Re:PCI DSS Compliance
by fragmede on Monday December 16, 2024 @02:10AM
(#42428706)
The "other API" likely provides a better unique identifier for users or charges. Name + last 4 is mostly unique, but what are you going to do if a user changes credit card number because it was stolen so the old one doesn't work? Can't renew or refund them.
[ Parent
| on HN ]
Re:PCI DSS Compliance
by hockey_guy on Monday December 16, 2024 @11:13PM
(#42438263)
Various POS API. ex: Square, Toast, and Clover. They briefly mention tokenizing CC numbers but nothing publicly available afaik.
I'd hate to have to support all three of that at launch so I'll just like to Clover's. Clover's tokenization docs are https://docs.clover.com/dev/docs/create-a-card-token but you don't want to touch the cc number/PAN so as to avoid PCI, so the flow I imagine is you charge the customers card on the POS device, then use their API to retrieve the charge https://docs.clover.com/dev/reference/getorders which includes the charge and customer id, and store that.