Payment Glossary

An authentication protocol (3DS / 3DS2) that adds a verification step where the customer confirms their identity with their bank. Reduces fraud liability and is required in many regions (e.g., EU under PSD2/SCA).

A service that automatically updates stored card details when a card is replaced, renewed, or re-issued. Reduces failed payments due to expired or changed card data.

A hold placed on a customer's funds to confirm they are available. The merchant's bank requests that the issuing bank reserves the specified amount. Authorization does not move money — it only reserves it.

The first 6–8 digits of a card number that identify the issuing bank, card network, card type (credit/debit/prepaid), and country of issuance. Used in fraud detection and routing decisions.

The process of completing an authorized transaction and moving funds from the customer's account to the merchant's account. Capture can happen immediately (auto-capture) or be delayed up to 7 days.

A unique identifier generated from a card's details (PAN, expiry) that allows tracking the same card across multiple transactions without storing the raw card number. Useful for fraud detection.

A forced reversal of a payment initiated by the card-issuing bank at the customer's request. Unlike refunds, chargebacks result in fees and can affect your processing privileges if rates are too high.

A hosted or embedded checkout experience. Checkout Sessions handle the full payment flow (form display, validation, 3DS, confirmation) and redirect to your success/cancel URLs.

A unique, time-limited token returned when creating a Payment Intent. It allows the client-side SDK to confirm the payment without exposing your secret API key. Never log or share the client secret.

A challenge to a transaction raised by a customer with their card issuer. Merchants have a window to submit evidence and contest the dispute. ClapPay notifies you via webhook when a dispute is opened.

ClapPay's single-embed payment component. Renders a complete payment form (method selection, card fields, 3DS) in one iframe. Requires only a Drop-In Session and publishable key on the client side.

ClapPay's low-level UI components for building custom payment forms. Each Element (CardElement, CardNumberElement, etc.) is a secure iframe fragment that captures card data without PCI scope on your servers.

Foreign exchange rate between two currencies. ClapPay provides real-time FX rates via the `/api/v1/fx/` service and a proxy at `/api/v1/payment/v2/fx-rates/` for checkout convenience.

Hash-based Message Authentication Code. ClapPay uses HMAC-SHA256 to sign webhook payloads. Verify the signature using your webhook secret to ensure the payload is genuine and unmodified.

A unique key you provide on POST requests to safely retry them without creating duplicate records. If the same key is used twice with the same parameters, the second call returns the cached result.

A token issued by the card network (Visa, Mastercard) to replace the physical card number (PAN). Network tokens are device-bound and automatically updated when a card is replaced, reducing payment failures.

Settlement of funds using a public blockchain (e.g., Ethereum, Solana). Faster than traditional banking rails for certain corridors. ClapPay supports on-chain settlement for merchants that accept stablecoins.

A ClapPay object that tracks the lifecycle of a payment. A Payment Intent moves through statuses: requires_payment_method → requires_confirmation → requires_action → processing → succeeded/failed.

A transfer of collected funds from your ClapPay balance to your linked bank account. Payouts occur on your configured schedule (daily, weekly, or monthly).

Payment Card Industry Data Security Standard. A set of security standards for organizations that handle credit card data. ClapPay is PCI Level 1 certified; using Elements or Drop-In minimizes your own PCI scope.

An authorization that explicitly delays capture. Used in hotels, car rentals, and other industries where the final charge amount may differ from the initial hold.

A key prefixed with pk_live_ or pk_test_ used on the client side to initialize the ClapPay SDK. Unlike the secret key, it is safe to expose in browser-side code.

A return of funds to the customer, initiated by the merchant. Refunds can be full or partial. They reference a succeeded Payment Intent and typically settle in 5–10 business days.

A 0–100 score assigned to each transaction by ClapPay's fraud engine. Higher scores indicate higher fraud risk. You can configure rules to block, flag, or allow transactions based on risk score thresholds.

A key prefixed with sk_live_ or sk_test_ used to authenticate server-side API requests. Never expose this in client-side code or public repositories.

The process by which funds from completed transactions are transferred to your bank account. ClapPay settles funds on a rolling basis (typically T+1 or T+2) according to your payout schedule.

A cryptocurrency pegged to a fiat currency (e.g., USDC ≈ 1 USD). ClapPay supports stablecoin payments and settlements, offering merchants a bridge between crypto and fiat.

An EU regulatory requirement under PSD2 requiring two-factor authentication for electronic payments. ClapPay automatically handles SCA flows and retries.

A non-persisting calculation that estimates applicable tax for a transaction before payment. Uses country, state, and amount to compute tax rates from ClapPay's TaxRate database.

Value Added Tax (Europe) or Goods and Services Tax (Australia, Canada, India). Digital goods and services sold cross-border often require collecting and remitting these taxes. ClapPay supports VAT/GST invoicing.

An HTTP POST request sent by ClapPay to your server when an event occurs (e.g., payment_intent.succeeded). Webhooks are signed with HMAC-SHA256 for verification.