Accept payments in native mobile apps

http POST https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/MobileRegistration \
  Content-Type:application/json \
  X-Key:YOUR_API_KEY \
  X-Signature:YOUR_HMAC_SHA256_HEX_SIGNATURE \
  X-DeviceId:DEVICE-UUID-001 \
  X-CompanyNumber:55555 \
  X-StoreNumber:200 \
  X-LaneNumber:1 \
  X-Client-Application-Name:MyPOSApp \
  DeviceId=DEVICE-UUID-001 \
  PublicKey="-----BEGIN PUBLIC KEY-----\nMIIBIjAN...\n-----END PUBLIC KEY-----" \
  KeyEncoding=Pem \
  Description="iPad-Kiosk-Lane-01"

import hmac, hashlib, json, requests

body = {
    "DeviceId": "DEVICE-UUID-001",
    "PublicKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjAN...\n-----END PUBLIC KEY-----",
    "KeyEncoding": "Pem",
    "Description": "iPad-Kiosk-Lane-01",
}
raw = json.dumps(body, separators=(',', ':'))
signature = hmac.new(
    API_SECRET.encode(), raw.encode(), hashlib.sha256
).hexdigest()

response = requests.post(
    "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/MobileRegistration",
    headers={
        "Content-Type": "application/json",
        "X-Key": API_KEY,
        "X-Signature": signature,
        "X-DeviceId": "DEVICE-UUID-001",
        "X-CompanyNumber": "55555",
        "X-StoreNumber": "200",
        "X-LaneNumber": "1",
        "X-Client-Application-Name": "MyPOSApp",
    },
    data=raw,
    timeout=30,
)
print(response.status_code, response.json())

using System.Security.Cryptography;
using System.Text;

var body = """{"DeviceId":"DEVICE-UUID-001","PublicKey":"-----BEGIN PUBLIC KEY-----\nMIIBIjAN...\n-----END PUBLIC KEY-----","KeyEncoding":"Pem","Description":"iPad-Kiosk-Lane-01"}""";
var signature = Convert.ToHexString(
    HMACSHA256.HashData(Encoding.UTF8.GetBytes(apiSecret), Encoding.UTF8.GetBytes(body))
).ToLowerInvariant();

using var client = new HttpClient();
using var req = new HttpRequestMessage(HttpMethod.Post,
    "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/MobileRegistration");
req.Headers.TryAddWithoutValidation("X-Key", apiKey);
req.Headers.TryAddWithoutValidation("X-Signature", signature);
req.Headers.TryAddWithoutValidation("X-DeviceId", "DEVICE-UUID-001");
req.Headers.TryAddWithoutValidation("X-CompanyNumber", "55555");
req.Headers.TryAddWithoutValidation("X-StoreNumber", "200");
req.Headers.TryAddWithoutValidation("X-LaneNumber", "1");
req.Headers.TryAddWithoutValidation("X-Client-Application-Name", "MyPOSApp");
req.Content = new StringContent(body, Encoding.UTF8, "application/json");

var res = await client.SendAsync(req);
Console.WriteLine((int)res.StatusCode);
Console.WriteLine(await res.Content.ReadAsStringAsync());

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.net.http.*;
import java.net.URI;

String body = "{\"DeviceId\":\"DEVICE-UUID-001\",\"PublicKey\":\"-----BEGIN PUBLIC KEY-----\\nMIIBIjAN...\\n-----END PUBLIC KEY-----\",\"KeyEncoding\":\"Pem\",\"Description\":\"iPad-Kiosk-Lane-01\"}";
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(apiSecret.getBytes(), "HmacSHA256"));
String signature = HexFormat.of().formatHex(mac.doFinal(body.getBytes()));

