[FEATURE] Enable saving Customer Cards outside of payments
- Dominant language
- Rust
- Stars
- 43.7k
- Forks
- 5.1k
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 210
Description
### Feature Description
Currently, the API to save a new card for a customer requires API key authentication i.e. the merchant server needs to know the raw card details of the customer when hitting the API. We need to update the flow such that this call can be made from the SDK on the customer's device, i.e. the merchant server never needs to touch the raw card details. This obviously requires an alternate authentication strategy since the merchant API key cannot be sent to the SDK.
### Possible Implementation
We can make use of Ephemeral Key Authentication to facilitate SDK calls. A brief description of the flow is as follows :-
1. Merchant server calls the Hyperswitch Ephemeral Key endpoint and generates a new ephemeral key.
2. Merchant server receives the Ephemeral Key from Hyperswitch and subsequently sends it to the SDK on the customer's device
3. The SDK collects the card details from the customer and hits Hyperswitch with Ephemeral Key Auth.
Since Hyperswitch ensures that the Ephemeral Key is temporary and for one-time use only for a particular customer, it is safe to accept the card details from the SDK.
### Have you spent some time checking if this feature request has been raised before?
- [X] I checked and didn't find a similar issue
### Have you read the Contributing Guidelines?
- [X] I have read the [Contributing Guidelines](https://github.com/juspay/hyperswitch/blob/main/docs/CONTRIBUTING.md)
### Are you willing to submit a PR?
Yes, I am willing to submit a PR!
Contributor guide
Assessment
This issue has not been assessed yet.