← All payment options
Legacy · PAYware Connect gateway

Verifone Hosted Payment Form (HPF)

Verifone's card form loads in an iFrame on the merchant's own checkout page and is styled with the merchant's CSS, so it looks like part of the site.

  • Shopper never leaves the merchant's page
  • Fully merchant-branded through a stylesheet
  • Processes through the PAYware Connect (PWC) gateway
  • Transactions appear in PAYware Connect reporting
  • Needs a Verifone Hosted Payment Solution account (hostedSecureID)
</> Developer view is on – credentials, code & live log ↓

Choose a test item

You'll pay on an IPC-branded payment form hosted by Verifone, shown right on this page. Sandbox payments run through PAYware Connect and appear in its reports.

</> Developer view – Verifone Hosted Payment Form (HPF) Choose an item above to generate a live request. Sample values shown below.plugin v1.7.0
1. Credentials & endpoints
EnvironmentSandbox
HPF form URLhttps://www.sandbox-cresecure.net/hpf/1_1/
hostedSecureIDvf544746443591SB
hostedSecureAPITokengmgGm4PnFaVYAetKNXvzxkLIQkemFBce
Callback URLhttps://demoipcpayments.com/ipc-hpf-callback.html
CSS URLhttps://demoipcpayments.com/ipc-hpf-style.css
Return URL (XML)https://demoipcpayments.com/ipc-hpf-return
Validation URLhttps://direct.sandbox-cresecure.net/direct/services/validation/
2. iFrame request (sample) – GET https://www.sandbox-cresecure.net/hpf/1_1/
hostedSecureIDvf544746443591SB
actionbuildForm
sessionId{unique per visit, 8+ chars}
amount12.99
currency_codeUSD
orderIdIPC-HPF-XXXXXXXX
order_desc{item name}
formType1
allowed_typesVisa|MasterCard|American Express|Discover
collectAddress3
langen_US
callback_urlhttps://demoipcpayments.com/ipc-hpf-callback.html
css_urlhttps://demoipcpayments.com/ipc-hpf-style.css
Full request URL
https://www.sandbox-cresecure.net/hpf/1_1/?hostedSecureID=vf544746443591SB&action=buildForm&sessionId=%7Bunique%20per%20visit%2C%208%2B%20chars%7D&amount=12.99&currency_code=USD&orderId=IPC-HPF-XXXXXXXX&order_desc=%7Bitem%20name%7D&formType=1&allowed_types=Visa%7CMasterCard%7CAmerican%20Express%7CDiscover&collectAddress=3&lang=en_US&callback_url=https%3A%2F%2Fdemoipcpayments.com%2Fipc-hpf-callback.html&css_url=https%3A%2F%2Fdemoipcpayments.com%2Fipc-hpf-style.css
HTML placed on the page
<iframe id="secureFrame" class="secureFrame" src="https://www.sandbox-cresecure.net/hpf/1_1/?hostedSecureID=vf544746443591SB&action=buildForm&sessionId=%7Bunique%20per%20visit%2C%208%2B%20chars%7D&amount=12.99&currency_code=USD&orderId=IPC-HPF-XXXXXXXX&order_desc=%7Bitem%20name%7D&formType=1&allowed_types=Visa%7CMasterCard%7CAmerican%20Express%7CDiscover&collectAddress=3&lang=en_US&callback_url=https%3A%2F%2Fdemoipcpayments.com%2Fipc-hpf-callback.html&css_url=https%3A%2F%2Fdemoipcpayments.com%2Fipc-hpf-style.css" style="width:100%;height:720px;border:0" scrolling="auto"></iframe>
3. Response functions (JavaScript, in window.top)

completeCREPayment(transaction), cancelCREPayment(), whatCVV2(), creHandleErrors(errorCode) and creHandleDetailErrors(errorCode, gatewayCode, gatewayMessage). The exact script is shown here once you choose an item.

