LearningBuilder can collect payments from end-users in many different ways. Adding integrations for gateways not listed here is generally possible with minor innovation.
Overview
LearningBuilder itself does not handle credit card transactions. Instead, it integrates with a variety of payment processing systems to handle those transactions.
In order to process payments, clients must have an existing merchant account with a supported gateway. If no existing merchant account exists we can assist with the setup, but the merchant account itself is a relationship between the client and their financial institution.
For more information on establishing a merchant gateway, see below.
Supported Gateways
Payflow Payments Pro | This service uses PayPal as the payment gateway and payment processor. PayPal performs all transaction processing prior to depositing into the client's merchant account. Customers using Payflow Payments Pro sign up for PayPal Pro service, which is around $30/month (as of July 2012). PayPal Payments Pro uses the concept of a "sandbox" for performing test transactions and a separate, live site. Payment processing is available through Secure Post mode but refund processing through LearningBuilder is not supported. As of February 2021, this gateway is disallowed by policy because it does not support a PCI-compliant payment option. This gateway will be fully removed from the software in an upcoming release. |
Payflow Pro | This service uses PayPal as the Payment Gateway but uses a third party payment processor. This interface is the result of PayPal's purchase of Verisign, which first developed the Payflow Pro product. PayPal now uses it for advanced interfaces that use other payment processors. Payments and refunds are both functional, and are supported in both the Secure Post and Hosted Pages iFrame Checkout configurations. Required Configuration: The client’s gateway account must be configured to use the “Silent Post” feature to prevent orphaned payment records in LearningBuilder. In the Payflow Pro Manager site, configure the account like so:
See PayflowPro Silent Post for more details. As of February 2021, using this gateway in “Secure Post” mode is disallowed by policy because it does not support a PCI-compliant payment option. Use “Hosted Pages” mode instead. The “Secure Post” mode will be removed from the software in an upcoming release. Please use LearningBuilder version 11.0.1 and greater in the 11.0.x LTS Release Branch series. Previous versions of LearningBuilder are at risk of allowing duplicate payments or improper error handling. |
Authorize.Net | Authorize.Net is an alternative gateway to PayPal. If the organization has already established a relationship with Authorize.Net and wishes to use this gateway, LearningBuilder can be configured to support it. Payment processing is available but refund processing through LearningBuilder is not supported. This Payment Gateway is functional in Secure Post and 3-Step Handshake Checkout Modes. As of February 2021, using this gateway in “Secure Post” mode is disallowed by policy because it does not support a PCI-compliant payment option. Use “3 Step Handshake” mode instead. The “Secure Post” mode will be removed from the software in an upcoming release. Please use LearningBuilder version 11.0.3 and greater in the 11.0.x LTS Release Branch series. Previous versions of LearningBuilder are at risk of allowing duplicate payments or improper error handling. |
Moolah | Moolah is an alternative gateway which is focused on Non-Profit organizations. The support of this gateway was introduced in LearningBuilder 8.10 and is only functional in the 3-Step Handshake Checkout Mode. Please use LearningBuilder version 11.0.3 and greater in the 11.0.x LTS Release Branch series. Previous versions of LearningBuilder are at risk of allowing duplicate payments or improper error handling. |
USAePay | USAePay provides a number of payment solutions. Currently, LearningBuilder supports the "2-Step Client-Side" mode only for this gateway. Please use LearningBuilder version 11.0.3 and greater in the 11.0.x LTS Release Branch series. Previous versions of LearningBuilder are at risk of allowing duplicate payments or improper error handling. |
Alabama Interactive | Alabama Interactive is a payment gateway used by licensing agencies in Alabama. It offers both a “Hosted Pages” and “Hosted Pages iFrame” option, but LearningBuilder only supports the “Hosted Pages” mode at this time. Required Configuration: The client’s gateway account must be configured to use the “Postback Service” feature to prevent unrecorded payments in LearningBuilder. For more information, see the configuration page. Unlike Payflow Pro, Alabama Interactive does not have a way to guarantee against unrecorded payments. If an error occurs while notifying LearningBuilder of a successful transaction, they will retry a set number of times and then send an email. We recommend using one of the other gateways instead that offer more robust protections against unrecorded payments in LearningBuilder. Please use LearningBuilder version 11.0.1 and greater in the 11.0.x LTS Release Branch series. Previous versions of LearningBuilder are at risk of allowing duplicate payments or improper error handling. |
Gateway / feature support matrix
Payment gateways support different features. If a feature is not supported, it may be because the gateway does not support it 
, or we have not added support in LearningBuilder for that feature in the gateway 
.
