BLIK OneClick

BLIK payments can be configured in several ways, the simplest of which is redirection. Customers enter a six-digit code on the BLIK website and confirm the payment in their bank's mobile application. However, BLIK payments can be even faster and more convenient, thanks to a transparent integration with PayU.

Each of these solutions (payment with redirection to eblik.pl or with a transparent integration) require a separate POS. Transparent integration with synchronous responses and/or with BLIK token registration requires special configuration.

Possible test scenarios:

Scenario 1.

BLIK level 0 (transparent payment with a T6 code)

The six-digit code, which customers start their payment with, doesn't have to be entered on the BLIK website. Merchant can retrieve the code on their website while accepting the order.

1. OAuth authorize (retrieving access_token)
2. BLIK OCR code (creating order with T6 payment)
3. Order Retrieve (checking order status)

Scenario 2.

BLIK level 0 with token registration (transparent payment with T6 code)

Each time a customer enters the T6 code, merchant can send a request to register BLIK token. Then, when confirming the transaction in the bank's mobile application, a customer will have an additional option to save the BLIK payment (no additional buttons are needed on the merchant's website).

1. OAuth authorize (retrieving access_token)
2. BLIK OCR - token registered by PayU (creating order with a T6 payment + token registration)
3. PayU automatically activates the token
4. Order Retrieve (checking the order status)
5. PayMethods Retrieve (retrieving payment methods – a BLIK token appears)

Scenario 3.

BLIK OneClick (transparent payment with a token)

If customers saved a token durign their last BLIK payment, they can now pay with OneClick without entering a new code.

1. BLIK OCR - pay with a token ( a token-only payment)
2. Order Retrieve (checking the order status)
3. PayMethods Retrieve (retrieving payment methods – a BLIK token appears)

Scenario 4.

Handling ambiguity (transparent payment with more than a single token)

Customers can have accounts in several banks and use BLIK in each of them. If a merchant saves a BLIK token from one bank, ambiguity occurs after an attempt to make a BLIK payment from another bank. PayU allows to handle such exception and lets the customer choose from many saved OneClick options.

Handling ambiguity can be tested in two stages. Steps 1-3 show ambiguity generation. Steps 4-6 simulate OneClick payment when ambiguity occurs.

1. OAuth authorize (retrieving access token)
2. PayMethods Retrieve (retrieving payment methods; missing token for given customer)
3. BLIK OCR - register a non-unique token (non-unique token registration)
4. PayMethods Retrieve (retrieving payment methods – a token appears in response)
5. BLIK OCR - pay with a token (payment with a non-unique token)
6. BLIK OCR - pay with a non-unique token (payment with a non-unique token and introduced alternative)

Information related to testing this service can be found in the Sandbox section.

BLIK OneClick additionally requires OAuth authorization in "grant_type=trusted_merchant". Therefore, please contact your sales representative in PayU before the integration.

Retrieving OAuth token:

                curl -X POST https://secure.snd.payu.com/pl/standard/oauth/authorize \
                 -d 'grant_type=client_credentials&client_id=300746&client_secret=2ee86a66e5d97e3fadc400c9f19b065d'
                
            

Sample response:

                {
                    "access_token": "f24bbf9b-30f0-4460-864f-aaadc07d1e34",
                    "token_type": "bearer",
                    "expires_in": 43199,
                    "grant_type": " client_credentials"
                }
            

Sample order with OAuth token:

BLIK level 0 order creation is consistent with standard integration method via REST API: Creating new order. Standard OrderCreateRequest should be extended by payMethod field.

                   curl -X POST https://secure.snd.payu.com/api/v2_1/orders \
                    -H "Authorization: Bearer d9a4536e-62ba-4f60-8017-6053211d3f47" \
                    -H "Content-Type: application/json" \
                    -d '{
                        "currencyCode": "PLN",
                        "totalAmount": "21000",
                        "description": "Transakcja testowa",
                        "notifyUrl": "https://your.eshop.com/notify",
                        "customerIp": "127.0.0.1",
                        "merchantPosId": "300746",
                        "products": [
                            {
                                "name": "Wireless Mouse for Laptop",
                                "unitPrice": "21000",
                                "quantity": "1"
                            }
                        ],
                        "payMethods": {
                            "payMethod": {
                                "type": "PBL",
                                "value": "blik",
                                "authorizationCode": "777123"
                            }
                        }
                   }'
                

Specification of OrderCreateRequest parameters

After payment is made PayU sends notification to the address specified in notifyURL parameter. More details about notifications can be found in Notifications section.

