Module and release scope
This guide covers Authorize.net Accept Hosted 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.
Open System → Payment gateways (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.
Exact connection fields
These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.
| Key / label | Type | Required | Default / guidance |
|---|---|---|---|
mode — Environment |
select | Yes | Default: "sandbox" Choices: sandbox = Sandbox, live = Live |
api_login_id — API Login ID |
text | Yes | Use the account-specific value described below. |
transaction_key — Transaction Key |
secret | Yes | Use the account-specific value described below. |
signature_key — Webhook Signature Key |
secret | Yes | 128 hexadecimal characters from Account → Settings → API Credentials and Keys. This is different from the Transaction Key. |
gateway_id — Gateway account ID |
text | Yes | The numeric Gateway ID for this merchant account. The connection test confirms this account and its currency. |
currency — Merchant account invoice currency |
select | Yes | Default: "USD" Choices: AUD = AUD, CAD = CAD, EUR = EUR, GBP = GBP, USD = USD |
One-off card invoice payments on Authorize.net's hosted form. Requires EmailaBiller 1.3.6, including its secure hosted POST handoff. Installed disabled with no merchant credentials or business values.
Configure
- Obtain a separate Authorize.net Sandbox merchant account. Under Account → Settings → API Credentials and Keys, copy the API Login ID, Transaction Key and Signature Key. The Signature Key is 128 hexadecimal characters and is different from the Transaction Key.
- Enter the merchant's numeric Gateway ID and actual single account currency. Supported two-decimal currencies are AUD, CAD, EUR, GBP and USD, subject to your merchant account. The read-only merchant-details query must confirm exactly that currency and Gateway ID. Never relabel a foreign-currency invoice as USD.
- Give the API integration permission to submit charges and read merchant/transaction details. Enable the Transaction Details reporting capability for your merchant account. No customer-profile, refund or subscription permissions are needed by this module.
- In the Merchant Interface Webhooks settings, register the exact HTTPS connection webhook URL shown in EmailaBiller. Enable net.authorize.payment.authcapture.created and net.authorize.payment.fraud.approved. Use the same Signature Key saved in the module.
- Save and Test. Testing only requests merchant details; it creates neither a hosted token nor a charge. In Live mode, merchant test mode must be off. Complete sandbox payment and notification verification before explicitly enabling production.
Hosted form and settlement
The customer's owned payment route requests a short-lived opaque token, then posts only that token to Authorize.net's fixed Sandbox or production form URL. The token is never placed in a URL or stored as a checkout identifier. Authorize.net collects card, verification and billing information; bank-account/eCheck collection and partial authorizations are disabled for this release.
Browser returns do not record funds. A notification must pass HMAC-SHA512 verification using the raw body and decoded Signature Key. Authenticated merchant and transaction-detail requests must confirm this account/currency, a captured or settled auth-capture transaction, original invoice metadata and identical authorized/captured amounts. Holds, refunds, voids, split tenders and unsigned claims cannot mark an invoice paid. Stable transaction IDs prevent duplicate ledger credits.
No recurring collection, card vault, automatic refund or manual-capture automation is included. Captured payments without a valid matching notification require provider-led billing review. API calls are never automatically retried after an uncertain response.
Provider documentation
- Accept Hosted token, form POST, settings and fixed URLs
- API requests and authentication
- Webhook setup, events and HMAC-SHA512
- Transaction Reporting
- Official API schema: merchant currencies, transaction status and order details
Diagnostics retain safe API error codes and HTTP status while suppressing credential values and raw response bodies.