Complete Example: Checkout Page with 3D Secure

const express = require('express');

const app = express();
app.use(express.json());
app.use(express.static('public'));

const PCI_BOOKING = 'https://service.pcibooking.net/api';
const API_KEY = process.env.PCI_BOOKING_API_KEY;
const TOKEN_PREFIX = 'https://service.pcibooking.net/api/payments/paycard/';

// Start a temporary session for the card entry form.
app.post('/api/card-session', async (req, res) => {
  const response = await fetch(PCI_BOOKING + '/payments/paycard/tempsession', {
    method: 'POST',
    headers: { 'Authorization': 'APIKEY ' + API_KEY }
  });
  if (!response.ok) {
    return res.status(502).json({ error: 'Could not start a card session' });
  }
  const sessionToken = await response.json(); // the response is a JSON string
  res.json({ sessionToken });
});

// Charge the card token through the Universal Payment Gateway.
app.post('/api/charge', async (req, res) => {
  const { cardToken } = req.body;
  if (typeof cardToken !== 'string' || !cardToken.startsWith(TOKEN_PREFIX)) {
    return res.status(400).json({ status: 'Rejected', reason: 'Invalid card token' });
  }

  // Take the amount from your own booking record, never from the browser.
  const booking = { reference: 'BK-10045', amount: 450.00, currency: 'USD' };

  const response = await fetch(PCI_BOOKING + '/paymentGateway', {
    method: 'POST',
    headers: {
      'Authorization': 'APIKEY ' + API_KEY,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      cardToken: cardToken,
      OperationType: 'Charge',
      Amount: booking.amount,
      Currency: booking.currency,
      myRef: booking.reference,
      PaymentGateway: { Name: 'NULLSuccess' },
      PayerDetails: { ClientIPAddress: req.ip }
    })
  });

  const result = await response.json();
  const status = result.OperationResultCode; // Success, Accepted, Rejected, TemporaryFailure or FatalFailure

  // Save result.GatewayReference with the booking: you need it for refunds and voids.
  res.json({
    status: status,
    reason: status === 'Success' ? null : (result.GatewayResultDescription || result.OperationResultDescription)
  });
});

app.listen(3000, () => console.log('Checkout running on http://localhost:3000/checkout.html'));

using System.Net.Http.Json;
using System.Text.Json;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddHttpClient("pcib", c =>
{
    c.BaseAddress = new Uri("https://service.pcibooking.net/api/");
    c.DefaultRequestHeaders.Add("Authorization",
        "APIKEY " + builder.Configuration["PCI_BOOKING_API_KEY"]);
});

var app = builder.Build();
app.UseDefaultFiles();
app.UseStaticFiles(); // serves wwwroot/checkout.html and wwwroot/card-failed.html

const string TokenPrefix = "https://service.pcibooking.net/api/payments/paycard/";

// Start a temporary session for the card entry form.
app.MapPost("/api/card-session", async (IHttpClientFactory factory) =>
{
    var client = factory.CreateClient("pcib");
    var response = await client.PostAsync("payments/paycard/tempsession", null);
    if (!response.IsSuccessStatusCode)
        return Results.StatusCode(502);

    // The response is a JSON string, for example "33b245a015cf4d10a3ca885e7f4c5600".
    var sessionToken = await response.Content.ReadFromJsonAsync<string>();
    return Results.Ok(new { sessionToken });
});

// Charge the card token through the Universal Payment Gateway.
app.MapPost("/api/charge", async (ChargeRequest request, HttpContext http, IHttpClientFactory factory) =>
{
    if (string.IsNullOrEmpty(request.CardToken) || !request.CardToken.StartsWith(TokenPrefix))
        return Results.BadRequest(new { status = "Rejected", reason = "Invalid card token" });

    // Take the amount from your own booking record, never from the browser.
    var booking = new { Reference = "BK-10045", Amount = 450.00m, Currency = "USD" };

    var client = factory.CreateClient("pcib");
    var response = await client.PostAsJsonAsync("paymentGateway", new
    {
        cardToken = request.CardToken,
        OperationType = "Charge",
        Amount = booking.Amount,
        Currency = booking.Currency,
        myRef = booking.Reference,
        PaymentGateway = new { Name = "NULLSuccess" },
        PayerDetails = new { ClientIPAddress = http.Connection.RemoteIpAddress?.ToString() }
    });

    var result = await response.Content.ReadFromJsonAsync<JsonElement>();
    // Success, Accepted, Rejected, TemporaryFailure or FatalFailure
    var status = result.TryGetProperty("OperationResultCode", out var c) ? c.GetString() : null;

    // Save GatewayReference with the booking: you need it for refunds and voids.
    string? reason = null;
    if (status != "Success")
    {
        reason = result.TryGetProperty("GatewayResultDescription", out var g) && g.ValueKind == JsonValueKind.String
            ? g.GetString()
            : result.TryGetProperty("OperationResultDescription", out var d) ? d.GetString() : "Declined";
    }
    return Results.Ok(new { status, reason });
});

app.Run();

record ChargeRequest(string CardToken);