Configure Google Pay — type: DIRECT

In your Google Pay API configuration, set the tokenization type to DIRECT. This tells Google Pay to use your own merchant public key for encryption, which your server will decrypt.

"type": "DIRECT"

  Receive the Encrypted Token from Google Pay

After the customer approves the payment, Google Pay returns an encrypted token from paymentMethodData.tokenizationData.token. The outer envelope uses the ECv2 protocol.

{
  "protocolVersion": "ECv2",
  "signedMessage": "...",
  "signature": "...",
  "intermediateSigningKey": {
    "signedKey": "...",
    "signatures": ["..."]
  }
}

  Decrypt the Token (ECv2)

Always verify the Google signature chain before decrypting. This prevents token forgery and replay attacks.

{
  "gatewayMerchantId": "94087155",
  "messageExpiration": "1741304144394",
  "messageId": "AH2EjtdzTuvrRcGAbH2k9B...",
  "paymentMethod": "CARD",
  "paymentMethodDetails": {
    "expirationYear": 2030,
    "expirationMonth": 10,
    "pan": "1234567890123456",
    "authMethod": "CRYPTOGRAM_3DS",
    "eciIndicator": "07",
    "cryptogram": "xQBBBBBB12abCDefGh+9Z0AAAA="
  }
}

  Convert the Cryptogram from Base64 to HEX

The cryptogram returned by Google Pay is Base64-encoded. PayFacto requires it in hexadecimal (HEX) format. Convert it before building the charge request.

import java.util.HexFormat;

public String getCryptogramHexString(final GooglePayPaymentPlainData plainData) {
    final String base64String = plainData.getCryptogram3ds();
    final byte[] bytes = decodeBase64(base64String);
    return HexFormat.of().formatHex(bytes);
}

  Build and Submit the Charge

Use paymentMethod.type: "CARD" with a card.authentication.wallet block. Set wallet.type to GOOGLE_PAY and pass the HEX-encoded cryptogram.

{
  "amount": "5000",
  "invoiceNumber": "123456789012",
  "capture": true,
  "paymentMethod": {
    "type": "CARD",
    "card": {
      "number": "1234567890123456",
      "expiry": {
        "month": "08",
        "year": "2030"
      },
      "authentication": {
        "wallet": {
          "eciIndicator": "05",
          "type": "GOOGLE_PAY",
          "cryptogram": "C50041041041075D9A6C305E9C1FBD6740000000"
        }
      }
    }
  }
}

  Configure Google Pay — gateway: payfacto

In your Google Pay API configuration, set the tokenization type to PAYMENT_GATEWAY and specify payfacto as the gateway. The gatewayMerchantId is your PayFacto merchant account UUID, found in the merchant back office.

{
  "tokenizationSpecification": {
    "type": "PAYMENT_GATEWAY",
    "parameters": {
      "gateway": "payfacto",
      "gatewayMerchantId": "merchant_123"
    }
  }
}

  Receive and Forward the Token

With PAYMENT_GATEWAY mode, Google returns a complete encrypted token payload. Your server does not need to decrypt it. Extract the full value of paymentMethodData.tokenizationData.token as a JSON string and pass it directly to PayFacto as paymentData.

Pass the token value exactly as received — as a JSON string. Do not parse, modify, or re-serialize it. PayFacto will handle all decryption internally.

  Build and Submit the Charge

Use paymentMethod.type: "CARD" with a card.authentication.wallet block. Set wallet.type to GOOGLE_PAY and pass the raw token JSON string as wallet.paymentData. No card number, expiry, or cryptogram are required.

{
  "amount": "10000",
  "invoiceNumber": "581113481611",
  "capture": true,
  "metadata": {
    "device_type": "android"
  },
  "paymentMethod": {
    "type": "CARD",
    "card": {
      "authentication": {
        "wallet": {
          "type": "GOOGLE_PAY",
          "paymentData": "{\"signature\":\"MEUCIHcdC0B4TKe...\",\"protocolVersion\":\"ECv2\",\"signedMessage\":\"{\\\"encryptedMessage\\\":\\\"kQl0kOsKNhE3FQ...\\\"}\"}"
        }
      }
    }
  }
}