HttpClient client = HttpClient.newHttpClient();
HttpResponse<String> response = client.send(
    HttpRequest.newBuilder()
        .uri(URI.create("https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/MobileRegistration"))
        .header("Content-Type", "application/json")
        .header("X-Key", apiKey)
        .header("X-Signature", signature)
        .header("X-DeviceId", "DEVICE-UUID-001")
        .header("X-CompanyNumber", "55555")
        .header("X-StoreNumber", "200")
        .header("X-LaneNumber", "1")
        .header("X-Client-Application-Name", "MyPOSApp")
        .POST(HttpRequest.BodyPublishers.ofString(body))
        .build(),
    HttpResponse.BodyHandlers.ofString()
);
System.out.println(response.statusCode() + " " + response.body());

import crypto from 'crypto';
import fetch from 'node-fetch';

app.post('/mobile/register', async (req, res) => {
  const { deviceId, publicPem, description } = req.body;

  const body = JSON.stringify({
    DeviceId: deviceId,
    PublicKey: publicPem,
    KeyEncoding: 'Pem',
    Description: description ?? '',
  });

  // HMAC-SHA256 of the raw JSON body, hex-encoded
  const signature = crypto
    .createHmac('sha256', process.env.WEBEPS_API_SECRET)
    .update(body)
    .digest('hex');

  const response = await fetch(
    `${process.env.WEBEPS_BASE_URL}/MobileRegistration`,
    {
      method: 'POST',
      headers: {
        'Content-Type':              'application/json',
        'X-Key':                     process.env.WEBEPS_API_KEY,
        'X-Signature':               signature,
        'X-DeviceId':                deviceId,
        'X-CompanyNumber':           process.env.WEBEPS_COMPANY_NUMBER,
        'X-StoreNumber':             process.env.WEBEPS_STORE_NUMBER,
        'X-LaneNumber':              process.env.WEBEPS_LANE_NUMBER,
        'X-Client-Application-Name': process.env.CLIENT_APP_NAME,
      },
      body,
    }
  );

  if (!response.ok) {
    return res.status(502).json({ error: await response.text() });
  }
  res.json({ registered: true });
});

http POST https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/InitializeSession \
  Content-Type:application/json \
  X-Key:YOUR_API_KEY \
  X-Signature:YOUR_RSA_SHA256_HEX_SIGNATURE \
  X-DeviceId:DEVICE-UUID-001 \
  X-CompanyNumber:55555 \
  X-StoreNumber:200 \
  X-LaneNumber:1 \
  X-Client-Application-Name:MyPOSApp \
  Amount:=0.10 \
  AllowCardNaming:=false \
  AuthorizationMode:=1 \
  ReturnMethod:=1 \
  ReturnURL=https://your-backend.example.com/mobile/hpp-return \
  FrameHostingURL=https://your-backend.example.com \
  TokenRetrievalRequired:=true \
  AccountAddressCollectionMode=Full \
  ValidateAccountSecurityCode:=true \
  ValidateAccountAddress:=false

from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
import json, binascii, requests

with open("private_encrypted.pem", "rb") as f:
    private_key = serialization.load_pem_private_key(f.read(), password=b"YOUR_PASSPHRASE")

payload = json.dumps({
    "Amount": 0.10, "AllowCardNaming": False, "AuthorizationMode": 1,
    "FeeType": None, "FeeAmount": None, "TenderType": None,
    "UseShippingAddressForBilling": False, "UseDefaultAddressForBilling": False,
    "CustomerAccount": None, "UniqueTransactionIdentifier": None,
    "UniqueId": None, "StoreNumber": None, "ReturnMethod": 1,
    "ReturnURL": "https://your-backend.example.com/mobile/hpp-return",
    "FrameHostingURL": "https://your-backend.example.com",
    "AdditionalFrameHostingURLs": None,
    "TokenRetrievalRequired": True,
    "AccountAddressCollectionMode": "Full",
    "ValidateAccountSecurityCode": True, "ValidateAccountAddress": False,
}, separators=(',', ':'))

sig = private_key.sign(payload.encode(), padding.PKCS1v15(), hashes.SHA256())
signature = binascii.hexlify(sig).decode()

