Adobe Commerce (SOAP build) | Smartpay Fuse Developer Portal

Product Overview

Adobe Commerce creates engaging shopping moments that integrate both digital and physical experiences, with a leading commerce solution for merchants and brands. Adobe Commerce is a unified commerce solution that lets you manage all content and products in one place, whether you own more than one brand, sell in several countries, or use different business models.

With the Cybersource plugin for Adobe Commerce, enable simple and secure payments and fraud management solutions for your Adobe Commerce or Magento solution.

Adobe Commerce platform compatibility

Adobe Commerce (cloud): 2.4 (current), 2.2 (obsolete), 2.3 (obsolete)
Adobe Commerce (on-prem): 2.4 (current), 2.2 (obsolete), 2.3 (obsolete)
Magento Open Source: 2.4 (current), 2.2 (obsolete), 2.3 (obsolete)

PHP Compatibility – 8.4, 8.3, 8.2.

Please Note:
If you are updating your integration from version 3.5.9 or earlier, you will need to recreate certificates, as the certificate folder has moved from the root to the var directory.
If you are updating your integration from version 3.5.10 or earlier, make sure to run the command “composer require robrichards/wse-php robrichards/xmlseclibs” to install necessary libraries.

Integration Features:
- SOAP API
- Microform (our solution for hosted fields)
- Secure Acceptance Hosted Checkout
- 3DSecure
- Device ID
Channels:
- eComm (CNP)
- MOTO
- In-App
Payment Methods:
- Visa
- MasterCard
- Maestro
- American Express
- Discover
- Diners
- Apple Pay
- Google Pay*
- Visa Click-to-Pay
- Paypal
- Paypal Credit
- Klarna
Payment Functions:
- Authorisation
- Capture
- Sale
- Void
- Full Refund
- Partial Refund
- Full Reversal
- Follow on Credit
- Standalone Credit
- Token Management Services (CIT only)
- Account Updater Service
Fraud Management:
- Decision Manager
- Advanced Screening

Getting Started

Adobe Prerequisites

In order to use the Cybersource Extension for Adobe Commerce please make sure you have a working instance of Adobe Commerce or Magento.

View the Adobe Commerce Getting Started guide here - Getting Started | Adobe Commerce Getting Started Guide (adobe.com)
Set up an Adobe Commerce Account - Creating a Commerce Account | Adobe Commerce User Guide (adobe.com)
Log Into the Market Place (ensure you have created an access key, for details please see Adobe support documentation)

Smartpay Fuse has been created in partnership with VISA Cybersource. All features listed on this page are supported on the Smartpay Fuse platform. When you click through to download the plugin you may notice reference to the Cybersource brand and see some features that are not part of the Smartpay Fuse gateway. If you have any questions about this plugin or its feature set then please don’t hesitate to Get in Contact.

Smartpay Fuse Prerequisites

You will be able to configure this integration to either Test or Production. If you do not yet have a live Smartpay Fuse account, or you wish to first test the integration, then creating a sandbox account will not only allow you to start programmatic integration but also provides access to the Smartpay Fuse Portal.

Visit our sandbox creation page here.
Complete the registration form.
Click submit to create your sandbox account.

Note: on submitting your application, you will receive an automated email from our partner, Cybersource, with first time login and password reset instructions. Be sure to check your junk mailbox if this doesn’t arrive within 2 minutes of clicking Submit.

Generate REST Keys

Before configurating this integration, you are required to generate your REST keys within your Smartpay Fuse Portal for both (Live) and (Test).

Sign into your Smartpay Fuse Portal account (Live) or (Test).
Access Payment Configuration -> Key Management
Select the 'Generate Key' button in the top right hand corner
Select your key type as 'REST - Shared Secret' and Generate Key
Copy your Shared Secret Key values and save them securely

Generate SOAP Keys

In addition, you are required to generate SOAP .p12 keys within your Smartpay Fuse Portal for both (Live) and (Test).

Sign into your Smartpay Fuse Portal account (Live) or (Test).
Access Payment Configuration -> Key Management
Select the 'Generate Key' button in the top right hand corner
Select your key type as 'Simple Order API' and Generate Key
Select Download Key, and save a password
Complete the download, and save your key securely.

Obtain the extension

In the Magento Marketplace. search for 'Cybersource Payment Management Platform' to locate the extension or follow the direct link.
Select your Magento 'Edition' & 'Store version' i.e. 'Commerce on Cloud' and '2.4'
Add your selection to cart
Complete checkout*

Upon completion of the checkout you will be granted access keys by Magento to download these into your Magento instance please follow the remaining steps

*Although you're required to go through a checkout process the extension is free of charge and no card details are required to be saved within you Magento Marketplace account

Prepare your Magento Environment

You can now copy your Public and Private Keys into your Magento instance:

Go to My Profile -> My Products -> Access Keys
Select the Cybersource extension line
Copy both the Public and Private Keys
In your Magento instance rename auth.json.sample file to auth.json in the Magento root directory on your server, with the access keys from steps above.
Add the following code text to the auth.json file