4. callback.html – https://demoipcpayments.com/ipc-hpf-callback.html
Exact file served on this domain
<!DOCTYPE html>
<html><head><meta charset="utf-8"><title>Processing…</title><meta name="robots" content="noindex"></head>
<body style="font-family:sans-serif;font-size:14px;color:#555">
<noscript>JavaScript is required to complete the payment.</noscript>
<script>
(function () {
	var raw = window.location.search.replace(/^\?/, '') || window.location.hash.replace(/^#/, '');
	var p = {};
	raw.split('&').forEach(function (kv) {
		if (!kv) { return; }
		var i = kv.indexOf('=');
		var k = i < 0 ? kv : kv.slice(0, i);
		var v = i < 0 ? '' : kv.slice(i + 1);
		try { k = decodeURIComponent(k.replace(/\+/g, ' ')); v = decodeURIComponent(v.replace(/\+/g, ' ')); } catch (e) {}
		p[k] = v;
	});
	var t = window.top, action = (p.action || '').toLowerCase();
	function call(fn) { if (t && typeof t[fn] === 'function') { t[fn].apply(t, [].slice.call(arguments, 1)); return true; } return false; }
	try {
		if (action === 'cancel' || 'cancel' in p || 'cancelCREPayment' in p) {
			call('cancelCREPayment');
		} else if (action.indexOf('cvv') > -1 || 'whatCVV2' in p) {
			call('whatCVV2');
		} else if (p.error || p.errorCode || p.errors || (p.code && p.code !== '000') || (p.status && p.status !== '000' && !p.transId)) {
			var code = p.error || p.errorCode || p.errors || p.code || p.status;
			if (!call('creHandleDetailErrors', code, p.gatewayCode || '', p.gatewayMessage || p.msg || p.message || '')) {
				call('creHandleErrors', code);
			}
		} else if (p.transId || p.appCode || p.approvalCode || p.status === '000' || p.tokenId || p.tokenPayment) {
			call('completeCREPayment', p);
		} else {
			call('ipcHpfUnknown', raw);
		}
	} catch (e) {
		document.body.textContent = 'Could not return the result to the payment page.';
	}
})();
</script>
</body></html>
5. Branded stylesheet – https://demoipcpayments.com/ipc-hpf-style.css
CSS loaded by the Verifone form
/* IPC branded Verifone HPF stylesheet */
body{margin:0;padding:4px 4px 16px;background:#fff;color:#1d2433;font:15px/1.4 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}
.mainTable{width:100%;border-collapse:separate;border-spacing:0 6px}
.mainTable td{vertical-align:middle;padding:0 4px}
.creNameLabel,.creAddressOneLabel,.creAddressTwoLabel,.creCityLabel,.creStateLabel,.creAmountLabel,.creNumberLabel,.creCVV2Label,.creTypeLabel,.creExpirationLabel,.creCardOnFileCheckLabel{font-size:13px;font-weight:600;color:#44506a;white-space:nowrap;padding-right:12px}
input,select{font:inherit;color:#1d2433}
.creNameField,.creAddressOneField,.creAddressTwoField,.creCityField,.creZipField,.creAmountField,.creNumberField,.creCVV2Field,.creStateField,.creTypeInput,.creExpirationMonthField,.creExpirationYearField{box-sizing:border-box;border:1px solid #c9d1e1;border-radius:6px;padding:7px 10px;background:#fff;min-height:36px;outline:none;transition:border-color .15s,box-shadow .15s}
.creNameField,.creAddressOneField,.creAddressTwoField,.creCityField,.creNumberField,.creAmountField{width:100%;max-width:340px}
.creCVV2Field{width:90px}
.creZipField{width:120px}
.creTypeInput{min-width:190px}
.creNameField:focus,.creAddressOneField:focus,.creAddressTwoField:focus,.creCityField:focus,.creZipField:focus,.creNumberField:focus,.creCVV2Field:focus,.creStateField:focus,.creTypeInput:focus,.creExpirationMonthField:focus,.creExpirationYearField:focus{border-color:#404558;box-shadow:0 0 0 3px #d0cd2a33}