response = requests.post(
    "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/InitializeSession",
    headers={
        "Content-Type": "application/json",
        "X-Key": API_KEY, "X-Signature": signature,
        "X-DeviceId": "DEVICE-UUID-001",
        "X-CompanyNumber": "55555", "X-StoreNumber": "200",
        "X-LaneNumber": "1", "X-Client-Application-Name": "MyPOSApp",
    },
    data=payload, timeout=30,
)
print(response.json())  # { SessionId, RequestURL }

using System.Security.Cryptography;
using System.Text;

var payload = """{"Amount":0.10,"AllowCardNaming":false,"AuthorizationMode":1,"ReturnMethod":1,"ReturnURL":"https://your-backend.example.com/mobile/hpp-return","FrameHostingURL":"https://your-backend.example.com","TokenRetrievalRequired":true,"AccountAddressCollectionMode":"Full","ValidateAccountSecurityCode":true,"ValidateAccountAddress":false}""";

using var rsa = RSA.Create();
rsa.ImportFromEncryptedPem(
    File.ReadAllText("private_encrypted.pem"),
    "YOUR_PASSPHRASE");
var sigBytes = rsa.SignData(
    Encoding.UTF8.GetBytes(payload),
    HashAlgorithmName.SHA256,
    RSASignaturePadding.Pkcs1);
var signature = Convert.ToHexString(sigBytes).ToLowerInvariant();

using var client = new HttpClient();
using var req = new HttpRequestMessage(HttpMethod.Post,
    "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/InitializeSession");
req.Headers.TryAddWithoutValidation("X-Key", apiKey);
req.Headers.TryAddWithoutValidation("X-Signature", signature);
req.Headers.TryAddWithoutValidation("X-DeviceId", "DEVICE-UUID-001");
req.Headers.TryAddWithoutValidation("X-CompanyNumber", "55555");
req.Headers.TryAddWithoutValidation("X-StoreNumber", "200");
req.Headers.TryAddWithoutValidation("X-LaneNumber", "1");
req.Headers.TryAddWithoutValidation("X-Client-Application-Name", "MyPOSApp");
req.Content = new StringContent(payload, Encoding.UTF8, "application/json");

var res = await client.SendAsync(req);
var json = await res.Content.ReadAsStringAsync();
// Deserialise to get SessionId and RequestURL
Console.WriteLine(json);

import java.security.*;
import java.net.http.*;
import java.net.URI;

// Load encrypted private key via BouncyCastle PEMParser or KeyStore
// After loading as PrivateKey `privateKey`:
String payload = "{\"Amount\":0.10,\"AllowCardNaming\":false,\"AuthorizationMode\":1," +
    "\"ReturnMethod\":1,\"ReturnURL\":\"https://your-backend.example.com/mobile/hpp-return\"," +
    "\"FrameHostingURL\":\"https://your-backend.example.com\"," +
    "\"TokenRetrievalRequired\":true,\"AccountAddressCollectionMode\":\"Full\"," +
    "\"ValidateAccountSecurityCode\":true,\"ValidateAccountAddress\":false}";

Signature sig = Signature.getInstance("SHA256withRSA");
sig.initSign(privateKey);
sig.update(payload.getBytes());
String signature = HexFormat.of().formatHex(sig.sign());

HttpClient client = HttpClient.newHttpClient();
HttpResponse<String> response = client.send(
    HttpRequest.newBuilder()
        .uri(URI.create("https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/InitializeSession"))
        .header("Content-Type", "application/json")
        .header("X-Key", apiKey)
        .header("X-Signature", signature)
        .header("X-DeviceId", "DEVICE-UUID-001")
        .header("X-CompanyNumber", "55555")
        .header("X-StoreNumber", "200")
        .header("X-LaneNumber", "1")
        .header("X-Client-Application-Name", "MyPOSApp")
        .POST(HttpRequest.BodyPublishers.ofString(payload))
        .build(),
    HttpResponse.BodyHandlers.ofString()
);
System.out.println(response.body()); // { SessionId, RequestURL }