Sample order response:

                {
                    "orderId": "LDTD3S2WWC181109GUEST000P01",
                    "status": {
                        "statusCode": "SUCCESS"
                    }
                }
            

orderId parameter is returned in response to the created order. orderId is an identifier of a given order and it is used for Order Retrieve request.

Retrieving OAuth token:

                curl -X POST https://secure.snd.payu.com/pl/standard/oauth/authorize \
                 -d 'grant_type=trusted_merchant&client_id=300746&client_secret=2ee86a66e5d97e3fadc400c9f19b065d&email=johndoe@gmail.com&ext_customer_id=JohnDoe'
                
            

Specification of Retrieve OAuth token parameters

Sample response:

                {
                    "access_token": "f24bbf9b-30f0-4460-864f-aaadc07d1e34",
                    "token_type": "bearer",
                    "refresh_token": "b7a4375a-d4fc-41a0-a380-a9dd8c2e9193",
                    "expires_in": 43199,
                    "grant_type": "trusted_merchant"
                }
            

Sample order:

In order to allow to save a token for later use with OneClick transactions, payMethod section should be extended by blikData field with"register": true flag.

                curl -X POST https://secure.snd.payu.com/api/v2_1/orders \
                 -H "Authorization: Bearer d9a4536e-62ba-4f60-8017-6053211d3f47" \
                 -H "Content-Type: application/json" \
                 -d '{
                     "currencyCode": "PLN",
                     "totalAmount": "21000",
                     "description": "Testowa transakcja",
                     "notifyUrl": "https://your.eshop.com/notify",
                     "customerIp": "127.0.0.1",
                     "merchantPosId": "300746",
                     "buyer": {
                         "extCustomerId": "JohnDoe",
                         "email": "johndoe@gmail.com"
                     },
                     "products": [
                         {
                             "name": "Wireless Mouse for Laptop",
                             "unitPrice": "21000",
                             "quantity": "1"
                         }
                     ],
                     "payMethods": {
                         "payMethod": {
                             "type": "BLIK_TOKEN",
                             "authorizationCode": "777123",
                             "blikData": {
                                 "register":true
                             }
                         }
                     }
                }'
            

PayMethods Retrieve

                curl -X GET https://secure.snd.payu.com/api/v2_1/paymethods \
                 -H "Authorization: Bearer d9a4536e-62ba-4f60-8017-6053211d3f47"
            

            {
                "blikTokens": [
                    {
                        "value": "TOKB_nuGYkknycEp3NDWAN2hh1c7FLnXseaLX",
                        "type": "UID",
                        "brandImageUrl": "https://static.payu.com/images/mobile/logos/pbl_blik.png"
                    }
                ],
                "cardTokens": [],
                "pexTokens": [],
                "payByLinks": [
                    {
                        "value": "blik",
                        "brandImageUrl": "https://static.payu.com/images/mobile/logos/pbl_blik.png",
                        "name": "BLIK",
                        "status": "ENABLED"
                    },
                    {
                        "value": "p",
                        "brandImageUrl": "https://static.payu.com/images/mobile/logos/pbl_p.png",
                        "name": "Płacę z iPKO",
                        "status": "ENABLED"
                    },
                    {
                        "value": "m",
                        "brandImageUrl": "https://static.payu.com/images/mobile/logos/pbl_m.png",
                        "name": "mTransfer",
                        "status": "ENABLED"
                    },
                    ... //pojawiają się pozostałe dostępne metody płatności
                    {
                        "value": "c",
                        "brandImageUrl": "https://static.payu.com/images/mobile/logos/pbl_c.png",
                        "name": "Płatność online kartą płatniczą",
                        "status": "ENABLED"
                    }
                ],
                "status": {
                    "statusCode": "SUCCESS"
                }
            }
            

PayMethods Retrieve - response parameters specification:

For blikTokens section:

Sample transparent payment with a token:

A token generated during first transaction is passed in the payMethod field. The payer doesn't have to enter the T6 code.

