Digital Wallet Tokenization
What is Tokenization?
Usage of tokens in the digital payment world was designed to replace sensitive data with a non-sensitive digital data equivalent. This tokenization process is a way to protect your cardholder sensitive data by exchanging it with secure data, called a token. The sensitive data includes a 16 digit card number, card verification number, and card expiry date which must be exchanged with a digital token that serves as a unique reference to the card. This token will be used by Digital Wallet providers (e.g. Apple Pay, Google Pay) to initiate the authorization request to the card network, and it will be used by the card network to lookup the card information before they send it to the issuer institution.
Provisioning Token
BUILD supports 2 methods for provisioning a token, which is to provision a payment card into a token within the digital wallets.
Direct Provisioning
This method allows your customer to enter the card data directly into the digital wallet in their mobile or wearable device. It requires your customer to type in card information or take a photo of a physical card.
Push Provisioning via your mobile app
This method allows seamless provisioning. It requires you to develop the SDK for various mobile operating systems. You can use BUILD developed iOS and Android SDKs to reduce your development timeline. Implementing the BUILD SDKs enables your mobile application to directly interact with Google/Apple SDK. However, you still need to go through APP certification required by Apple/Google before actual provisioning.
NOTE: Apple or Google has their own timeline on the certification process of your mobile app. You need to manage it directly with Apple or Google.
Google:Launch process | Google Pay Push Provisioning API for Android | Google for Developers
Google Pay Push Provisioning
BuildAndroidSDK helps Mobile app developers to easily implement Add to Google Pay button in mobile banking applications.
SDK can enable cardholders to provision their card details from their mobile app to their device's payment wallet in a simple, secure way, eliminating the need to enter their card information manually.
The SDK is intended to be embedded into the mobile application(s). Whereas the mobile app provider is in charge of the app's user experience, the SDK allows clients to take advantage of Build's infrastructure.
Set up BuildAndroidSDK so that you can add cards to Google Pay.
Getting started with the Android SDK requires the below steps.
Step 1 : Get the Build SDK
Add the build-googlepay-wallet.aar to the app/libs directory
repositories {
flatDir {
dirs 'libs'
}
}
dependencies {
implementation(name: 'build-googlepay-wallet', ext: 'aar')
implementation 'com.google.code.gson:gson:2.8.9'
}
Network permissions need to be enabled
Proguard
The following Proguard Keep rules have to be added to the application
-keep class com.buildfinancial.gp.sdk.** {
public <fields>;
public <methods>;
}
-keep class com.buildfinancial.gp.model.JsonBean
-keep @com.buildfinancial.gp.model.JsonBean class * {
*;
}
-keep class com.google.**{*;}
-keepclassmembers class * implements java.io.Serializable {
static final long serialVersionUID;
private static final java.io.ObjectStreamField[] serialPersistentFields;
private void writeObject(java.io.ObjectOutputStream);
private void readObject(java.io.ObjectInputStream);
java.lang.Object writeReplace();
java.lang.Object readResolve();
}
##---------------Begin: proguard configuration for Gson ----------
# Gson uses generic type information stored in a class file when working with fields. Proguard
# removes such information by default, so configure it to keep all of it.
-keepattributes Signature
# For using GSON @Expose annotation
-keepattributes *Annotation*
# Gson specific classes
-dontwarn sun.misc.**
#-keep class com.google.gson.stream.** { *; }
# Application classes that will be serialized/deserialized over Gson
-keep class com.google.gson.examples.android.model.** { <fields>; }
# Prevent proguard from stripping interface information from TypeAdapter, TypeAdapterFactory,
# JsonSerializer, JsonDeserializer instances (so they can be used in @JsonAdapter)
-keep class * extends com.google.gson.TypeAdapter
-keep class * implements com.google.gson.TypeAdapterFactory
-keep class * implements com.google.gson.JsonSerializer
-keep class * implements com.google.gson.JsonDeserializer
# Prevent R8 from leaving Data object members always null
-keepclassmembers,allowobfuscation class * {
@com.google.gson.annotations.SerializedName <fields>;
}
# Retain generic signatures of TypeToken and its subclasses with R8 version 3.0 and higher.
-keep,allowobfuscation,allowshrinking class com.google.gson.reflect.TypeToken
-keep,allowobfuscation,allowshrinking class * extends com.google.gson.reflect.TypeToken
The Android SDK is compatible with apps supporting Android API level 21 and above.
Step 2 : Get the Google Push Provisioning API SDK
Google Push SDK currently uses version 18.3.3, please download it according to Google documentation.
Set up your environment | Google Pay Push Provisioning API for Android | Google for Developers
Step 3 : Configure the SDK into your app
Use the getInstance() method to create an instance of GooglePaySDK, which enables the provisioning features.
To configure SDK in your app, initialize the SDK by using the initialize(application,uid,customerId,secretKey,deviceId,debug,sdkInitResultListener) method. sdkInitResultListener ->onInitResult Returns the initialization result
MainActivity.googlePaySDK = GooglePaySDK.getInstance()
MainActivity.googlePaySDK?.initialize(
MyApplication.instance(),
uid, customerId, secretKey, deviceId, debug,
object : SdkInitResultListener {
override fun onInitResult(p0: Boolean, p1: BaseResult?) {
if(p0){
//success
}
}
})
NOTE: This can be initialized any part of the app, ideally after having the below details
- uid: Unique identifier for Build (required).
- customerId: Customer identifier (required).
- secretKey: Api key, from server side, following Get secret (required).
- deviceId: The deviceId should match the deviceId used to generate the secret (required).
- debug: YES for testing mode, NO for production.
Also, override the onActivityResult method in your app and call the GooglePaySDK onActivityResult method in the same activity where you initialize it.
override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
super.onActivityResult(requestCode, resultCode, data)
MainActivity.googlePaySDK?.onActivityResult(requestCode, resultCode, data)
}
NOTE: In SDK, if BaseResult code returns 430, it means the secret has expired, please get it again and restart SDK.
class BaseResult {
public int code;
public String msg;
}
Step 4 : Check the wallet
Use checkWallet(Activity activity, CheckWalletListener checkWalletListener) method. Check the active wallet to make sure it exists, if it doesn't, create a wallet.
If onCheckWalletListenerSuccess returns, check wallet status successfully.
Step 5 : Verify if card added to wallet
Use checkIfCardIsAddedToWallet(card_id, singleCardResultListener) method. This method is used to check whether provisioned tokens(Added to google pay wallet or not) are present or not.
If onCardAddedStatusSuccess returns true, has been added to the wallet. Returns false, has not been added to the wallet
If onCardAddedStatusFailure returns, the query failed.
Step 6 : Adding the card to the wallet (provisioning)
Use addToWallet(card_id, activity, pushProvisioningResultListener) method.This method is used to add cards to the wallet.
If onPushProvisioningSuccess returns, the operation was successful.
If onPushProvisioningFailure returns, failed.
If onTokenGetFailure returns, failed to get card token.
Retrieve Card Profile Information
Use the getCardProfile(card_id, CardProfileResultListener cardProfileResultListener) method. The onCardProfileResult callback will be triggered to return the query results.
{
“card_id”: "string",
“profile_name”: "string",
“card_img_url”: "string"
}
Card Details Retrieval
The SDK includes a function that allows querying the full Primary Account Number (PAN) using the cardId.
To query the card details, use the getCardDetails(card_id, phone_last4, CardDetailsResultListener cardDetailsResultListener) method. The onCardDetailsResult callback will be triggered to return the query results.
{
“pan”: "string",
“cvv”: "string",
“expiry”: "string",
“holder_name”: "string"
}