Integrating with SecurePay

Getting started with SecurePay is quick and easy, and there are multiple ways you can integrate based on your needs. You also have the chance to test your integration after signing up for an account. SecurePay provides you with a sandbox version, allowing you to freely test SecurePay on your website for as long as you’d like before starting with a live account.

The methods in which you can integrate with SecurePay include SecurePay API, e-Commerce extensions and other methods such as XML, SecureFrame, SecureBill and more.

To find out more on each of the integration methods available, click on the links below.

SecurePay API

Other integration methods

e-Commerce extensions

SecurePay API

The SecurePay API allows you to take payments on your web site in a PCI DSS compliant manner whilst retaining a much greater degree of control over the look & feel than is possible with other payment integrations.

Getting started

Obtaining a SecurePay test account

To obtain your test credentials, you must first create an account with SecurePay. If you’d like to do this now, follow this link to the SecurePay home page and sign up for free.

After entering your details, you’ll be given a clientId , a clientSecret and a merchantCode .

These are your test credentials, which you can use to explore SecurePay API’s functionality and integration for free before you start trading.

Giving SecurePay API a test run

Along with your clientId and your clientSecret , you will also have been issued a merchantCode , which you will need to access the sandbox environment where SecurePay can be tested.

To test the SecurePay API and get a feel for how everything works, simply have your credentials ready and access the sandbox environment .

Setting up your live account

Once you’re ready, you can return to your SecurePay account and apply for your merchant account/facility.

After approval, you’ll receive a welcome email providing access to your merchant portal.

After logging in, you’ll notice an activated status letting you know that you’re all set up and ready to integrate our API onto your live site! You will also find your live clientSecret .

SecurePay will use this to confirm data exchanges (sensitive information) with you as a merchant, so keep it safe and secure!

Environment details

To consume SecurePay API you will need an accessToken to authenticate, refer to the authentication section for more information.

Environment Base URL Sandbox https://payments-stest.npe.auspost.zone https://payments.auspost.net.au

Authentication

Overview

SecurePay API uses the OAuth 2.0 protocol for authentication and authorization. Your client application requests an access token from the Authorization Server , and sends the token as part of the Authorization Header to the SecurePay API resource that you want to access.

OAuth 2.0 is used by the world’s largest digital organisations, and it is currently the most secure and technologically advanced protocol of its kind. It uses fast-expiring access tokens that can only be utilised for specific resources by applications. This greatly mitigates the risk of “man-in-the-middle” attack and data breaching.

Client Credentials

For security reasons, do not retrieve a new “access_token” for every API call. Any “access_token” granted as part of this API is valid for a duration of 24 hours. Refer to response field “expires_in” for more details.

Example code to obtain an access token:

curl -X POST \
  https://welcome.api2.sandbox.auspost.com.au/oauth/token \
  --header 'Authorization: Basic xxxxxxxx' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'audience=https://api.payments.auspost.com.au'
    "access_token": "eyJraWQiOiJJTzdwOUxNcEd0NBlLLV80Q192SFUyaUFvcGJoMXNZQ0JCOTV5cEthVzBJIiwiYWxnIjoiUlMyNTYifQ.eyJ2ZXIiOjEsImp0aSI6IkFULkFSdUVqbmdlcmJFWHZ1M1ZEMGMzZjNjWDM3OWJzZzhzeElmTmZXNUttSGsiLCJpc3MiOiJodHRwczovL2Rldi00MjQ4ODMub2t0YS5jb20vb2F1dGgyL2RlZmF1bHQiLCJhdWQiOiJhcGk6Ly9kZWZhdWx0IiwiaWF0IjoxNTYwNDAyMjQ0LCJleHAiOjE1NjA0ODg2NDQsImNpZCI6IjBvYW9rYXp4eTB2OEs5UGRVMzU2Iiwic2NwIjpbImh0dHBzOi8vYXBpLnBheW1lbnRzLmF1c3Bvc3QuY29tLmF1L3BheWhpdmUvbWFuYWdlLWFjY291bnRzL3JlYWQiLCJodHRwczovL2FwaS5wYXltZW50cy5hdXNwb3N0LmNvbS5hdS9wYXloaXZlL21hbmFnZS1hY2NvdW50cy93cml0ZSJdLCJzdWIiOiIwb2Fva2F6eHkwdjhLOVBkVTM1NiJ9.Zsv-NGEIUOOucmFl4_a2-E_Kd9GrlRuWvzwwYoU2s8C84PE1dFUzAIoXAs29jPYL3Ceu4t_TtKbm92VG_Oyd85-_pk7nYIli-1SxNSHwIcF8bNMV-mNngXEhjLA_Qm6eT-Ydj6k8Ww47XiDa8fYz48FMmi6f4zU44sEPL3wbNsPTIYEcQxzyO8gPpiKHn-74Gc7XVmFRAKngHr-3WrySevS8CzTlxdk3YJG60LHaivsXoAQ0vaREe4SaTwjlIaxLqfqVihG0B4o4dOlI9pT8gfhTfyb2QnTcyD16uQlUJuXGzlTZmg57mTwNeKmyFAAsOqKTITie-arizOIAtXqb2Q",
    "token_type": "Bearer",
    "expires_in": 86400,
    "scope": "https://api.payments.auspost.com.au/payhive/payments/read https://api.payments.auspost.com.au/payhive/payments/write https://api.payments.auspost.com.au/payhive/payment-instruments/read https://api.payments.auspost.com.au/payhive/payment-instruments/write"
 Authentication URL 
Environment
Sandbox
https://welcome.api2.sandbox.auspost.com.au/oauth/token
https://welcome.api2.auspost.com.au/oauth/token
 Header Parameters 
Parameter
Required
Description
Authorization
Required
HTTP Basic Auth header containing your client id and client secret (issued during the on-boarding process). Refer to HTTP Basic Auth for more information.
Content-Type
Required
Should be set to application/x-www-form-urlencoded.
 Request Parameters 
Parameter
Required
Description
grant_type
String
Required
The grant_type parameter must be set to client_credentials.
audience
String
Required
The audience parameter must be set to https://api.payments.auspost.com.au.