Questions

1. What is Forte Checkout?

2. What are the key benefits of Forte checkout? 

3. How does Forte Checkout differ from SWP? 

4. How is a payment completed using Forte Checkout? 

5. Why does a browser permission prompt appear when using a Card Reader with Forte Checkout? 

   5.1. How should the browser permission prompt be handled?

   5.2. What Should be done id a device access was previously blocked? 

   5.3. Does granting device access allow Forte Checkout to access other devices? 

6. How is the signature (Hash Code) generated and validated in Forte Checkout? 

   6.1. How is the Forte Checkout signature generated?

   6.2. Which parameters are used to generate the signature?

7. How can fields be configurated as editable, required, or hidden in Forte Checkout? 

    7.1. What other configuration options are available for managing or suppressing shipping address fields in       Forte Checkout? 

8. How is the Forte Checkout "Pay Now" button implemented using PHP? 

9. How are response codes used in Forte Checkout Webhooks? 

10. How is a token created in Forte Checkout?

    10. 1 How is a token created without generating a transaction in Forte Checkout? 

11. How is a schedule transaction button created in Forte Checkout? 

12. What is the difference between Forte Checkout v1 Auth and v2 Auth? 

13. Where can the API login ID and secure transaction key be found? 

14. Why does the Forte Checkout button not respond when clicked or appear unstyled? 

15. Why does Forte Checkout return an error in Internet Explorer 10?  

16. Can phone number fields be validated before form submission?  

17. Does Forte Checkout support Canadian eCheck transaction processing?  

18. What testing resources are available for Forte Checkout?   

CSCSG Forte Checkout is a hosted checkout solution that lets businesses accept payments on their own site without hosting their own payment form, helping reduce PCI scope while delivering a simple, configurable payment experience. 

For easily accept payments, it includes features such as customizable JavaScript integration, wallet storage, customer self-service updates for payment and address data, configurable form fields, flexible amount settings, and a checkout flow designed to reduce cart abandonment. 

• Reduces PCI scope by tokenizing payment data so card data does not touch the merchant environment and supports strong security through hash-based authentication. 
• Keeps checkout on the merchant’s own site with no redirects, which may help reduce cart abandonment. 
• Supports multiple payment types and features, including credit and debit cards, ACH or eCheck, tokenization, recurring schedules, stored payment methods, and digital wallets such as Apple Pay, Google Pay, and PayPal. 
• Offers configurable fields and amount options, works across desktop, tablet, and mobile devices, and integrates with callbacks, webhooks, and Dex for reporting and payment management. 

Forte Checkout provides a secure, hosted payment experience that guides customers through the payment process from initiation to confirmation. The standard transaction workflow consists of the following this steps: 

1. The billing application invokes Forte Checkout through a button code. When ready to make a payment, the customer selects the “Pay Now” button. 
2. The customer selects the desired payment method, enters the required information and click “Next”. 
3. To continue, the customer populates the billing details and click “Next”. Note: This information may be pre-populated through the Checkout button configuration, and merchants can control whether specific fields are required or optional. 
4. The customer reviews the payment and billing information to verify that all details are accurate before authorizing the transaction. Customer selects “Authorize” to submit the payment for processing. 

Upon successful processing, a confirmation callback response is returned directly to the billing platform. The billing application can then use this response to generate a confirmation page and customer receipt. 

Modern versions of Google Chrome and Microsoft Edge have implemented additional security controls that require users to explicitly authorize websites and applications to communicate with locally connected devices. When using a supported card reader with Forte Checkout, may receive a browser permission prompt requesting access to devices, local network resources, or applications on the computer. This access is required for Forte Checkout to communicate with the payment device and process transactions successfully. 

These browser permissions are required to allow Forte Checkout to establish communication with supported payment devices, such as V400C terminals and compatible card readers. Without the required authorization, the browser may block access to the device, preventing payment transactions from being initiated or completed successfully . 

Chrome Versions 142–144 

• If prompted that the CSG Forte product "Look for and connect to any device on your local network" select “Allow”. 
• Forte Checkout communicates only with the intended payment device and does not access other devices on local network.

Chrome Version 145 and Later 

• If prompted that the CSG Forte product "Access other apps and services on this device" select “Allow”. 
• This authorization enables communication between Forte Checkout and the connected payment device. 

Edge Versions 142–144 

• If prompted that the CSG Forte product "Look for and connect to any device on your local network" select “Allow” to continue using the card reader. 

Edge Version 145 and Later 

• If the permission prompt appears for the first time, simply select "Allow". 

Firefox (Newer Versions) 

• Firefox does not display a device-access prompt for supported payment devices. 
• However, merchants using a V400C terminal must ensure the latest Device Handler version is installed.
• Updated Device Handler software can be obtained through CSG Forte Developer Documentation or by contacting Technical Support. 

