[MUSIC PLAYING]
JOSE UGIA: Hi, everyone, and welcome to our very first
episode of "Ask Google Pay Devs," a series of videos where
we'll address commonly asked questions
about integrating Google Pay.
To make it easier for us to find your questions,
make sure to use the #AskGooglePayDevs hashtag
across Twitter, YouTube, Stack Overflow,
or any other site where you enjoy asking questions.
I'm Jose, a Developer Relations Engineer at Google Pay,
and I'll be your host today.
Before we start, and in case this
is the first time you're taking a look at the online APS
for Google Pay, I would like to share with you three reasons
for integrating Google Pay in your applications and websites.
First, when you add the Google Pay button
to your website or mobile application,
you are simplifying the checkout flow for your customers,
reducing the number of steps to pay to as few as two clicks
or taps.
This not only makes your checkout process faster,
but it also has an impact on your conversion performance.
Second, there are hundreds of millions
of cards that have already been saved to Google accounts
during the phone setup process, or from previous transactions
with Google, including Google Play, Chrome,
and other apps and websites that have already integrated
with the Google Pay APS.
What does this mean for you?
Your uses don't need to log into their accounts
to pay in your website or mobile application,
ensuring a fast checkout process.
And third, security.
When a user chooses a form of payment through Google Pay,
their payment credentials are encrypted
before they leave the Google servers
and sent to your application.
It is not until you send those credentials to your payment
service provider that they will be
decrypted to the original form to complete the payment.
This makes your application resilient
to external vulnerabilities.
When you are ready to integrate, you
can create a business profile and submit your integration
through Google Pay's Business Console.
OK, now we are ready to dive into your questions.
Let's get to our first question of the day,
how to collect payments for an application listed
in Google Play.
Should I use Play Billing or Google Pay?
There are two primary ways to accept payments if you are
distributing your [INAUDIBLE] application through Google
Play--
Google Play's billing system, and Google Pay.
Google Play's billing system is required
when you are selling digital items or services
within an app on Google Play, while Google Pay can
be used when you are selling physical items or services that
will be used or delivered outside of your app,
such as groceries, retail merchandise, or food delivery.
Note that you can use Google Pay to make payments easier
in your application, regardless of whether your app is listed
on Google Play or somewhere else.
Should I integrate directly with the Google Pay libraries,
or should I use the libraries from my PSP?
You can go with the libraries which are more suitable to you
to complete the integration.
Use the Google Pay online libraries
if you like to integrate the different payment
providers separately, or if you prefer
to remove intermediate layers in the code and the dependencies
you use.
Using the Google Pay libraries directly
is also useful if you want to quickly swap
payment configurations and payment providers.
Take a look at the payment data request
object in the documentation to learn more.
On the other hand, if you're using multiple features
from a single PSP in your application
and prefer to use one library that encompasses most
of the functionality and APS available,
many PSPs offer complete packages
that help you with just that.
Take a look at the documentation for your specific payment
provider to find out more.
How to integrate Google Pay using a mobile or web library
or framework?
We want to provide you with the right set of tools
to help you integrate Google Pay in the most
familiar and convenient way for you and your team.
If you are using generic stacks for your applications,
like JavaScript on the Web and Java are currently on Android,
you can use our vanilla libraries
to get started on both platforms.
Take a look at g.co/pay/api to learn more.
We've also added support for the Google Pay button
for many popular web frameworks like React, Angular, View,
Swells, and many others.
There are frameworks specific libraries
for React and Angular, while the general purpose web component
version can be used for other frameworks.
Check out the repository on GitHub
where discussions, issues and pull requests are welcome.
Where to place the Google Pay button inside your checkout
form.
Add the Google Pay button to the product page
to provide an Express Checkout options
for users who are likely to checkout with only one product.
We recommend placing digital wallets
like Google Pay above your checkout form.
The reason is that Google Pay makes
it easy for your customers to choose
from their existing payment details
like their card details and shipping addresses.
Placing the button first means that customers
won't start filling in the form before realizing that a faster
alternative is available.
The Google Pay button should be the same size
as other buttons on the page.
By default, the Google Pay button
will wrap to the size of the text inside,
but this can be customized on the web
by setting the button size mode property to fill
and on Android.
What happens after I receive a payment token from Google Pay?
After a form of payment is successfully selected,
a result is returned back to your application or website
in response to the payment data request.
This result contains information about the payment request
and the payment method itself, which
in turn includes what we refer to as tokenization information.
This object contains an opaque payload in string format
that you need to relay to your payment processor
or gateway of choice.
