Visa Click to Pay API Fundamentals
Merchants and payment service providers
Click to Pay API documentations
Endpoints
| Environment | URL |
|---|---|
Sandbox |
https://sandbox.api.visa.com/src/v1 |
Certification |
https://cert.api.visa.com/src/v1 |
Production |
https://api.visa.com/src/v1 |
Initialize SRC uses a separate, browser-loaded URL and is not part of the REST base path. The Initialize SRC URL is a Visa-hosted page loaded in a hidden iframe directly from the merchant's checkout page.
See Initialize SRC for the endpoint URL and integration details.
API Authentication Methods
The Click to Pay API requires two authentication mechanisms only:
| Protocols | Details |
|---|---|
Token Authentication (x-pay-token) |
Session-based authentication using JSON Web Tokens that identify specific transactions and their contents. See X-Pay Token in the Visa Developer Center for authentication setup instructions. |
API Key Authentication (apikey) |
Client-specific authentication using persistent API keys issued during onboarding. Keys identify the connecting client system and remain valid throughout the integration lifecycle. |
Browser-Based SRC System Initialization
In addition to the REST API endpoints, the Click to Pay integration includes one browser-based operation: Initialize SRC.
Initialize SRC is architecturally different from all other Click to Pay APIs:
| REST APIs | Initialise SRC | |
|---|---|---|
| How it's called | Your server or frontend calls a REST endpoint | Your frontend loads a Visa-hosted URL in a hidden iframe |
| Authentication | x-pay-token + API key | Parameters passed on the URL |
| Response | HTTP JSON response | Asynchronous browser postMessage |
| Where it runs | Server or browser | Browser only |
Initialize SRC must be implemented on the client (browser) side of your checkout page. It does not use the src/v1 REST base URL and does not require x-pay-token or API key authentication.
See Initialize SRC for the complete integration steps.