juspay / juspay/hyperswitch

[FEATURE] Enable saving Customer Cards outside of payments

Open
#3,383 0 comments 0 reactions 1 assignee Claimed by @vspecky View on GitHub
A-core A-payment-methods C-feature
Dominant language
Rust
Stars
43.7k
Forks
5.1k
Avg merge
2d 21h
Merged PRs (30d)
210

Description

### Feature Description

Currently, the API to save a new card for a customer requires API key authentication i.e. the merchant server needs to know the raw card details of the customer when hitting the API. We need to update the flow such that this call can be made from the SDK on the customer's device, i.e. the merchant server never needs to touch the raw card details. This obviously requires an alternate authentication strategy since the merchant API key cannot be sent to the SDK.

### Possible Implementation

We can make use of Ephemeral Key Authentication to facilitate SDK calls. A brief description of the flow is as follows :-
1. Merchant server calls the Hyperswitch Ephemeral Key endpoint and generates a new ephemeral key.
2. Merchant server receives the Ephemeral Key from Hyperswitch and subsequently sends it to the SDK on the customer's device
3. The SDK collects the card details from the customer and hits Hyperswitch with Ephemeral Key Auth.

Since Hyperswitch ensures that the Ephemeral Key is temporary and for one-time use only for a particular customer, it is safe to accept the card details from the SDK.

### Have you spent some time checking if this feature request has been raised before?

- [X] I checked and didn't find a similar issue

### Have you read the Contributing Guidelines?

- [X] I have read the [Contributing Guidelines](https://github.com/juspay/hyperswitch/blob/main/docs/CONTRIBUTING.md)

### Are you willing to submit a PR?

Yes, I am willing to submit a PR!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.