[Go to site: main page, start]
Skip to main content

​
Overview

Every integration must be reviewed and certified by the ECRYPT engineering team before processing live transactions. Certification confirms that your implementation handles payment flows correctly, meets compliance requirements, and avoids common issues that can cause problems in production. The process has three stages: prepare your integration in sandbox, schedule a certification call with our engineering team, and cut over to production once approved.

​
Before You Schedule

Work through the checklist below in your sandbox environment. Completing these items before your certification call keeps the review focused and avoids delays.

​
Test Core Payment Flows

Run each of the following transaction types end-to-end and confirm you receive the expected response codes:
If your integration only handles initial transactions (sales, authorizations) and you plan to manage refunds, voids, and captures through the ECRYPT dashboard, let us know when scheduling your certification call.
If your integration accepts ACH payments, also test a sale and refund using the check payment object.

​
Test Entry Points

Certification requirements vary depending on how you accept payments. Make sure you test every entry point your integration uses:

​
Verify Error Handling

Trigger common failure scenarios and confirm your integration handles them gracefully:
  • Declined transactions. Submit a transaction that returns a decline and verify your UI communicates the result clearly to the end user.
  • Validation errors (400). Send a malformed request (missing required fields, invalid values) and confirm you parse the errors array from the response.
  • Authentication failures (401/403). Attempt a request with an invalid or missing API key and verify you do not expose raw error details to end users.

​
Confirm Webhook Delivery

If your integration relies on webhooks:
  1. Register your webhook endpoint in the ECRYPT dashboard.
  2. Process at least one transaction and confirm the webhook payload is received.
  3. Verify your endpoint returns a 200 response promptly.
  4. Test your handling for relevant event types (transaction approved, declined, refunded, voided).

​
Review Compliance Basics

  • PCI scope. Confirm you understand your PCI obligations based on your integration method. If you tokenize via the hosted iframe or checkout page, your server never handles raw card data. If you tokenize server-side via POST /v1/tokens with raw card numbers, your environment must meet SAQ D requirements and provide ECRYPT a copy of your AOC.
  • Surcharging. If surcharging is enabled on your account, verify that surcharge amounts display correctly to the cardholder before they confirm the transaction. ECRYPT automatically drops surcharges on debit and prepaid cards via BIN lookup. You are responsible for complying with your states surcharging laws.
  • Stored credentials. When charging a customer wallet for recurring or installment payments, make sure initiatedBy is set correctly (0 for merchant-initiated, 1 for customer-initiated).

​
Schedule Your Certification Call

Once you have completed the checklist above, contact the ECRYPT engineering team to schedule your review:

Schedule Certification

Email your account manager or devsupport@ecrypt.com with:
  • DBA Name
  • Brief description of your integration
  • Supported features (iFrame, terminals, subscriptions, etc.)
The engineering team will coordinate a time to walk through your integration together.

​
What Happens During the Call

The certification call is a live review where an ECRYPT engineer works through your integration with you. Expect the session to cover:
  1. Transaction walkthrough. You will run each of the core payment flows (sale, refund, void, authorize, capture) while the engineer monitors the requests and responses on the ECRYPT side.
  2. Error handling review. The engineer may trigger specific decline codes or error conditions to confirm your integration responds appropriately.
  3. Compliance check. The engineer reviews how you handle sensitive data, display surcharges (if applicable), and manage stored credentials to ensure there are no compliance risks.
  4. Edge cases. Depending on your integration type, the engineer may check scenarios like partial refunds, duplicate transaction prevention, webhook retry handling, or terminal connectivity recovery.
  5. Feedback. If any issues are found, the engineer will walk through what needs to change. Minor issues can often be resolved and re-tested on the same call.
Most certification calls take 30 to 60 minutes depending on the complexity of the integration.

​
After Certification

Once the ECRYPT engineering team approves your integration:

​
Switch to Production Credentials

Replace your sandbox API keys with your production API keys. Your production keys are available in the ECRYPT dashboard under Settings > API Keys.
Never use sandbox keys in production or production keys in sandbox. Sandbox transactions are simulated and will not process real payments.

​
Run a Live Verification

After switching to production credentials, run a small live transaction (such as a $1.00 sale followed by a void or refund) to confirm your production configuration is working end to end.

​
Register Production Terminals

If your integration uses in-person terminals, you must register each terminal in the production environment. Terminal registrations do not carry over from sandbox.

​
Update Webhook URLs

If you registered sandbox webhook URLs, update them to point to your production endpoints.

​
Need Help?

If you have questions about certification requirements or need to reschedule your review, visit the Developer Support page.