Preliminary Preparation

 Notes：

1. Please confirm that the payment complete notification return URL [ReturnURL] for the order created is open for external connections. Please configure it so it can [receive] the payment results information returned by ECPay via Server Site POST. Before returning 1|OK to ECPay, the checksum must be checked and must match the credentials.
2. Please confirm whether the membership system server has enabled a firewall exception for postgate.ecpay.com.tw, in order to prevent the firewall from blocking payment notifications. Do not bind the exception directly to the IP address.
3. The connection port for ECPay API calls provided is limited to only the https (443 port) option. Please connect using a legitimate domain name system (DNS).
4. Please confirm that every transaction parameter is transmitted to the ECPay API via http POST.
5. Make sure that the Server URL connection port is http 80 port and https 443 port.
6. HTML tags are not permitted for labeling the contents of the transmitted parameters .
7. Please do not keep or display cryptographic key information, such as Javascript, HTML, or CSS on the front page to prevent the loss or theft of transaction information due to stolen keys.
8. When transmitting the platform merchant ID parameter PlatformID, please use the HashKey and HashIV of the platform merchant and create a checksum. The [PlatformID] is the merchant ID [MerchantID] binded to the platform.
9. Foreign and UnionPay cards are not supported for credit card payment under Stage.
10. Chinese URLs are not supported for the return URL. For the value of URL field, please use the word converted into punycode. For example, 中文.tw is converted into xn--fiq228c.tw (the xn--fiq228c.tw should be in use).
11. Special symbols are not supported in parameter transmission. This will cause the order creation to fail.
12. Credit card biding card number function – if OTP text messaging is supported by the merchant, then entering the CVV is not required.
13. For merchants, please undergo Time Synchronization for the server to avoid server lag.
14. The payment result should be subject to the information returned to [ReturnURL].
15. To protect the rights and online transaction security for consumers,  ECPay’s API service supports TLS 1.2 .
16. If you are calling the API too fast, you will receive an HTTP Status Code 403, so please slow down the API and wait 30 minutes before calling again.If you need to access the API at a high speed, please contact the service provider.
17.  If merchants need to accept credit card payment of foreign cards, please enable “accepting foreign credit card” function on Merchant’s Admin Website (on Production only). The path is: Merchant’s Admin Website → Credit card receipt → Credit card account settings → Foreign credit card transactions:

• application status: if not applied, please press “application” button.
• Enabled state: if not enabled, please select “Enable” (the Merchant’s Admin Website is in Chinese only; the above is translated by Google translation).