If permission was denied, access can be restored through the browser settings. 

Chrome Versions 142–144 

• Open the website's “Site Settings” and select “Reset Permission” to display the prompt again. 
• Alternatively, enable “Local Network Access” and reload the payment page. 
• Users may also navigate to: “Settings” > “Privacy and Security” > “Site Settings” > “Website” > “Local Network Access” > “Allow”.

Chrome Version 145 and Later 

• Open “Site Settings” and select “Reset Permission”. 
• Alternatively, navigate to: “Settings” > “Privacy and Security” > “Site Settings” > “Website” > “Apps on Device” > “Allow”. 

Edge Versions 142–144 

• Change “Local Network Access” to “Allowed” and refresh the payment page. 
• Alternatively, change the setting to “Ask” and “Refresh” to display the permission request again. 
• Users may also navigate to: “Settings” > “Privacy and Security” > “Site Settings” > “Website” > “Local Network Access” > “Allow” 

Edge Version 145 and Later 

• Change “Apps on Device” to “Allowed” and reset permissions if necessary. 
• Alternatively, navigate to: “Settings” > “Privacy and Security” > “Site Settings” > “Website” > “Apps on Device” > “Allow”. 

No. Forte Checkout uses the browser permission solely to communicate with the designated payment device needed for transaction processing. It does not access other devices or services on the local network beyond the permissions required to support the payment transaction process.

Forte Checkout uses a cryptographic signature (hash code) to validate transaction requests and confirm the authenticity of callback and Webhook responses. This security mechanism helps ensure that transaction data has not been altered and verifies that communications originate from a trusted source. The signature must be validated for all callback and webhook responses, as failure to verify the returned signature could introduce security vulnerabilities into an implementation.

Forte Checkout Version 2 authentication uses an HMACSHA256 hash generated from a combination of transaction-specific values and the merchant's API Secure Key. 

Example format: 

The resulting hash value is passed to Forte Checkout using the signature parameter. This signature uniquely represents a specific transaction for a specific merchant implementation

Send the hashed values in signature parameter, a character string of varying length (depending on the hash method) that is used to represent a specific transaction for a specific merchant in Forte Checkout. Forte Checkout V2 Auth – CSG Forte

Forte Checkout allows merchants to customize the behavior of payment and customer information fields by using field attributes. By appending the parameter to supported fields, merchants can specify whether a field should be editable, required, or hidden during the checkout process. These settings provide greater control over the customer experience while ensuring that necessary transaction data is collected. 

Example: 

In addition to using field attributes such as edit, required, and hide to control the behavior of individual fields, Forte Checkout provides an alternative configuration option that allows merchants to suppress the entire shipping address section during the checkout process. 

When shipping information is not required for a transaction, merchants may disable shipping address collection by setting the “collect_shipping_address” parameter to “false”, by configuring this parameter, the shipping address section is removed from the customer-facing checkout experience, eliminating the need to individually configure shipping-related fields using the hide attribute 

Additionally, when populating billing information programmatically, merchants should ensure that the appropriate country value is supplied. For example: billing_country=“US”. Providing a valid country value helps support accurate field population, address validation, and overall transaction processing. Proper configuration of country information may also improve data consistency and reduce validation-related issues during checkout. 

Forte Checkout provides a PHP implementation example that demonstrates how to configure a ”Pay Now” button in a Sandbox environment. The button passes the required transaction parameters, generates a transaction signature (hash), and initiates the payment process when selected by the customer. 

The PHP implementation includes the following key components: 

• API Login ID: Identifies the merchant account. 
• Version Number: Specifies the Checkout authentication version. 
• Total Amount: Indicates the transaction amount. 
• UTC Time: Provides the timestamp required for transaction validation. 
• Order Number: Associates the payment with a specific order. 
• Transaction Method: Defines the payment transaction type.
•  Signature (Hash): Authenticates the transaction request using the merchant's Secure Transaction Key. 

The hash is generated using the transaction parameters and Secure Transaction Key before being passed to the Checkout button as the signature parameter. 

Example: 

Forte Checkout Webhooks send asynchronous, server-to-server notifications to a merchant-defined endpoint after manually completed transaction requests. Webhooks must currently be configured by CSG Forte IT, and CSG Forte recommends using them for server-side actions such as order fulfillment or marking a payment as paid. 

Within Webhook data, the transaction result is typically found in the response object. The key field to review is “response_code”, which represents the transaction result, while “response_desc” provides the text description. In the sample transaction payload, a response code such as A01 with “response_desc” of TEST APPROVAL indicates an approved transaction result. 

Depending on Webhook subscriptions, a single checkout action can trigger multiple events. For example, one credit card sale that also creates customer and “paymethod” tokens can generate “transaction.sale”, “customer.create”, and “paymethod.create”, all grouped under a shared “event_id” for easier tracking. 

