# Veracity Pay – Adyen flavour

Base URL `https://adyen.pay.veracity.se/v71` in place of https://checkout-test.adyen.com/v71 (also at `https://pay.veracity.se/adyen/v71`). Auth: `X-API-Key: $ADYEN_API_KEY`.

```
ADYEN_CHECKOUT_URL=https://adyen.pay.veracity.se/v71
ADYEN_API_KEY=vp_sk_test_…
ADYEN_MERCHANT_ACCOUNT=acct_…
ADYEN_HMAC_KEY=…                  # from the registration e-mail (Adyen-format notification endpoint)
```

1. `POST /sessions` { merchantAccount, amount: { value, currency }, reference, returnUrl, mode: "hosted", countryCode, shopperEmail, lineItems? } → { id: "CS…", url, sessionData }. Redirect to url.
2. The shopper returns to `returnUrl?sessionId=…&sessionResult=…`; `GET /sessions/{id}` → status completed | paymentPending | refused | canceled | expired.
3. `POST /payments` with `paymentMethod: { type: "scheme", encryptedCardNumber: "test_4111111111111111", … }` → resultCode Authorised | Refused | Pending | RedirectShopper.
4. Refunds: `POST /payments/{pspReference}/refunds`; cancels: `/cancels`.
5. Notifications (AUTHORISATION, REFUND, CANCELLATION) in Adyen's standard format to the Adyen-format endpoint: set its URL with `curl https://pay.veracity.se/v1/webhook_endpoints/{we_id} -u $ADYEN_API_KEY: -d url=https://YOUR-APP/api/adyen/notifications`. Verify additionalData.hmacSignature: base64(HMAC-SHA256(hex-key, "pspReference:originalReference:merchantAccountCode:merchantReference:value:currency:eventCode:success")). Answer `[accepted]`.

### Test outcomes

- Hosted checkout: each flavour follows that provider's order of steps; every verification (3-D Secure, Swish app, BankID) is a six-digit code e-mailed to the payer. A "Test mode" panel picks approve, decline (with a reason, including authentication_failed), pending, timeout or provider error. Invoice asks for a personnummer: use 19121212-1212.
- Magic cards: `4242424242424242` Visa – succeeds; `5555555555554444` Mastercard – succeeds; `4000000000000002` Declined: card declined; `4000000000009995` Declined: insufficient funds; `4000000000000069` Declined: expired card; `4100000000000019` Declined: suspected fraud; `4000000000003220` Requires 3-D Secure authentication; `4000000000000150` Pending, succeeds after 5 s; `4000000000000168` Pending, fails after 5 s; `4000000000000119` Provider error (500); `4000000000000184` Timeout – the session expires; `4000000000000341` Succeeds, but renewals fail.
- Magic amounts (total ends in these öre/cents, at least 1.00): `.01` Declined: card declined; `.02` Declined: insufficient funds; `.03` Declined: expired card; `.04` Declined: suspected fraud; `.05` Declined: credit check failed (invoice); `.06` Requires an extra authentication step; `.07` Pending, succeeds after 5 s; `.08` Pending, fails after 5 s; `.09` Timeout – the session expires.
- `metadata[veracity_test_outcome]` on a Checkout Session or PaymentIntent: `approve`, `decline_card_declined`, `decline_insufficient_funds`, `decline_expired_card`, `decline_fraudulent`, `decline_credit_rejected`, `challenge`, `pending_succeed`, `pending_fail`, `timeout`, `provider_error` (`metadata[veracity_test_delay]` seconds for pending/timeout).
- Without a browser: `POST /v1/test_helpers/checkout/sessions/{id}/complete` with `outcome` (MCP tool `complete_checkout`).
- Next renewal of a subscription: `POST /v1/test_helpers/subscriptions/{id}/next_charge_outcome` with `outcome` = approve | insufficient_funds | restricted_card | timeout (MCP tool `set_next_charge_outcome`).
- Time: `POST /v1/test_helpers/advance_clock` with `months` / `days` (MCP tool `advance_clock`); renewals are charged without a code and send invoice.paid or invoice.payment_failed.
## Going live and deviations from the original

Original documentation: [Adyen Checkout API v71](https://docs.adyen.com/api-explorer/Checkout/71/overview), [Adyen Hosted Checkout](https://docs.adyen.com/online-payments/build-your-integration/sessions-flow/?platform=Web&integration=Hosted+Checkout), [Adyen webhooks (HMAC)](https://docs.adyen.com/development-resources/webhooks/verify-hmac-signatures).

To go live, change only the host and the keys: Test: `https://checkout-test.adyen.com/v71`; Production: `https://{prefix}-checkout-live.adyenpayments.com/checkout/v71`. Replace X-API-Key, merchantAccount and the HMAC key with those from Adyen's Customer Area.

Deviations in Veracity Pay:
- Sessions work with mode: hosted only. Drop-in and Components load from Adyen's own servers.
- /payments takes test card numbers; /payments/details (3DS and redirects), captures, reversals and tokenisation are missing.
- Notifications: AUTHORISATION, REFUND and CANCELLATION. OFFER_CLOSED and CAPTURE are not sent.