The only PCI Compliant checkout mode for Authorize.Net is 3-Step Handshake.
Configuring AuthNet
The Authorize.Net account manager must provide their Public Client Key, API Login ID, and a Transaction Key in order to set up 3-Step Handshake in LearningBuilder.
AppConfig settings
Category | Setting | Notes |
|---|---|---|
Payment | EnableCreditCardValidation | If enabled, LearningBuilder does an algorithmic check on the credit card number before submitting to the gateway. (For instance, ensuring that Visa cards start with a “4”, and other card-specific checks) This setting is not used by any PCI-compliant setup, including 3-Step Handshake. This validation check is only possible if LearningBuilder has access to the raw credit card number. |
ManualPaymentDocumentationFileTypes | Types of files that can be uploaded as payment documentation. This should be a subset of images that can be converted to PDF. The product default should suffice, unless the client only wants to review specific file types. This configuration only matters if RequireAttachmentsWhenRecordingPayments is set to true. | |
PaymentAllowedCcTypes | List of allowed credit card types. This controls both what is visible on the checkout page. You must enter the values from the StringConstant attribute on the CreditCardTypesEnum. Invalid values are currently ignored. Valid values are listed in the CreditCardTypesEnum. AuthNet’s website says they accept AmericanExpress, Discover, JCB, MasterCard, Visa; but their developer documentation says they also accept DinersClub, so unless the client specifically only wants to accept certain credit cards, the default value should suffice. | |
PaymentCheckoutMode |
| |
PaymentDocumentationFileLibrary | Enables the “upload payment documentation” feature which allows users to upload a file (e.g. a scan of a check) when recording a manual payment. (See also RequireAttachmentsWhenRecordingPayments) Setting this to EMPTY disables this feature. If specified, this should be the ID of the File Library in which the documentation files will be stored. PER HEURISTICS POLICY, in PROD environments this must point to an encrypted File Library. WARNING: Once initialized to a non-empty value, changing this to point to a different library will cause the 'view documentation' link to vanish to any payments referencing the original library. This can be resolved by manually updating the pre-existing files to belong to the new library instead. Please consult with the technical support team before changing this setting from one library to another. | |
PaymentEnabled | This must be set to true in order to use AuthNet in LB. | |
PaymentGateway | Must be set to “AuthNet” | |
PaymentHistoryItemDisplayLimit | The number of transaction line items displayed on the payment history page before they get rolled up into 1 line item. The recommended limit is the default of 5. | |
RequireAttachmentsWhenRecordingPayments | Requires a user to upload payment documentation when manually recording a manual payment. Requires that PaymentDocumentationFileLibrary be set to a valid File Library ID. | |
ShoppingCartItemDisplayLimit | The number of shopping cart items displayed on the checkout page before they get rolled up into 1 line item. There doesn’t seem to be an actual numerical limit. However, the recommended limit is the default of 25. | |
VoucherUsageLockDurationInMinutes | The number of minutes that a Voucher code is locked as in-use when first selected for payment, to prevent multiple users from using the same code at the same time. Only used if Vouchers are in use. Recommended limit is the default of 30 minutes. | |
Payment - Authorize.Net | AuthNetApiLoginId | This is the merchant Account ID. |
AuthNetLiveUrl | The fully resolved URL for the Autorize.NET API service for LIVE Transactions This should stay as the product default. | |
AuthNetMerchantEmail | The email address used with Authorize.NET. Exact purpose unclear, but may be passed to AuthNet in some backend API calls. Most clients who use AuthNet either have it as the default or empty. | |
AuthNetMode | Determines whether transactions should be processed as Test transactions. Acceptable values are 'Test', 'Live' or empty. And what does this mean? Most using 3-step have it as Live, but some have it empty. Does it matter? Those using AuthNet but SecurePost have some defaulted to test, but I guess payments still work. What gives? | |
AuthNetPassword | The Password needed for logging into the Authorize.NET API How is this different from the transaction key? Is the product default fine? https://account.authorize.net/helpCP/Account/Settings/Security_Settings/General_Settings/API_Login_ID_and_Transaction_Key.htm ← According to this, there’s no such thing as an AuthNet password for the API. It’s only a transaction key. So what does LB mean when they ask for the Password? Are they actually asking for the merchant interface password (meaning that the tooltip is incorrect), or are they asking for access to the API and either I’m not finding the correct documentation OR this is just the same thing as the Transaction Key and the same information should be entered? See also: https://developer.authorize.net/hello_world/common_setup_questions.html#API_login | |
AuthNetPublicClientKey | This is the key that is used for the 'ThreeStep' payment checkout mode. Obtain key from Auth.Net Merchant Interface: Account > Settings > Security Settings > General Security Settings > Manage Public Client Key | |
AuthNetTestUrl | The fully resolved URL for the Autorize.NET API service for TEST Transactions This should stay as the product default. | |
AuthNetTransactionKey | Unique key provided by Client for using Authorize.NET API See AuthNetPassword question | |
AuthNetTransactionMethod | Determines the type of transaction. This value should always be “CC” | |
AuthNetTransactionType | Determines what actions Authorize.NET should take with the information provided. This value should be set to AUTH_CAPTURE unless client has specifically requested another method. Acceptable values are AUTH_CAPTURE or AUTH_ONLY | |
AuthNetVersion | The version of the Authorize.NET API that should be used. This should stay as the product default; it will only be updated if LearningBuilder is updated to use a newer version of the AuthNet integration. |
The only PCI-compliant mode supported by AuthNet is “ThreeStep”Configurations for 3-Step Handshake (LB Version 10.5.1)
PaymentCheckoutMode
This must be set to ThreeStep in order to use 3-Step Handshake.
AuthNetPublicClientKey
This must be entered before 3-Step Handshake can be enabled. The client will need to provide the public client key. They can find it through their Auth.Net Merchant Interface: Account > Settings > Security Settings > General Security Settings > Manage Public Client Key.
AuthNetMode
This must be set to Live in order to use 3-Step Handshake.
AuthNetApiLoginId
This is the Account ID that the client will need to provide in order to log in to the Authorize.NET API. This should already be configured if the client is using AuthNet.
AuthNetPassword & AuthNetTransactionKey
This is the Account Password that the client will need to provide in order to log in to the Authorize.NET API. This should already be configured if the client is using AuthNet.