Prior to attempting to process a transaction the host website must complete authentication with the DNA platform. The authentication process is unique for each transaction and utilises the test account credentials which are supplied following the configuration of the merchant test account, namely;

  • TerminalID
  • ClientID
  • ClientSecret

Authentication POST - Request

Authentication is completed via a POST request to the test URL shown below.

Security Risk

The “client_secret” must always be stored securely. Do not send authorisation requests from the front-end as the user could access the data via the web browser’s console.

The POST must contain the below data.

Authentication Request
Field NameStateData TypeDescription
grant_typeMandatoryStringAuthorisation type required to confirm the action required.
  • client_credentials Obtain credentials required to process a transaction.
scopeMandatoryStringConfirm scope of the action to be performed with credentials.
  • payment integration_hosted Full re-direct.
  • payment integration_embedded JavaScript Lightbox - content delivered via iFrame.
  • payment integration_seamless JavaScript Lightbox - content hosted on merchant site.
  • webapi Transaction management.
payment integration_seamless must be used if you are using our Hosted Fields solution.
client_idMandatoryStringProvided to the integrator following the successful creation of a test account.
client_secretMandatoryStringProvided to the integrator following the successful creation of a test account.
invoiceIdMandatoryStringOrder/invoice/transaction/basket number generated by the host website. This ID must be unique for this transaction.

This value must not contain any Personally Identifiable Information such as a vehicle registration number or cardholder name. See the warning below for more details.

We recommend simply generating a UUID/GUID.
amountMandatoryDecimalTotal amount of the order including decimal places where applicable. ‘Whole’ amounts (e.g. “1”) on a GBP account will be processed as £1.00.
currencyMandatoryStringCurrency of the transaction.
GBPPound Sterling
terminalMandatoryStringProvided to the integrator following the successful creation of a test account.
Personally Identifiable Information

In the invoiceId field above, you are free to pass a wide variety of data. You must however be careful to not include any Personally Identifiable Information. This can include vehicle registration details, cardholder name, and many other data. Please refer to European General Data Protection Regulations (Article 4) for detailed guidance on what should not be included here.

Security Risk

Authentication POST - Response

Following the receipt of a correctly formatted authorisation POST the DNA platform will respond with the below.

Field NameData TypeDescription
access_tokenStringAccess token provided by the DNA platform for this transaction. The token should be securely stored ready to be used in the transaction request.
expires_inIntegerNumber of seconds from generation until the access_token expires. If the token is not used before this time has passed a new token will need to be requested.
refresh_tokenStringReserved for future use.
scopeStringConfirmation of the scope(s) passed in the authorisation request.
token_typeStringType of token issued
BearerBearer token

Example Request and Response

Example: Authentication Request (NodeJs)
var request = require("request");
var options = {
method: 'POST',
url: '',
scope: 'payment integration_hosted',
client_id: 'ExampleShop',
client_secret: 'mFE454mEF6kmGb4CDDeN6DaCnmQPf4KLaF59GdqwP',
grant_type: 'client_credentials',
invoiceId: '1234567',
amount: '1',
currency: 'GBP',
terminal: 'b95c9d1f-132f-4e04-92d2-32335c7486ea'
request(options, function (error, response, body)
if (error) throw new Error(error);

Direct or Widget

You can choose how to initiate the payment for the cardholder. A simple 'Pay Now' button would be via our Direct Integration. The Widget approach is slightly more complex, but allows you to render multiple Payment Methods, within your Checkout page.

Direct Example

You include a simple button that calls the payment function.

Lightbox Example
The payment window is generated when it is clicked.
In this case, it is a Lightbox/iFrame but you can do a page redirect if desired.


It is possible to support Additional Payment Methods via the Direct approach. These will be rendered in the Lightbox or Redirect.

Best Practice

Unless you are planning on using more than one Payment Method e.g. Klarna, Google Pay, PayPal, then the Direct Integration is likely to be the quickest and easiest approach. Additional Payment Methods via the Direct approach will require an additional button click by the Customer.