import crypto from 'crypto';
import fs from 'fs';
import fetch from 'node-fetch';

const privateKey = fs.readFileSync(process.env.RSA_PRIVATE_PEM_PATH, 'utf8');

app.post('/api/payments/initialize', async (req, res) => {
  const { amount = 0.10, returnURL } = req.body;

  const payload = JSON.stringify({
    Amount: amount,
    AllowCardNaming: false,
    AuthorizationMode: 1,
    FeeType: null,
    FeeAmount: null,
    TenderType: null,
    UseShippingAddressForBilling: false,
    UseDefaultAddressForBilling: false,
    CustomerAccount: null,
    UniqueTransactionIdentifier: null,
    UniqueId: null,
    StoreNumber: null,
    ReturnMethod: 1,
    ReturnURL: returnURL ?? process.env.HPP_RETURN_URL,
    FrameHostingURL: process.env.HPP_FRAME_HOSTING_URL,
    AdditionalFrameHostingURLs: null,
    TokenRetrievalRequired: true,
    AccountAddressCollectionMode: 'Full',
    ValidateAccountSecurityCode: true,
    ValidateAccountAddress: false,
  });

  // RSA-SHA256, hex-encoded signature
  const signature = crypto
    .createSign('SHA256')
    .update(payload)
    .sign({ key: privateKey, passphrase: process.env.RSA_PASSPHRASE }, 'hex');

  const response = await fetch(
    `${process.env.WEBEPS_BASE_URL}/InitializeSession`,
    {
      method: 'POST',
      headers: {
        'Content-Type':              'application/json',
        'X-Key':                     process.env.WEBEPS_API_KEY,
        'X-Signature':               signature,
        'X-DeviceId':                process.env.DEVICE_ID,
        'X-CompanyNumber':           process.env.WEBEPS_COMPANY_NUMBER,
        'X-StoreNumber':             process.env.WEBEPS_STORE_NUMBER,
        'X-LaneNumber':              process.env.WEBEPS_LANE_NUMBER,
        'X-Client-Application-Name': process.env.CLIENT_APP_NAME,
      },
      body: payload,
    }
  );

  if (!response.ok) {
    return res.status(502).json({ error: await response.text() });
  }

  const data = await response.json();
  // Return only what the app needs — never forward the full NCR response
  res.json({
    sessionId:  data.SessionId,
    requestURL: data.RequestURL,
  });
});

http POST https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/CompleteSession \
  Content-Type:application/json \
  X-Key:YOUR_API_KEY \
  X-Signature:YOUR_RSA_SHA256_HEX_SIGNATURE \
  X-DeviceId:DEVICE-UUID-001 \
  X-CompanyNumber:55555 \
  X-StoreNumber:200 \
  X-LaneNumber:1 \
  X-Client-Application-Name:MyPOSApp \
  SessionId=45016f4cce57e5ab4e308a1822b9b9fc3336

from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
import json, binascii, requests

with open("private_encrypted.pem", "rb") as f:
    private_key = serialization.load_pem_private_key(f.read(), password=b"YOUR_PASSPHRASE")

payload = json.dumps({"SessionId": session_id}, separators=(',', ':'))
sig = private_key.sign(payload.encode(), padding.PKCS1v15(), hashes.SHA256())
signature = binascii.hexlify(sig).decode()

response = requests.post(
    "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/CompleteSession",
    headers={
        "Content-Type": "application/json",
        "X-Key": API_KEY, "X-Signature": signature,
        "X-DeviceId": "DEVICE-UUID-001",
        "X-CompanyNumber": "55555", "X-StoreNumber": "200",
        "X-LaneNumber": "1", "X-Client-Application-Name": "MyPOSApp",
    },
    data=payload, timeout=30,
)
print(response.status_code, response.json())

