What do you know about payment APIs?

[chenmichael]

My company is talking about payment and account information APIs. They are planning to get them integrated so as to better help us and our workflow.

I am confused, mainly about the safety and compliance standards. How do those work? It's a small firm so my opinion would also be taken into account in the meeting. I want to be better informed.

 

[fisicx]

There is masses of detail on Google about APIs and how they work. To even scratch the surface here would take hours.

All an API does is provide a bridge between two systems. For example, connecting your website to a payment provider. If your company doesn’t understand how integration works they are not really to begin implementation.

 

[Nathanto]

My company is talking about payment and account information APIs. I am confused, mainly about the safety and compliance standards.

As @fisicx says, in most cases an API is just a piece of software that connects your in-house systems to a third-party system such as PayPal, eBay or Companies House etc.

So, for example, if your company accepts PayPal and has to do a refund then currently someone may have to process the return/refund internally and then manually log into Paypal, find the right transaction and manually action a refund for the correct amount. With an API that someone just processes the return/refund on your own existing system as they do anyway and then your system can either automatically action a refund on PayPal or you could have a second authorisation step built-in.

Either way "the safety and compliance standards" is really based around your own internal processes rather than the API itself. If you can give specifics on what the API is planned to do then posters may be able to offer more relevant advice.

 

[antropy]

There are a few different types of API, each with their own functions. But as mentioned above, they connect your site to various other sites/services to automate processes.

One of the compliance standards we see pop up for handling payments is PCI Compliance. This would usually be handled by the payment providers (e.g. Paypal) unless your company directly handles credit/debit card details. We've actually got a blog about that in case you want to check it out, though I'd definitely recommend that you do further research elsewhere too.

What are you hoping to do with the API, could you elaborate a bit more?

Kelly at Antropy

 

[chenmichael]

There is masses of detail on Google about APIs and how they work. To even scratch the surface here would take hours.

All an API does is provide a bridge between two systems. For example, connecting your website to a payment provider. If your company doesn’t understand how integration works they are not really to begin implementation.

Thanks that makes sense. I suppose the misunderstanding I had was more about what lies around the API than the API itself.

We are looking at leveraging APIs to tie payment/account details into our own workflows and thus I am mostly trying to figure out what we should be asking the supplier about in terms of security, restriction of access, and compliance before we start.

There definitely seems to be a lot more to think about than just the technical functionality of the API.

 

[chenmichael]

As @fisicx says, in most cases an API is just a piece of software that connects your in-house systems to a third-party system such as PayPal, eBay or Companies House etc.

So, for example, if your company accepts PayPal and has to do a refund then currently someone may have to process the return/refund internally and then manually log into Paypal, find the right transaction and manually action a refund for the correct amount. With an API that someone just processes the return/refund on your own existing system as they do anyway and then your system can either automatically action a refund on PayPal or you could have a second authorisation step built-in.

Either way "the safety and compliance standards" is really based around your own internal processes rather than the API itself. If you can give specifics on what the API is planned to do then posters may be able to offer more relevant advice.

That's a good way to think of things. This is a much clearer contrast than the refund scenario.

We're not just talking about automating things like a PayPal return, we're talking about APIs for payment and account information in our situation, so I'm particularly interested in what happens to the data once it hits our own systems.

We’re working with customers who are quite sensitive about financial data, so I’m trying to make sure we’re thinking about the security and compliance side appropriately rather than considering the API as just another integration.

 

[chenmichael]

There are a few different types of API, each with their own functions. But as mentioned above, they connect your site to various other sites/services to automate processes.

One of the compliance standards we see pop up for handling payments is PCI Compliance. This would usually be handled by the payment providers (e.g. Paypal) unless your company directly handles credit/debit card details. We've actually got a blog about that in case you want to check it out, though I'd definitely recommend that you do further research elsewhere too.

What are you hoping to do with the API, could you elaborate a bit more?

Kelly at Antropy

That’s useful. One of the things I’ve seen is PCI. We are not intending to process card details ourselves, therefore part of the reason I am attempting to get a feel for where the provider's responsibilities finish and our responsibilities begin.

The API we're looking at is primarily around payment/account information and getting that information into our own workflows. So I guess my greater issue is what should we be looking at surrounding data access, storage and permissions when considering the provider?
Thanks for directing me in the proper place, I'll dig into the PCI side also.

 

[fisicx]

You need to dig into the api documentation. Everything you need to know will be covered.

 

[Dev. Milon]

My company is talking about payment and account information APIs. They are planning to get them integrated so as to better help us and our workflow.

I am confused, mainly about the safety and compliance standards. How do those work? It's a small firm so my opinion would also be taken into account in the meeting. I want to be better informed.

To clarify the situation, is your company asking you to integrate a third-party payment API, or are they planning to build their own proprietary payment API service?

 

[chenmichael]

To clarify the situation, is your company asking you to integrate a third-party payment API, or are they planning to build their own proprietary payment API service?

3rd party because building would take us a lot of time and funds.

 

[fisicx]

3rd party because building would take us a lot of time and funds.

All depends on the scope of the project. But if you just want to connect to a payment provider then it's normally very simple. You don't then need to worry about PCI - the payment provider looks after this.