dateOfCardCreated string Required
    maskedCard dateOfCardLastUsed string Optional, provided if available

     

     

  2. Format Cards for Display: Cards prepared with brand, type, last four digits, card art, and description.
  3. Display Card List: Consumer views available cards in ascending order from last used; if unavailable or only available for some cards, sort all or any remaining cards based on the date they were added to Visa Click to Pay, with earliest on top.

    SRCis must present the card brand, last four digits, card art, and descriptor in association with each card.

  4. Consumer Selects Card: Consumer clicks or taps desired card.
  5. Confirm Selection: SRCi provides visual confirmation to consumer.

 

Step 5. Checkout

Call the Checkout endpoint with optional additional authentication. This step includes two POST calls to the checkout endpoint.

Step 6. Payload Retrieval (Conditional)

If the payloadTypeIndicator from the previous step is NON_PAYMENT or SUMMARY, call the Payload Retrieval endpoint to retrieve the payment payload.

Step 7. Transaction Confirmation

Once the transaction has been processed, notify Visa Click to Pay of the checkout or payment authorization results with the Transaction Confirmation endpoint.

Step 8. SRCi Account Creation (Optional)

SRCi may present consumers with an option to create an account with them for future non-Visa Click to Pay checkout convenience after successful transaction completion.

Future Checkout Flow:

With SRCi Account Created:

  • Future Flow: Existing SRCi Consumer
  • Verification: SRCi performs verification
  • Speed: Faster - no OTP required
  • Experience: Streamlined checkout

Without SRCi Account (Guest Continues):

  • Future Flow: This flow
  • Verificiation: Visa performs verification (OTP)
  • Speed: Requires OTP validation each time
  • Experience: Guest checkout maintained

Step 9. SRCi Token Enrollment (Optional)

Refer to DPA-Scoped Card-on-File (CoF) Token using Visa Click to Pay.

Checkout with Card Enrollment during Checkout (New SRCi Consumer, No Existing Visa Click to Pay Profile)

User Story

As an SRCi, you want to support checkout for consumers whose cards are not yet enrolled in Visa Click to Pay by enabling in‑checkout card enrollment, allowing consumers to seamlessly enroll their card and continue directly to payment.

Scenario Description

Context:

  • Consumer does not have an existing account with the SRCi
  • Consumer's card is NOT enrolled in Visa Click to Pay
  • Card enrollment occurs during checkout (just-in-time)
  • SRCi collects required enrollment data and consumer consent (refer to )
  • Enrollment creates the necessary credentials for checkout

Flow: SRCi attempts to find the consumer's cards in Visa Click to Pay, discovers none are enrolled, then collects card details and consumer information to enroll the card just-in-time before proceeding with checkout.

High-Level Flow

new-consumer-no-profile

Step 1. Identity Lookup

Determine whether the provided consumer identity (email addressor mobile phone number) exists within Visa Click to Pay using the Identity Lookup endpoint.

Expected returned result:

{
  "consumerPresent1": true,
  ...
}

Step 2. Collect Consumer Information

Collect all required information before enrollment may proceed. This includes:

  • Card details: number, expiry, name on card
  • Consumer data requirements:
    • First and Last Name - Required if Full Name not provided
    • consumerIdentity - Required
      • Email - If consumerIdentity is mobile phone number, email address is required
      • Mobile - If consumerIdentity is email address, mobile phone number is required
    • Country - Required
    • Language - Required
  • Consent to Visa Terms of Service and Privacy Notice
  • (Optional) Card Security Code (CVV2) - improves verification status
    • If provided, card is verified; if not provided, card is unverified

Step 3. Card Enrollment

Enroll the card to Visa Click to Pay using the Card Enrollment endpoint, resulting in getting a srcDigitalCardId returned in the enrollment confirmation.

Step 4. Checkout

Call the Checkout endpoint with optional additional authentication. This step includes two POST calls to the checkout endpoint.

