Getting started

Getting started - overview of Barion payments

Time needed

Working with the Barion API is a no-brainer. Depending on the circumstances (your needs, business expectations, system architecture, business process management and available resources), you can integrate Barion within a few hours. Typically though the basic integration and testing are accomplished in a couple of days.

IMPORTANT

We recommend reading the documentation first. As developers, we are very much aware that you prefer jumping in, but consider that as a payment system, implementing Barion requires discipline. Also, we would rather spare you any unnecessary hassle.

Feature overview

Barion is a provider of online electronic payments. Our payment services include:

• payment with debit and credit cards
• payment with prepaid Barion wallet

We have several payment solutions, based on the above payment types:

• Responsive Web Payment, which works in desktop and mobile browsers
• Mobile App Payment, which works in native mobile apps in two scenarios:
  • If the Barion Mobile App is installed on the customer's device, a simple and quick payment works with the Barion Mobile App
  • If the Barion Mobile App is not installed on the customer's device, the Responsive Web Payment solves the payment

The payment process

Paying through the Barion Smart Gateway follows these simple steps:

1. Customer chooses to pay.
2. The merchant's server initiates the payment by calling the /Payment/Start API and using POSKey for authentication. Barion returns a Payment ID. Shop records the transaction.
3. Merchant's website redirects the user to the Barion payment gateway UI, which can be either:
   1. A responsive web user interface.
   2. The Barion mobile app, if the customer uses their mobile for the purchase and the Barion app is installed. Our app is available on Android and iOS platforms.
4. The customer completes the payment.
   1. If the customer has no Barion account, they must provide card data.
   2. If the customer has a Barion wallet (account), they log in and can choose to pay using a card on file, a new card, or alternatively from their Barion balance.
5. In case of a change in the payment status (e.g. successful payment happened or the customer rejected the payment), the Barion server notifies the shop. Upon receiving the notification the shop must call /Payment/<PaymentId>/PaymentState to see if the payment was successful or not.
6. The merchant's server records the result of the transaction.
7. The user is redirected by Barion to the merchant's return URL.

Flow of funds

• Guest payment with card – available for any cardholder with a card capable of making VPOS payments. The debit or credit card is charged and the merchant's Barion account is topped up with the equivalent amount. No need for Barion registration or previous top-up.

• Payment with card on file – available for any card holder with a card capable of making VPOS payments that previously registered with Barion and chose to store card data in their Barion wallet. The debit or credit card is charged and the merchant's Barion account is topped up with the equivalent amount. Card data is stored in a PCI DSS-compliant card vault. No CVC is stored. No need for a previous top-up.

• Payment with prepaid Barion balance – available for any user that previously registered with Barion and has a balance in their Barion wallet. Money is transferred to the merchant's account. This payment does not involve cards. Customer wallets can be topped up via bank transfer.

• Top-up – available for all Barion users from a bank account. By wiring funds to Barion with a personal top-up code in the comment, Barion balance is topped up in the appropriate currency.

• Withdrawal - available for all Barion users. Funds are transferred from a Barion wallet to any bank account via wire transfer.

Extra services

We also provide extra services that can be combined with the above payment technologies:

• Token payment for automatic payments, such as One-Click or recurring payments
• Sharing economy features, such as:
  • Payment to 3rd parties or C2C (Consumer to Consumer) payments
  • Deducting commission from C2C payments
  • Escrow services for C2C payments

Other services augmenting the above payments:

• Refunding payments to the original funding source (card or balance) from GUI or API
• Withdrawing funds to bank accounts from GUI or API
• Free and real-time money sending between Barion accounts from GUI or API

Sandbox and live

Barion maintains a clone of the live Barion secure server as a sandbox or test environment, where developers can experiment with their solutions. The sandbox works with "test" money instead of real, so there is no risk when playing around. Sandbox is open, all you need is to register, read the documentation and you can start playing. For more information on differences in the live and sandbox servers, read Setting up the Sandbox environment and testing payments.

Skills and tools required

All you need is an intermediate level of web back-end development with the ability and tools to call a REST API. Although there are no specific competency or tool requirements, an up-to-date development environment, and toolbox is essential. We balance compatibility and security when picking which latest technology to use. For more information, read Calling the Barion API.

Supported currencies

The list of currencies supported by Barion.

To use the Barion Smart Gateway and the Barion API in a given currency, you must have an active account with that currency.

SSL

Barion servers use https:// protocol to communicate. We recommend using a REST library that can verify the identity of our server when calling the Barion API. Always use TLS version 1.2 or newer.

For more information on differences in SSL certificates on the live and sandbox servers, read Setting up the Sandbox environment and testing payments.

PCI DSS certification

Barion is Payment Card Industry Data Security Standard (PCI DSS) certified. Since you, as a merchant do not handle cardholder data, PCI DSS certification for merchants using Barion payment is not mandatory. The PCI DSS is an information security standard for organizations that handle branded credit cards. If you handle credit cards, even temporarily, PCI DSS certification is mandatory.

For more information, read Legal and accounting information.

Going live

When your payment solution is working properly in the sandbox, you are ready to go live. Using the live server requires a real contract and an approved shop, so prepare in advance. Read the Going live guide thoroughly and follow the instructions before going live.

Requirements

Follow the Barion Logo Guidelines and place the appropriate logo on your page. Using the logo is a requirement for all Barion price packages, omitting it results in rejecting live shops. Our experience shows that it is important for customers to show they can pay with Barion on your website. We also think that keeping the logo consistent across all Barion merchants helps the entire Barion community.

Another prerequisite of the Starter or Advanced packages is to let Barion know about your users' cart contents details. Use the Item structure within the Items[] property of the PaymentTransaction structure of the Transactions property of the /Payment/Start API endpoint to pass data. The customers see the cart content during payment and later in their Barion wallet history.

When providing cart content, follow the guidelines below:

• Use real product names, generics such as "product" or "drink" will not work. Follow these examples:
  • Canon IXUS 110 Compact Digital Camera
  • Heineken lager 5L party barrel
• Provide all items in one collection
• Use all fields of the Item structure
• You may add discounts as a separate item, subtotals are not checked, so you can use negative prices
• You may add packaging or shipping costs as a separate item
• Provide a link to the image of the product if available, we will use it later for enhancing the payment UX

Limitations

Currently, we do not allow placing the payment GUI in an <iframe> or similar solution, due to security reasons.