This payload holds details about the form of payment selected
by your users and is encrypted using
keys shared between Google Pay and your PSP.
In other words, all your PSP can decrypt and access
the contents of the encrypted payload.
If you are integrating Google Pay
and hence operating in test mode,
you are sent back a dummy token in string format
as in the example.
To learn more about the payment data response
returned by the load payment data requests,
take a look at our documentation using
the link for this question in the description below.
How do I complete my integration with the PSP?
The way to handle the payment payload received from Google
Pay will depend on how you are completing the operation
with your payment processor.
It's important to remember that the result returned
by Google Pay contains the payment method selected
by your user.
The most common procedure is to use this payment method
to create the order through your backend servers
and from there initiate the payment transaction
with your PSP.
Some PSPs offer alternative flows
to complete a payment process.
One of them separates the creation
of the payment method and the order,
allowing you to use the Google Pay result to create
the payment method directly from your client using client
libraries provided by your PSP.
Once the payment method is created,
you can initiate the payment transaction
from your backend servers without attaching the payment
method information and simply passing
a reference to the object created previously.
All in all, make sure to only issue requests containing
sensitive information, like order price,
from your backend servers.
How to test my integration before publishing
my application or website?
Testing your integration before pushing them
life is key to ensure a reliable checkout
experience for your customers and a robust payment
stack for your business.
To help you test your payments flows holistically,
we have created a set of test cards, authentication methods
and billing and shipping addresses
that you can associate to your test accounts
and use them to complete payment transactions while operating
in test mode.
You can enable test cards quickly
by flipping a switch directly from the developer
documentation.
I have completed my integration.
What do I need to do next?
If you have already integrated Google Pay in your web
or Android application, you are one step away
from collecting payments with Google Pay in production.
To do that, you'll need to submit your integration
using Google Pay's Business Console, which will guide you
through the process of creating a business profile
and submitting and managing your web and Android integrations.
Once your integration is cleared for production,
all you need to do is change the environment to production
and publish or deploy your application.
You can access Google Pay's Business Console in this link.
What security implications are there
after integrating Google Pay?
The term Security in Payments is present at various stages
in a transaction and they all need
to be considered separately.
Let's use a familiar example to help explain the concept.
Suppose that you develop an application that
allows users to create information that only
they can see, like their shopping list,
through a password protected user account.
For these accounts to be secure, the overall service
needs to meet a minimum set of requirements,
like using an encrypted connection
between your application and your servers,
storing credentials securely or prompting
the users to use a strong password, among others.
If any of the previous requirements
is not adopted correctly, your system may become vulnerable
and your users' information can get exposed.
A payment transaction also has multiple security layers
which are required in order to ensure a safe payment
experience for your users.
Like encrypting payment information in transit,
tokenized card details, cardholder authentication,
payment authorization or storing payment details securely.
Some of these security requirements
are handled by PCI DSS compliant third party
service providers or gateways, while others
are embedded as part of the payment processing stack
in card networks and other payment methods.
Keeping that in mind, your service
is responsible for collecting payment details
and securely forwarding them to your PSP or processing stack.
This is where Google Pay can help.
When your customers use Google Pay in your application
or website, their payment credentials
are encrypted before they are shared
with you to create the order with your payment processor.
This means that even if your service gets compromised,
the user payments information is still safe.
In addition to that, make sure to continue
running your existing risk checks through your payment
processor or existing in-house infrastructure
when the order is created.
What's the difference between Gateway and Direct Integration?
Which one should I be Using with a gateway integration,
you are benefiting from the work your payment service provider
or PSP has done to support Google Pay.
In this case, the payment information
returned by Google Pay can only be decrypted and used
by your PSP.
As mentioned earlier, if your service is compromised,
your customer's payment details are kept safe.
If your PSP is offering a Google Pay Gateway Integration,
it is recommended that you use it.
This significantly streamlines your integration
and ongoing maintenance requirements.
The direct integration is designed
for businesses where PCI DSS compliant and work
with the PSP that does not offer the Google Pay gateway
integration.
Direct payment tokens are securely
shared with you, the merchant.
Because of this, direct integrations
are required to provide ongoing evidence of PCI DSS
level 1 compliance and regularly rotate encryption keys.
And these were our topics for today's session.
I hope that your questions were answered,
and if they weren't make sure to post them on Twitter, YouTube,
and Stack Overflow using the Ask Google Pay
Devs hashtag so we can feature them on one of the upcoming
episodes.
Thank you for watching, and I'll see you next time.
[MUSIC PLAYING]