Step 5. Payload Retrieval (Conditional)

If the payloadTypeIndicator from the previous step is NON_PAYMENT or SUMMARY, call the Payload Retrieval endpoint to retrieve the payment payload.

Step 6. Transaction Confirmation

Once the transaction has been processed, notify Visa Click to Pay of the checkout or payment authorization results with the Transaction Confirmation endpoint.

DPA‑Scoped Card‑on‑File (CoF) Token using Visa Click to Pay

Overview

Merchant Digital Card‑On‑File (COF) via Visa Click to Pay enables a merchant to support saved‑card use cases—such as subscriptions, recurring payments, and repeat checkout—without storing card data.

The Consumer completes a purchase using Visa Click to Pay. After a successful transaction, the Consumer may elect to designate the card used as the merchant Digital Card‑On‑File for that merchant. Visa Click to Pay securely stores the card, while the merchant retains a reference identifier (srcDigitalCardId) that can be used to retrieve encrypted payment payloads on demand for future transactions.

Any consent to store credentials for merchant Digital Card‑On‑File is collected and managed by the merchant prior to enrolling the card for COF.

Note: Merchant refers to the merchant entity operating the Digital Payment Application (DPA) and/or the Payment SRC Initiator (SRCi).

  • The DPA is responsible for consumer consent and Card‑On‑File token scope (TRID).
  • The SRCi is responsible for invoking Visa Click to Pay APIs, including Checkout, Card Enrollment, and Payload Retrieval.

Unless explicitly stated otherwise, references to Merchant encompass both roles.

Key Points
  • Cards are stored by Visa Click to Pay; the merchant does not store PANs or sensitive card data.
  • The Consumer explicitly designates a card as a merchant Digital Card‑On‑File for a specific merchant.
  • COF enrollment returns a merchant‑scoped srcDigitalCardId, which serves as the reference for future payments.
  • Consumer consent to store and use the card for COF is required and controlled by the merchant.
  • Payment credentials (cryptograms and EMV payloads) are retrieved on demand using GetPayload.
  • A merchant Digital Card‑On‑File may be used for:
    • repeat consumer‑initiated transactions, and
    • merchant‑initiated transactions (for example, subscriptions or recurring payments), subject to applicable merchant terms and consumer authorization.

High-Level Flow

In this diagram, Merchant denotes the merchant entity operating the Digital Payment Application (DPA) and/or the Payment SRC Initiator (SRCi). The DPA is responsible for consumer consent and Card‑On‑File token scope (TRID), and the SRCi is responsible for invoking Visa Click to Pay APIs.

Step 1: Initial Checkout

The Consumer completes a purchase at the merchant using Visa Click to Pay.

Visa Click to Pay returns a checkout response that includes the following identifiers:

  • srcDigitalCardId
  • srcCorrelationId
  • srciTransactionId

The merchant uses the returned payment payload to complete authorization and stores the returned identifiers for potential COF enrollment.

Step 2: Consumer Designates Merchant Digital Card‑On‑File

After the purchase is completed, the Consumer chooses to designate the card used in the transaction as the merchant Digital Card‑On‑File.

The merchant presents applicable terms and conditions and collects explicit consumer consent to store and use the card for future payments.

If consent is not provided, the card is not enrolled for COF.

Step 3: Enroll Card as Merchant Digital Card‑On‑File

Once consent has been obtained, the merchant enrolls the card for COF using the previously returned srcDigitalCardId.

Visa Click to Pay provisions a merchant‑specific Card‑On‑File token and returns a merchant‑scoped srcDigitalCardId representing the merchant Digital Card‑On‑File.

The merchant stores this reference for future use.

Step 4: Future Payments Using Merchant Digital Card‑On‑File

For subsequent transactions:

  • The merchant uses the stored srcDigitalCardId to request a payment payload from Visa Click to Pay.
  • No SRC checkout or Consumer interaction is required.

SRCi‑Scoped eCommerce (eCom) Token using Visa Click to Pay

This use case enables a Payment SRCi to obtain and use an SRCi‑specific eCommerce (eCom) token for transactions processed through Visa Click to Pay.

