Hosted Components

MPI Parameters

Fill in the fields below to submit to the CTBC MPI endpoint

merid

Transaction Type

MPIEnc

Simulate Successful Transaction

Redirect Method to 3DS Page

Redirect parent page to 3DS pageThe form targets the top window (_top), so the parent page navigates away. From the parent's own Submit button this needs Ezypay's script on the parent page, or an iframe with sandbox="... allow-top-navigation"; otherwise the browser blocks it. A click inside this page always works.

Open the 3DS page in a popup windowThis page opens the popup itself (CTBC cannot be shown in an iframe/modal). Needs a user click inside this page, otherwise the popup blocker rejects it.

Parent page loads Ezypay's JS script and opens the 3DS page in a popup with itPosts an EZYPAY_3DS_OPEN message to the parent, which opens the popup. Requires /ezypay-3ds.js to be loaded on the parent page.

How the parent page passes successUrl / cancelUrl

Query string of this pageLoad /mpi?successUrl=https://...&cancelUrl=https://... (same params as /paymentmethod/embed). Works with no script and with a native button inside the iframe.

postMessage from the parent pageThe parent sends { actionType: "setReturnUrls", successUrl, cancelUrl } when this page announces EZYPAY_MPI_READY. Independent of the "create" message.

Ezypay's JS script on the parent pageThe parent calls Ezypay3ds.init({ successUrl, cancelUrl }); the script relays them to this page as EZYPAY_3DS_CONFIG. Requires /ezypay-3ds.js on the parent page.

successUrl: not received (or not a valid https URL)

cancelUrl: not received (or not a valid https URL)

Simulate /auth API callAll redirect options: the 3DS window (the popup, or the top window for option 1) opens /mpi/auth, which calls a dummy authentication API (about 3 seconds) and then sends the window to CTBC with the default values the API returns. When the 3DS page POSTs back to /paymentmethod/processing, that page redirects to successUrl or cancelUrl.

How this page hands successUrl / cancelUrl to /auth

Sends the URLs received above on to /auth, which shows what it got. Only used when "Simulate /auth API call" is on.

URL query string/mpi/auth?successUrl=...&cancelUrl=... Works for all three redirect options. The URLs show up in the address bar, history and server logs.

URL fragment (#)/mpi/auth#successUrl=...&cancelUrl=... Works for all three redirect options. The browser never sends the fragment to the server or in a Referer header.

postMessage to the popup (options 2 and 3 only)Option 2: this page keeps the popup reference and posts to it. Option 3: this page asks the parent script to post to the popup it opened. Not possible for option 1: the iframe is destroyed when the top window navigates to the auth page.

CTBC MPI Test Lab

MPI Parameters