                curl -X POST https://secure.snd.payu.com/api/v2_1/orders \
                 -H "Authorization: Bearer d9a4536e-62ba-4f60-8017-6053211d3f47" \
                 -H "Content-Type: application/json" \
                 -d '{
                     "currencyCode": "PLN",
                     "totalAmount": "21000",
                     "description": "Transakcja testowa",
                     "notifyUrl": "https://your.eshop.com/notify",
                     "customerIp": "127.0.0.1",
                     "merchantPosId": "300746",
                     "buyer": {
                         "extCustomerId": "JohnDoe",
                         "email": "johndoe@gmail.com"
                     },
                     "products": [
                         {
                             "name": "Wireless Mouse for Laptop",
                             "unitPrice": "21000",
                             "quantity": "1"
                         }
                     ],
                     "payMethods": {
                         "payMethod": {
                             "type": "BLIK_TOKEN",
                             "value": "TOKB_nuGYkknycEp3NDWAN2hh1c7FLnXseaLX"
                         }
                     }
                }'
            

OrderCreateRequest parameters specification

Non-unique token registration

               curl -X POST https://secure.snd.payu.com/api/v2_1/orders \
                -H "Authorization: Bearer d9a4536e-62ba-4f60-8017-6053211d3f47" \
                -H "Content-Type: application/json" \
                -d '{
                    "currencyCode": "PLN",
                    "totalAmount": "21000",
                    "description": "Transakcja testowa",
                    "notifyUrl": "https://your.eshop.com/notify",
                    "customerIp": "127.0.0.1",
                    "merchantPosId": "300746",
                    "buyer": {
                        "extCustomerId": "JohnDoe",
                        "email": "johndoe@gmail.com"
                    },
                    "products": [
                        {
                            "name": "Wireless Mouse for Laptop",
                            "unitPrice": "21000",
                            "quantity": "1"
                        }
                    ],
                    "payMethods": {
                        "payMethod": {
                            "type": "BLIK_TOKEN",
                            "value": "SIMULATE_ALIAS_NON_UNIQUE-",
                            "authorizationCode": "777123",
                            "blikData": {
                                "register":true
                            }
                        }
                    }
                }'
            

Payment with a non-unique token and introduced alternative

Sample BLIK OrderCreateRequest with introduced alternative.

                curl -X POST https://secure.snd.payu.com/api/v2_1/orders \
                    -H "Authorization: Bearer d9a4536e-62ba-4f60-8017-6053211d3f47" \
                    -H "Content-Type: application/json" \
                    -d '{
                        "currencyCode": "PLN",
                        "totalAmount": "21000",
                        "description": "Transakcja testowa",
                        "notifyUrl": "https://your.eshop.com/notify",
                        "customerIp": "127.0.0.1",
                        "merchantPosId": "300746",
                        "buyer": {
                            "extCustomerId": "JohnDoe",
                            "email": "johndoe@gmail.com"
                        },
                        "products": [
                            {
                                "name": "Wireless Mouse for Laptop",
                                "unitPrice": "21000",
                                "quantity": "1"
                            }
                        ],
                        "payMethods": {
                            "payMethod": {
                                "type": "BLIK_TOKEN",
                                "value": "SIMULATE_ALIAS_NON_UNIQUE-",
                                "blikData": {
                                    "appKey":"930872"
                                }
                            }
                        }
                    }'
            

If an invalid request is sent, the response will contain an error status, code and description according to the following table.

{
    "blikData":{
        "alternatives":[
            {
            "appKey":"alternative key1",
            "appLabel":"alternative label1"
            },
            {
            "appKey":"alternative key2",
            "appLabel":"alternative label2"
            }
        ]
    }
}

{
    "blikData":{
        "tokens":[
            {
            "value":"token value",
            "type":"token type"
            }
        ]
    }
}

*To be implemented when the PSP delivers the change on their side. From the start merchant must be prepared to accept both response statuses. In the first integration phase, merchant supports (ERROR_AUTH_TOKEN, WARNING_CONTINUE_AUTH_TOKEN) in the same way.

Postman collection for scenario testing purposes:

It is possible to test this service on sandbox environment. For this purpose you can use the already prepared Postman collection.

Depending on the T6 code used (authorizationCode) it is possible to obtain:

• 777123 - positive authorization,
• 500500 - negative authorization.

Codes for simulating transactions with an incorrect T6 code