# Server-to-Server card payment

Process a card payment directly via the API without using the SDK. The payment is created and confirmed in a single API call with full card details. Useful for PCI-compliant merchants or server-side integrations.

## Use cases

- PCI-compliant server-side integrations
- Call center / MOTO payments
- Migration from other payment providers
- Backend-only payment processing

## Steps

### 1. Create and confirm payment — `POST /payments`

Submit the payment with full card details and confirm: true to process immediately in a single call.

Key parameters:
• confirm: true - Processes the payment immediately
• payment_method: "card" - Required when confirming
• payment_method_data.card - Full card details (number, expiry, CVV, holder name)
• capture_method: "automatic" or "manual"
  - automatic: Authorise and capture in one step
  - manual: Authorise only, capture later
• authentication_type: "no_three_ds" or "three_ds"
  - three_ds: Response includes a next_action with a redirect URL for 3DS
• setup_future_usage: "off_session" - Saves the card for future use
• customer.id - Required to save the card

If 3DS is required, the response status will be "requires_customer_action" with a redirect URL in next_action.

Request body:

```json
{
  "amount": 6500,
  "currency": "ZAR",
  "confirm": true,
  "capture_method": "automatic",
  "authentication_type": "no_three_ds",
  "setup_future_usage": "off_session",
  "payment_method": "card",
  "payment_method_data": {
    "card": {
      "card_number": "4200000000000091",
      "card_exp_month": "01",
      "card_exp_year": "32",
      "card_cvc": "123",
      "card_holder_name": "Test Holder"
    }
  },
  "customer": {
    "id": "cus_new_user_mrxzdvmq",
    "email": "newuser@example.com",
    "name": "New Customer",
    "phone": "+27123456789"
  },
  "description": "Server-to-Server card payment",
  "return_url": "https://example.com/flows/server-to-server-card?status=complete",
  "billing": {
    "address": {
      "line1": "123 Main Street",
      "line2": "Apartment 4B",
      "city": "Cape Town",
      "state": "Western Cape",
      "zip": "8001",
      "country": "ZA",
      "first_name": "John",
      "last_name": "Doe"
    },
    "phone": {
      "number": "821234567",
      "country_code": "+27"
    },
    "email": "john.doe@example.com"
  }
}
```

### 2. Handle 3DS (if required)

If authentication_type is "three_ds", the response will contain:

{
  "status": "requires_customer_action",
  "next_action": {
    "redirect_to_url": "https://..."
  }
}

Redirect the customer to the URL to complete 3DS authentication. After completion, they will be redirected to your return_url.

If authentication_type is "no_three_ds", this step is skipped and the payment is processed immediately.

### 3. Verify payment status — `GET /payments/{id}`

After 3DS completion (or immediately for no_three_ds), fetch the payment to verify its status.

Expected statuses:
• succeeded - Payment captured successfully
• requires_capture - Payment authorised (manual capture_method)
• failed - Payment was declined

The response also contains:
• payment_method_id - If setup_future_usage was set, use this for future charges
• customer_id - The customer the card was saved to

## Response

Payment endpoints return the payment object. Key fields to read:

- `payment_id` — the payment identifier.
- `status` — current payment status (see the state transitions below).
- `client_secret` — pass to the SDK to complete the payment client-side.
- `next_action` — present when a redirect or 3-D Secure challenge is required.

## Key parameters

- confirm: true - Single API call to create and process
- No SDK required - full card details sent server-side
- PCI compliance required for handling raw card data
- 3DS handled via redirect when authentication_type is 'three_ds'

## Flow diagram

```mermaid
flowchart LR
    A[POST /payments<br/>confirm: true] --> B{3DS Required?}
    B -->|Yes| C[Customer completes 3DS]
    C --> D[Verify Status]
    B -->|No| D
    D --> E{Status}
    E -->|succeeded| F[Payment Complete]
    E -->|requires_capture| G[Capture Later]
    E -->|failed| H[Handle Error]
```

## Payment state transitions

```mermaid
stateDiagram-v2
    [*] --> processing: Confirm Payment
    processing --> requires_customer_action: 3DS Required
    processing --> succeeded: No 3DS + Auto Capture
    processing --> requires_capture: No 3DS + Manual Capture
    processing --> failed: Declined
    requires_customer_action --> succeeded: 3DS Passed + Auto Capture
    requires_customer_action --> requires_capture: 3DS Passed + Manual Capture
    requires_customer_action --> failed: 3DS Failed
    requires_capture --> succeeded: Capture
    succeeded --> [*]
    failed --> [*]
```

---

Interactive version: https://playground.peachpayments.com/flows/server-to-server-card