Vendor |
| Checkout Modes | Supported Features | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Secure | Hosted | Hosted | 3 Step | 2 Step | Full | Partial | GL | Discount | Responsible Party ‘Pending’ Payments (aka Bulk Employer Payments) | Organization ‘Bulk’ Payments | (Legacy) Learning Plan Task Payments | |||
Payflow Payments Pro - NOT SUPPURTED AS OF NOV. 2021 | PayPal |
|
|
|
|
|
|
|
|
|
|
|
|
|
Payflow Pro | PayflowPro |
|
|
|
|
|
|
|
|
(Added with 10.0 Release) |
( |
|
|
|
Moolah | Moolah |
|
|
|
|
|
|
|
|
|
|
|
|
|
Authorize.Net | AuthNet |
|
|
|
|
|
|
|
|
( |
|
|
|
|
USAePay | USAePay |
|
|
|
|
|
|
|
|
|
|
|
|
|
Alabama Interactive | AlabamaInteractive |
|
|
|
|
|
|
|
|
|
|
|
|
|
Checkout Modes
The CheckoutMode App Config setting controls the user’s experience during checkout.
For more information about PCI Compliance for each gateway, see the Compliance docs
Method | App Config value for
| Description / PCI Compliance |
|---|---|---|
Secure Post |
| Payment forms are hosted by LearningBuilder. Payment card data is transmitted to LearningBuilder, which then submits the payment transaction to the gateway. This mode is not PCI compliant and is disallowed by policy in 10.6.0 and later. It will be removed from the software in a future version. |
Hosted Pages |
| When the user begins checkout, their browser is redirected to the payment gateway’s website. The credit card form is hosted by the gateway and the entire transaction occurs externally to LearningBuilder. The user is redirected back to LearningBuilder after the transaction is complete. This approach is secure because LearningBuilder is entirely removed from the checkout process and has no opportunity to collect or transmit payment card data. The main drawback to this approach is that the payment gateway’s checkout form often does not look exactly like LearningBuilder, resulting in a disjointed user experience. On the other hand, innovations made by the gateway to their checkout experience (such as adding support for new payment types) can be immediately available to end users without requiring changes to LearningBuilder. |
Hosted Pages |
| This is similar to Hosted Pages, except that instead of redirecting the user to a 3rd-party checkout process, the 3rd-party checkout form is displayed in an iframe within LearningBuilder. This often results in a more seamless user experience because the user never leaves the context of the LearningBuilder site. This approach is secure because the credit card form is hosted by and submitted to the payment gateway. LearningBuilder is not involved in the collection or processing of credit card data in any way. |
2 Step Client-Side |
| In this mode, the checkout process is implemented within LearningBuilder except for the credit card processing. When the user submits the form containing credit card data, the form submits directly to the payment gateway which handles the transaction and then redirects the user back into LearningBuilder. This mode provides a mostly seamless checkout experience, except that LearningBuilder cannot display a “checkout confirmation” page after the credit card data is entered but before processing the transaction. The card data is submitted directly to the gateway, so the confirmation page, if any, must be handled by the gateway as well. This approach is secure because the credit card form, though hosted by LearningBuilder, is submitted directly to the gateway for processing. Credit card data is not submitted to or transferred by LearningBuilder in any way. See the USAePay documentation for more information |
3-Step Handshake |
| After the user enters their credit card information, LearningBuilder submits that data directly to the payment gateway as a background post. The user’s browser does not navigate away from LearningBuilder. The gateway securely stores the credit card data, without processing a transaction, and returns a token that can be used to reference those saved credentials at a later time. The user then finishes the checkout process in LearningBuilder, which includes a “checkout confirmation” page. Once the user confirms their intent, LearningBuilder makes a second background post to the gateway. This post includes the transaction details (amount, etc) plus the token that was received earlier. The payment gateway then uses the stored card data to complete a transaction. This approach provides a seamless user experience without sacrificing security. It is the recommended approach for many customers. This approach is secure because no credit card data is submitted to or processed by LearningBuilder in any way. The credit card data is submitted directly to the gateway, which then gives LearningBuilder a secure, one-time-use token for referring to those credentials at a later time. This token cannot be used to “reverse engineer” or compromise the card details. For more information on this methodology, see this link |
PCI Compliance
As of 10.6, LearningBuilder does not support any payment gateways or checkout modes in which payment card data is transmitted to or processed by LearningBuilder. In order to maintain PCI compliance, LearningBuilder cannot have anything to do with credit card details.
