Encrypted Token

This guide explains how to create a payment with an encrypted Google Pay™ token. Armaghast decrypts the token, so your systems never receive card data. This is the recommended approach for most merchants.

For the Google Pay API settings, Google policies and going live, see Google Pay gateway integration.

Prerequisites

1. An Armaghast requestor with Google Pay enabled, its requestor ID and Bearer token.
2. A Google Pay API integration in your checkout with the tokenization type PAYMENT_GATEWAY:

"tokenizationSpecification": {
  "type": "PAYMENT_GATEWAY",
  "parameters": {
    "gateway": "armaghast",
    "gatewayMerchantId": "YOUR_REQUESTOR_ID"
  }
}

gatewayMerchantId must be the requestor ID that you use in the API path. Armaghast rejects a token issued for another requestor.

Implementation Process

1. When the customer confirms the payment, Google Pay returns a PaymentData object. Take the token from paymentMethodData.tokenizationData.token.
2. Send the token to your backend without parsing, changing or storing it. The token is already a JSON string: do not encode it again.
3. Send a sale or auth request with:
   • paymentMethod: GOOGLE_PAY_TOKEN
   • googlePayToken: the token string
4. Do not send card or cardId, and do not send a googlePayToken message extension together with googlePayToken. Armaghast rejects such requests.
5. Handle the response as for a card payment. A PAN_ONLY credential may require 3-D Secure; the response then includes what you need to complete it.

The token has a limited lifetime. Send it to Armaghast right away.

Tokens and request examples

Encrypted Google Pay token

{
  "signature": "MEYCIQCf3...0GKM3Y=",
  "intermediateSigningKey": {
    "signedKey": "{\"keyValue\":\"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...\",\"keyExpiration\":\"1780000000000\"}",
    "signatures": ["MEUCIQDn...DjCq0Ug="]
  },
  "protocolVersion": "ECv2",
  "signedMessage": "{\"encryptedMessage\":\"PeYi...2bg==\",\"ephemeralPublicKey\":\"BOdo...4Wo=\",\"tag\":\"VXr2...dr0=\"}"
}

How to get it in the browser:

paymentsClient.loadPaymentData(paymentDataRequest).then((paymentData) => {
  const googlePayToken = paymentData.paymentMethodData.tokenizationData.token;
  // send googlePayToken to your backend as is
});

Sale/Auth example

curl --request POST \
  --url https://SERVER_NAME/api/payments/sale/$REQUESTOR_ID \
  --header "Authorization: Bearer $BEARER_TOKEN" \
  --header 'Content-Type: application/json' \
  --data @sale.json

{
  "order": {
    "orderMerchantId": "123",
    "orderDescription": "Order description",
    "orderAmount": "10.00",
    "orderCurrencyCode": "EUR"
  },
  "browser": {
    "ipAddress": "123.123.123.123",
    "acceptLanguage": "en",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
    "javascriptEnabled": true,
    "screenHeight": 900,
    "screenWidth": 1440,
    "colorDepth": 24,
    "timeZone": 0
  },
  "urls": {
    "resultUrl": "https://merchant.example/result"
  },
  "paymentMethod": "GOOGLE_PAY_TOKEN",
  "googlePayToken": "{\"signature\":\"MEYCIQCf3...0GKM3Y=\",\"intermediateSigningKey\":{...},\"protocolVersion\":\"ECv2\",\"signedMessage\":\"...\"}"
}

Important: googlePayToken must contain the whole token as a JSON string, exactly as Google Pay returned it.

Errors

Code	Message	What to check
-40	Google Pay token is not a valid token / is too long; googlePayToken must not be sent together with card or cardId	Send the token unchanged and without card / cardId
-41	Cannot decrypt Google Pay token; token is expired	Check gateway is armaghast, the Google Pay environment (TEST / PRODUCTION) matches the Armaghast environment, and send the token right away. Quote errorCorrelationId to support
-42	Google Pay gatewayMerchantId does not match the requestor	gatewayMerchantId must equal the requestor ID in the API path
-43	Google Pay token content is not supported	Only CARD with PAN_ONLY or CRYPTOGRAM_3DS is accepted
-44	messageExtensions must not contain googlePayToken when googlePayToken is sent	Remove the googlePayToken message extension

Comparing Encrypted vs. Decrypted Methods

Feature	Encrypted Method	Decrypted Method
Who decrypts the token	Armaghast	You, with your own Google Pay keys
PCI DSS Scope	Minimal	Expanded: card data in your systems
Implementation Complexity	Lower	Higher - requires decryption implementation
Recommended for	Most merchants	Special use cases only

See the Google Pay Decrypted Token guide for the decrypted approach.