During the initial transaction, payment processing is performed using a token bound to the Visa Click to Pay Token Requestor ID (TRID). After checkout, the Payment SRCi may elect to request an SRCi‑specific eCom token—a Visa network token bound to the SRCi's TRID—for use in subsequent transactions.

The SRCi‑specific eCom token enables streamlined repeat checkout and follow‑on transactions without repeating the full Visa Click to Pay lookup flow.

Only Payment SRCis are eligible to request SRCi‑specific tokens.

Key Points:

  • An SRCi‑specific eCom token is a Visa network token bound to the Payment SRCi's TRID
  • Only Payment SRCis may request SRCi‑specific tokens
  • First transaction: processed using a token bound to the Visa Click to Pay TRID
  • Subsequent transactions: may use the SRCi‑specific eCom token once provisioned
  • Enrollment occurs post‑ Visa CTP checkout by invoking the Card Enrollment endpoint with the srcDigitalCardId returned from checkout

Scenarios

Scenario A - SRCi-Specific Token Exists:

If an SRCi specific eCom token already exists for the selected card:

  • Checkout returns an SRCi specific payload
  • The Payment SRCi uses the SRCi specific token for transaction confirmation and processing

Scenario B — SRCi‑Specific Token Does Not Exist:

If no SRCi‑specific eCom token exists, SRCis may choose:

  • Option A (Default): The Payment SRCi uses the Visa Click to Pay eCom payload bound to the Visa Click to Pay TRID
  • Option B: The Payment SRCi requests an SRCi‑specific eCom token via post‑checkout enrollment

High-Level Flow

Step 1: Checkout Initiated

The consumer completes Checkout using Visa Click to Pay.

  • The Payment SRCi invokes Checkout (POST /transactions/credentials)
  • The response includes identifiers such as srcDigitalCardId and srcCorrelationId
  • The payload is bound to the Visa Click to Pay TRID
  • Authorization and approval/decline are completed using the checkout payload or a subsequent payload retrieval

Step 2: Determine Whether an SRCi‑Specific Token Is Required (Optional)

After checkout, the Payment SRCi determines whether an SRCi‑specific eCom token is required for subsequent transactions.

This determination is made by evaluating the scope of the payload returned by Checkout or Payload Retrieval (GET /transactions/credentials):

  • If the payload is bound to the SRCi’s TRID, an SRCi‑specific eCom token already exists
  • If the payload is bound to the Visa Click to Pay TRID, no SRCi‑specific token exists

No additional API call is required solely to determine token existence.

Step 3: Enroll for SRCi‑Specific eCom Token (Optional)

If the Payment SRCi chooses to provision an SRCi‑specific token:

  • The Payment SRCi invokes Card Enrollment:
    • Endpoint: POST /cards
    • Inputs: srcDigitalCardId (from Checkout), srcClientId

Visa Click to Pay provisions an SRCi‑specific Visa network eCom token and returns:

  • Token reference
  • Token metadata
  • Token expiration details

The Payment SRCi stores the token reference for future use.

Step 4: Use SRCi‑Specific eCom Token for Subsequent Transactions

For subsequent transactions:

  • The Payment SRCi retrieves payment credentials using Payload Retrieval (GET /transactions/credentials), providing the SRCi‑specific token reference
  • Visa Click to Pay returns an encrypted payment payload bound to the SRCi’s TRID
  • The Payment SRCi submits the payload for authorization via its acquirer or PSP
  • Approval or decline is processed as a standard eCommerce authorization

Summary

The SRCi‑specific eCom token flow allows Payment SRCis to:

  • Complete the initial checkout using Visa Click to Pay with minimal friction
  • Optionally provision an SRCi‑scoped token after checkout
  • Use Payload Retrieval (GET /transactions/credentials) to retrieve encrypted payment payloads where required
  • Enable repeat and follow‑on transactions without repeating the full Visa Click to Pay flow
  • Maintain a clear distinction between Visa Click to Pay‑scoped and SRCi‑scoped tokens