International Gateway

How it works

1. 1

   Tokenise the card

   POST to /v1/payment_methods with type=card and the raw card fields. This returns a pm_ token. Your servers only ever handle the token — the raw PAN never touches your infrastructure again.
2. 2

   Create a PaymentIntent

   POST to /v1/payment_intents with provider=cybersource_cnp, the payment_method token, and the charge amount. Pass setup_future_usage=off_session if you plan to charge the card again without the cardholder present.
3. 3

   3DS2 challenge (if required)

   If the issuer requires authentication, next_action.type is three_d_secure. Redirect the customer to next_action.redirect_url. MerasPay hosts the 3DS challenge flow and handles the ACS callback.
4. 4

   Customer completes challenge

   The cardholder authenticates with their issuing bank on the 3DS page. MerasPay receives the authentication result and passes it to Cybersource.
5. 5

   Intent transitions automatically

   After authentication (or immediately if 3DS was not required), Cybersource authorises the charge and MerasPay transitions the intent to succeeded. No confirm call is needed for the 3DS path.
6. 6

   Receive the webhook

   payment_intent.succeeded fires on your webhook endpoint. Use this as the authoritative fulfillment signal.

Endpoints

The International Gateway uses the same PaymentIntents API as domestic rails. Pass provider=cybersource_cnp — no separate endpoint set.

Tokenise a card

The returned pm_ token is reusable — store it against the customer for future charges.

3DS2 next_action shape

When the intent requires 3DS authentication, the create response contains:

{
  "type": "three_d_secure",
  "redirect_url": "https://3ds.merashub.com/auth/pi_01J4KM...",
  "return_url": "https://yourapp.com/checkout/return"
}

Redirect the customer to redirect_url. After the challenge, MerasPay redirects the cardholder to return_url and the intent transitions server-side. Poll or listen for the webhook — do not rely solely on the return redirect.

Supported cards and currencies

Test cards

Use any future expiry date, CVC 123 (or 1234 for Amex), and any billing postcode in sandbox.

Example — card payment with pm_ token

curl -X POST https://api.merashub.com/v1/payment_methods \
  -H "Authorization: Bearer sk_test_..." \
  -H "Content-Type: application/json" \
  -d '{
    "type": "card",
    "card": {
      "number": "4111111111111111",
      "exp_month": 12,
      "exp_year": 2029,
      "cvc": "123"
    },
    "billing_details": {
      "name": "Amina Hassan",
      "email": "amina@example.com"
    }
  }'

{
  "id": "pm_01J5RQ2XVZB3RN4TQ8E7PWCARD",
  "type": "card",
  "card": {
    "brand": "visa",
    "last4": "1111",
    "exp_month": 12,
    "exp_year": 2029,
    "funding": "credit"
  },
  "billing_details": {
    "name": "Amina Hassan",
    "email": "amina@example.com"
  },
  "created_at": "2026-05-25T10:00:00Z"
}

curl -X POST https://api.merashub.com/v1/payment_intents \
  -H "Authorization: Bearer sk_test_..." \
  -H "Idempotency-Key: order_7791" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 12000,
    "currency": "USD",
    "provider": "cybersource_cnp",
    "payment_method": "pm_01J5RQ2XVZB3RN4TQ8E7PWCARD",
    "description": "Order #7791"
  }'

{
  "id": "pi_01J5RQ9ABCDE4TM5FW9E2VKCNP",
  "status": "succeeded",
  "amount_minor": 12000,
  "currency": "USD",
  "provider": "cybersource_cnp",
  "payment_method": "pm_01J5RQ2XVZB3RN4TQ8E7PWCARD",
  "fraud_details": {
    "decision": "ACCEPT",
    "score": 14
  },
  "succeeded_at": "2026-05-25T10:00:02Z"
}