Each of the supported gateways conforms to this requirement in a different way, which is documented above.
Additionally, the following implementation details are necessary for PCI Compliance:
The
EnableCreditCardValidationApp Config setting is deprecated and has no impact on a PCI-compliant payment gateway. The credit card data is transmitted directly to the payment gateway and is not examined by LearningBuilder in any way.When using the BACK button to navigate backward from the Review page to the Checkout page, the credit card information is not persisted and must be re-entered.
Obtaining an Internet Merchant Account
To accept credit cards over the Internet, you need a special account called an Internet Merchant Account. If PayPal is your merchant bank, you do not need the Internet Merchant Account. Your account provider or merchant (acquiring) bank works with a PayPal-supported credit card processor. Examples are First Data, TSYS Acquiring Solutions (formerly Vital Processing Services), and Paymentech. To accept live credit cards, provide details about your account to PayPal during the "Go Live" part of enrollment.
An Internet Merchant Account is a different type of merchant account. It has additional risks associated with card-not-present (e-commerce) transactions. It is different from a merchant account used for face-to-face/card-present (in-person) retail transactions. Obtain an Internet Merchant Account even if you already accept credit cards at your location. To apply for an Internet Merchant Account, contact your merchant (acquiring) bank.
The high-level testing of the Payment Gateway setup process is as follows:
On a LearningBuilder™ support site, set up the Payment Gateway in a test mode.
Attempt an invalid payment (using an expiration date in the past)
Attempt a valid `payment (using the special credit card number)
On the LearningBuilder™ support site, set up the Payment Gateway in a live mode.
Attempt an invalid payment (using an expiration date in the past)
Attempt a valid payment (using a real credit card and a small payment amount; e.g. $0.02)
On the LearningBuilder™ live site, set up the Payment Gateway to match the support site.
Attempt an invalid payment (using an expiration date in the past)
On the LearningBuilder™ support site, set the Payment Gateway back into a test mode.
The Fake gateways support three simulated responses:
FirstName = "MissingId": This will result in an Approval but no Transaction ID
FirstName = "Decline": This will result in a Declined status.
FirstName = Anything else: This will result in an approval.
Testing a payment gateway integration
Testing payment gateway settings
If you append "Fake" to the end of the PaymentGateway app config value, the system will simulate connecting to the gateway without actually doing so. This is useful when testing in a non-production environment.
Known Issues / Observations
This document outlines known issues, outstanding items, or extra notes as they relate to ALL payment gateways. For gateway-specific documentation, refer to Payment Gateway-specific documentation.
In an isolated circumstance, a user is able to create duplicate transactions in AuthNet, USAePay, and Moolah. This issue has been resolved in 11.0.3. See LB-2716 - Getting issue details... STATUS
If a Payment Attribute is added to a role grant workflow with a success action that grants the role, successfully completing the payment does not redirect the Practitioner to an auto-started Learning Plan Instance (LPI). This is counter to the expected case, where normally granting oneself a role will redirect the Practitioner to the LPI associated with that role if the Learning Plan Definition is set to “automatically begin when eligible.” See LB-2653 - Getting issue details... STATUS
There is a small window of time within the ThreeStep Checkout Mode where a duplicate payment is possible. Refer to Duplicate Payments within Moolah and Duplicate Payments within Authorize.net for more information.