using System.Security.Cryptography;
using System.Text;

var payload = $"{{\"SessionId\":\"{sessionId}\"}}";

using var rsa = RSA.Create();
rsa.ImportFromEncryptedPem(
    File.ReadAllText("private_encrypted.pem"),
    "YOUR_PASSPHRASE");
var sigBytes = rsa.SignData(
    Encoding.UTF8.GetBytes(payload),
    HashAlgorithmName.SHA256,
    RSASignaturePadding.Pkcs1);
var signature = Convert.ToHexString(sigBytes).ToLowerInvariant();

using var client = new HttpClient();
using var req = new HttpRequestMessage(HttpMethod.Post,
    "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/CompleteSession");
req.Headers.TryAddWithoutValidation("X-Key", apiKey);
req.Headers.TryAddWithoutValidation("X-Signature", signature);
req.Headers.TryAddWithoutValidation("X-DeviceId", "DEVICE-UUID-001");
req.Headers.TryAddWithoutValidation("X-CompanyNumber", "55555");
req.Headers.TryAddWithoutValidation("X-StoreNumber", "200");
req.Headers.TryAddWithoutValidation("X-LaneNumber", "1");
req.Headers.TryAddWithoutValidation("X-Client-Application-Name", "MyPOSApp");
req.Content = new StringContent(payload, Encoding.UTF8, "application/json");

var res = await client.SendAsync(req);
Console.WriteLine((int)res.StatusCode);
Console.WriteLine(await res.Content.ReadAsStringAsync());

import java.security.*;
import java.net.http.*;
import java.net.URI;

String payload = "{\"SessionId\":\"" + sessionId + "\"}";
Signature sig = Signature.getInstance("SHA256withRSA");
sig.initSign(privateKey);
sig.update(payload.getBytes());
String signature = HexFormat.of().formatHex(sig.sign());

HttpClient client = HttpClient.newHttpClient();
HttpResponse<String> response = client.send(
    HttpRequest.newBuilder()
        .uri(URI.create("https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/CompleteSession"))
        .header("Content-Type", "application/json")
        .header("X-Key", apiKey)
        .header("X-Signature", signature)
        .header("X-DeviceId", "DEVICE-UUID-001")
        .header("X-CompanyNumber", "55555")
        .header("X-StoreNumber", "200")
        .header("X-LaneNumber", "1")
        .header("X-Client-Application-Name", "MyPOSApp")
        .POST(HttpRequest.BodyPublishers.ofString(payload))
        .build(),
    HttpResponse.BodyHandlers.ofString()
);
System.out.println(response.statusCode() + " " + response.body());

app.post('/api/payments/complete', async (req, res) => {
  const { sessionId } = req.body;
  if (!sessionId) return res.status(400).json({ error: 'Missing sessionId' });

  const payload = JSON.stringify({ SessionId: sessionId });

  const signature = crypto
    .createSign('SHA256')
    .update(payload)
    .sign({ key: privateKey, passphrase: process.env.RSA_PASSPHRASE }, 'hex');

  const response = await fetch(
    `${process.env.WEBEPS_BASE_URL}/CompleteSession`,
    {
      method: 'POST',
      headers: {
        'Content-Type':              'application/json',
        'X-Key':                     process.env.WEBEPS_API_KEY,
        'X-Signature':               signature,
        'X-DeviceId':                process.env.DEVICE_ID,
        'X-CompanyNumber':           process.env.WEBEPS_COMPANY_NUMBER,
        'X-StoreNumber':             process.env.WEBEPS_STORE_NUMBER,
        'X-LaneNumber':              process.env.WEBEPS_LANE_NUMBER,
        'X-Client-Application-Name': process.env.CLIENT_APP_NAME,
      },
      body: payload,
    }
  );

  if (!response.ok) {
    return res.status(502).json({ error: await response.text() });
  }

  const result = await response.json();
  res.json({ success: true, transaction: result });
});