1 of 8

Payment Method Manifest

  • Goal: FPWD.
  • Implemented: a while ago.
  • Used by:

@rsolomakhin

2 of 8

Payment Method Manifest

HEAD / HTTP/2 HTTP/2 200

Link: <manifest.json>; rel="payment-method-manifest"

GET / HTTP/2 {

“supported_origins”: “*”

}

3 of 8

Payment Method Manifest

{

“default_applications”: [“https://bobpay.xyz/app.json”]

}

4 of 8

Payment Method Manifest

{

“supported_origins”: [“https://partner1.com”, “https://partner2.com”]

}

5 of 8

Payment Method Manifest

{

“default_applications”: [“https://bobpay.xyz/app.json”],

“supported_origins”: [“https://partner1.com”, “https://partner2.com”]

}

6 of 8

Payment Method Manifest

{� "related_applications": [{� "platform": "play",� "id": "com.samsung.android.spay",� "min_version": "1",� "fingerprints": [{� "type": "sha256_cert",� "value": "34:DF:0E:7A:9F:1…."� }]� }]�}

​

7 of 8

Payment Method Manifest

  • Feedback from payment method owners:
    • Need more logging.
    • Allow localhost development.
    • Respect HTTP Cache header.

8 of 8

Payment Method Manifest

    • Hosting a manifest
      1. Not a big burden from experience
      2. Free hosting services
      3. Standardized (non-URL) payment method identifier
      4. Caching
    • HTTP headers to locate manifest
      • Working as intended
    • User IP exposure to manifest host
      • Download manifest only if user has installed its app
    • Merchant origin exposure to manifest host
      • +1 if fetch initiated by a payment request