.creAmountField{background:#f4f6fb;font-weight:700;color:#404558}
.creCVV2WhatLink{color:#404558;text-decoration:underline!important;font-size:13px;margin-left:8px;text-decoration:none}
.creCVV2WhatLink:hover{text-decoration:underline}
.creButtonRow td,.creButtonLabel{padding-top:8px;padding-bottom:8px}
.completeButton,.cancelButton{font:600 15px/1 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;border-radius:6px;padding:12px 22px;cursor:pointer;margin-right:8px}
.completeButton{background:#404558;color:#fff;border:2px solid #404558}
.completeButton:hover{filter:brightness(1.12)}
.cancelButton{background:#fff;color:#404558;border:2px solid #c9d1e1}
.cancelButton:hover{border-color:#404558}
.processingCompleteButton{background:#8a97b3!important;border-color:#8a97b3!important;color:#fff!important;cursor:wait!important;pointer-events:none}
.finishedCompleteButton{background:#2e7d32!important;border-color:#2e7d32!important;color:#fff!important;pointer-events:none}
@media (max-width:480px){.mainTable td{display:block;width:auto}.creNameLabel,.creNumberLabel,.creCVV2Label,.creTypeLabel,.creExpirationLabel,.creAmountLabel{padding:6px 4px 2px}}
6. Server-side confirmation – Transaction Validation Service
cURL
curl -X POST 'https://direct.sandbox-cresecure.net/direct/services/validation/' \
  -d 'hostedSecureID=vf544746443591SB' \
  -d 'hostedSecureAPIToken=gmgGm4PnFaVYAetKNXvzxkLIQkemFBce' \
  -d 'order_id=IPC-HPF-XXXXXXXX' \
  -d 'total_amt=12.99' \
  -d 'trans_id={transId returned by the form}' \
  -d 'response_type=json'
PHP (this page’s logic, simplified)
<?php
// 1. Build the HPF iFrame URL (runs on your server for every checkout)
$params = array (
  'hostedSecureID' => 'vf544746443591SB',
  'action' => 'buildForm',
  'sessionId' => '{unique per visit, 8+ chars}',
  'amount' => '12.99',
  'currency_code' => 'USD',
  'orderId' => 'IPC-HPF-XXXXXXXX',
  'order_desc' => '{item name}',
  'formType' => '1',
  'allowed_types' => 'Visa|MasterCard|American Express|Discover',
  'collectAddress' => '3',
  'lang' => 'en_US',
  'callback_url' => 'https://demoipcpayments.com/ipc-hpf-callback.html',
  'css_url' => 'https://demoipcpayments.com/ipc-hpf-style.css',
);
$src = 'https://www.sandbox-cresecure.net/hpf/1_1/?' . http_build_query($params, '', '&', PHP_QUERY_RFC3986);
echo '<iframe id="secureFrame" src="' . htmlspecialchars($src) . '" style="width:100%;height:720px;border:0"></iframe>';

// 2. After completeCREPayment() fires, confirm server-to-server (never trust the browser alone)
$res = wp_remote_post('https://direct.sandbox-cresecure.net/direct/services/validation/', array('body' => array(
    'hostedSecureID'       => 'vf544746443591SB',
    'hostedSecureAPIToken' => 'gmgGm4PnFaVYAetKNXvzxkLIQkemFBce',
    'order_id'             => 'IPC-HPF-XXXXXXXX',
    'total_amt'            => '12.99',
    'trans_id'             => $transIdFromForm,
    'response_type'        => 'json',
)));
$v = json_decode(wp_remote_retrieve_body($res), true);
$paid = ($v['status'] ?? '') === 'success' && ($v['order_id_match'] ?? '') === 'YES' && ($v['total_amt_match'] ?? '') === 'YES';
7. Live log for this payment

Choose an item and continue – every step of the payment will be logged here as it happens.

🔒 Card details are entered in a secure form hosted by Verifone and never touch this website.