Supported Webhook events in both version 2 and version 3 are: 

• transaction.sale 
• transaction.authorize 
• customer.create 
• customer.update 
• paymethod.create 
• paymethod.update 

Version 3 also supports: 

• schedule.create 
• schedule.update 

Be aware that, based on subscription setup, similar data may be delivered more than once across separate Webhook events. Also, transaction voids, credits, and updates to individual schedule items are not handled through these webhook events and must instead be completed through the appropriate Forte REST API version. If endpoint does not return HTTP 200, CSG Forte treats the webhook post as failed and retries it up to 20 times, adding one minute for each retry. 

To create a token in Forte Checkout, merchants must pass the following parameters in their button code:

CSG Forte returns token values in the callback response after a successful request. the callback message like the one displayed below:

To create a token without generating a transaction in Forte Checkout, use method="token" in the button code. The Checkout token method creates both customer and payment method tokens or generates a new payment method token for an existing customer, and that no transaction is generated.

To create a schedule transaction button in Forte Checkout, use method="schedule" in the button code. Checkout explains that the schedule method is used to schedule either a single future-dated transaction or a recurring schedule. 

The key schedule-specific parameters are schedule_start_date, schedule_frequency, schedule_quantity, and schedule_continuous. schedule_start_date must be today or later, schedule_frequency supports values such as weekly, bi-weekly, monthly, bi-monthly, quarterly, semi-annually, and annually, and schedule_continuous=true means the schedule continues until it is suspended or deleted. 

The examples show two common ways to present the schedule button: 

• Option 1: a full HTML document that includes the Forte Checkout JavaScript, stylesheet, callback function, and the schedule button. 

• Option 2: a button-only HTML example that can be inserted into an existing page where the supporting scripts are already handled.

In Forte Checkout, the auth version refers to the type of merchant credentials used in the button code, not the software release version of Checkout itself. For v1 Auth, the button uses legacy merchant credentials with “version_number="1.0" and an “api_login_id”. For v2 Auth, the button uses organization API credentials with “version_number="2.0" and requires “api_access_id” plus “location_id”. 

For v1-style authentication, the merchant identifier is the legacy “api_login_id”. For v2-style authentication, the merchant is identified through the organization’s API credentials and the location where the transaction is processed. 

The CSG Forte developer documentation currently published online is for Forte Checkout v2 Auth. The page shows “version_number” as 2.0, explains how to generate API credentials in Dex, and identifies “location_id” as the merchant location under which the transaction is processed. 

Dex is the merchant portal used to manage organizations, locations, and developer credentials. The Dex support portal includes articles for creating API credentials, managing legacy credentials, and accessing locations, which aligns with the v2 and legacy credential workflows. 

To obtain the API Login ID and Secure Transaction Key for a Forte Checkout integration that uses legacy credentials, sign in to “Virtual Terminal”, then navigate to “Gateway Settings” and select “Gateway Keys”. From there, can view or manage the credentials required for the integration.

This issue may occur if the customer environment is blocking the Checkout script URL or if the required Checkout JavaScript has not been included correctly in the HTML page. CSG Forte recommends verifying in the browser’s network console that the JavaScript file loads successfully and confirming that the appropriate script reference is present in the section of the page.

For legacy v1 implementations, the production script is: 

• <script type="text/javascript" src="https://checkout.forte.net/v1/js"></script

For legacy v2 implementations, the production script is  

• <script type="text/javascript" src="https://checkout.forte.net/v2/js"></script

This issue can occur when Internet Explorer 10 is running in “Compatibility View”. Forte Checkout requires “Standard View”, and the Checkout modal may not display correctly while “Compatibility View” is enabled. 

To resolve the issue, complete the following steps: 

1. Access the “Compatibility View Settings” window from the “Tools” menu in Internet Explorer. 
2. Remove the local host from the list of websites added to “Compatibility View” (if listed). 
3. Uncheck the box “Display intranet sites in Compatibility View” (if checked). 
4. Click “Close” to fix the error. 

Yes. CSG Forte indicates that validation is possible, although the approach depends on the technology used in integration. The recommendation is to use either a jQuery validation plugin or an Angular custom directive to validate data in the payment form before submission.

Yes. Forte Checkout supports both U.S. and Canadian transaction processing. However, Canadian merchants must be configured with a Canadian processor to use this functionality, Contact Customer Service for more information. 

When configured for Canadian ACH, the routing number can be entered as eight digits as it appears in the financial institution’s MICR code. Forte Checkout displays the appropriate financial institution based on that entry. In this format, the three-digit portion identifies the financial institution, and the five-digit portion identifies the branch. 

• For code samples, see our BitBucket repository here: Forte Payment Systems · GitHub
• To use our Forte Checkout Testing Workbench, see here: https://sandbox.forte.net/checkout/workbench/.