                {
     "http-basic":{
        "repo.magento.com": {
            "username": "Your_Public_Key",
            "password": "Your_Private_key"
        }
    }
}

Open composer.json and add the following keys and values under the "require" array

                "version": "2.4.8-p3",
         "require": {
                "cyber source/global-payment-management": "3.5.11",
                "magento/composer-dependency-version-audit-plugin": "~0.1",
                "magento/composer-root-update-plugin": "^2.0.4",
                "magento/module-bundle-sample-data": "^100.4.*",
                "magento/module-catalog-rule-sample-data": "^100.4.*",
                "magento/module-catalog-sample-data": "^100.4.*",
}

Update, Compile & Deploy*

Now that you've prepared the environment you just need to import the code base through Composer. In order to do this run the following commands.

Note: While upgrading from any version of the plugin before v.3.5.11, make sure to run the command “composer require robrichards/wse-php robrichards/xmlseclibs” to install the necessary libraries.

*Please run the below lines individually

                composer require cybersource/global-payment-management
composer require cybersource/module-recaptcha
composer require robrichards/wse-php robrichards/xmlseclibs
php bin/magento module:enable CyberSource_AccountUpdater CyberSource_Core CyberSource_ApplePay CyberSource_Atp CyberSource_BankTransfer CyberSource_SecureAcceptance CyberSource_ECheck CyberSource_GooglePay CyberSource_KlarnaFinancial CyberSource_Address CyberSource_Tax CyberSource_ThreeDSecure CyberSource_PayPal CyberSource_WeChatPay CyberSource_Recaptcha
php bin/magento setup:di:compile
php bin/magento indexer:reindex
php bin/magento setup:upgrade
php bin/magento setup:static-content:deploy -f
php bin/magento cache:clean
php bin/magento cache:flush
php bin/magento module:status

You can now validate the install has been successful in two ways:

A Cybersource folder structure should now be visible under your 'Vendor' folder.
When accessing Stores -> Configuration -> Sales -> Payment Methods you will see the Cybersource configuration options

Initial Configuration

Although we have added flexible integration options, we recommend utilising our Microform solution for capturing card details, as this provides a full PCI-A Solution offering flexibility around your chosen UI.

General Settings -> Webservice Configurations

Enter your Merchant ID (Smartpay Fuse Organization ID)
Test Mode : If set to yes will point all transactions to TEST system (Please ensure you are using the correct credentials for the environment you're pointing to)

REST Settings

API Key Detail: Enter Key ID (Created in Step 1)
API Shared Secret Key: Enter Shared Secret Key (Created in Step 1)

Message Level Encryption

Enable Message Level Encryption: This is a security enhancement that is being introduced to Smartpay Fuse. Please reach out to Support to confirm if this is enabled for your merchant account.

Simple Order P12 Key File

Certificate File: Upload file (Created in Step 1)
Key Password: Enter your secret password (Created in Step 1)

Note: If you are upgrading from any version before v3.5.10, make sure to configure “Certificate File” and “Key Password” again and save the configuration. After saving, the certificate file will be stored in the var/certificates directory.

Credit Card Settings

Set Enabled to Yes
Set 'Title' to the value you would like card payments to appear under in your Store Front
Select Payment API as 'SOAP Toolkit API'
Select Checkout Flow Mode as 'Flex Microform'. If you elect to use Hosted Checkout, you will need to create a suitable Secure Acceptance profile.

Device Fingerprint Settings

Active: Set to Yes
Do not alter the masked value for Org ID. This value is populated by default.

Strong Customer Authentication

Enforce Strong Customer Authentication when saving a card: This is a requirement when transacting in certain regions, and should be set to Yes.
Enforce Strong Customer Authentication when not saving a card.

Security Best Practice Guidance

According to industry best practices, the hosting environment should enable rate limiting or implement a service like Cloudflare that will protect against a wide range of attacks.

As a starting point a merchant should have their environment setup with rate limits for all web applications and additional limits for the following endpoints:

/Cybersource3ds/cca/requestToken
- Limit to 5 POST requests per session per minute
- Limit to 20 POST requests per IP per minute for unknown networks
- Limit to 500 POST requests per IP per minute for known networks
/Cybersource/index/loadSilentData/
- Limit to 5 POST requests per session per minute
- Limit to 20 POST requests per IP per minute for unknown networks
- Limit to 500 POST requests per IP per minute for known networks
/Cybersource/index/placeorder/
- Limit to 5 POST requests per session per minute
- Limit to 20 POST requests per IP per minute for unknown networks
- Limit to 500 POST requests per IP per minute for known networks

These numbers are recommendations only, and each environment should be monitored on a high and average traffic volume day to determine the actual values of the rate limit that will not affect the consumer experience.

As additional security measures, the following could be done:

Implement reCAPTCHA as an option during checkout
Modify the payment module to allow for session / IP rate limiting in Magento web application

Further Information

Testing Guide landing page can be found here
Generic test card numbers (no 3DS) can be found here
3DS testing use cases can be found here
Information on PCI-DSS for each of the integration options can be found here