> **Description:** Let customers review and accept your terms of sale and privacy policy in the Vipps or MobilePay app.

> **AI agent:** Read [https://developer.vippsmobilepay.com/docs/knowledge-base/ai-tools.md](https://developer.vippsmobilepay.com/docs/knowledge-base/ai-tools.md) first. It covers keeping API keys and secrets out of generated code.

> **Full site overview:** For an overview of the entire site, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).

# Merchant terms

Provide your terms of sale and privacy policy directly in the Vipps or MobilePay app during the payment process.
Customers can review the information and must accept the merchant terms before continuing with the payment.

Merchant terms are supported in ePayment flows that use the Vipps or MobilePay app, including
[Express payments](https://developer.vippsmobilepay.com/docs/APIs/epayment-api/api-guide/features/express.md) that start outside your website, such as from a QR code or an advertisement.

We recommend using merchant terms together with either `receiptUrl` or `receipt` to provide the customer with an
order overview alongside the legal information.
See [Set order details](https://developer.vippsmobilepay.com/docs/APIs/epayment-api/api-guide/features/pre-built-order-management-api-integration.md) for details.

## User acceptance flow

When you include merchant legal links in the payment request, the customer sees an acceptance screen in the
Vipps or MobilePay app before completing the payment. The screen provides access to the legal links you supplied.
If you also include order details, the customer can open the order overview from this screen.

The customer must select **I accept** to continue with the payment.
If the customer cancels, they cannot proceed with that payment flow.

Screenshot: Vipps or MobilePay shows Sales terms and Privacy policy links,
an I accept button and a Cancel option.

## Authorization

All ePayment API requests must include a valid Bearer token in the `Authorization` header.
See [Authorization](https://developer.vippsmobilepay.com/docs/APIs/epayment-api/api-guide/concepts.md#authorization) for how to obtain one.

## Create a payment with merchant terms

Call [`POST:/epayment/v1/payments`](https://developer.vippsmobilepay.com/redocusaurus/epayment-swagger-id.yaml) with `merchantLegalLinks`.

For example:

```bash
curl -X POST https://apitest.vipps.no/epayment/v1/payments \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR-ACCESS-TOKEN" \
  -H "Ocp-Apim-Subscription-Key: YOUR-SUBSCRIPTION-KEY" \
  -H "Merchant-Serial-Number: YOUR-MSN" \
  -H "Idempotency-Key: YOUR-IDEMPOTENCY-KEY" \
  -H "Vipps-System-Name: acme" \
  -H "Vipps-System-Version: 3.1.2" \
  -H "Vipps-System-Plugin-Name: acme-webshop" \
  -H "Vipps-System-Plugin-Version: 4.5.6" \
  -d '{
    "amount": {
      "value": 49900,
      "currency": "NOK"
    },
    "paymentMethod": {
      "type": "WALLET"
    },
    "customer": {
      "phoneNumber": "4712345678"
    },
    "reference": "UNIQUE-PAYMENT-REFERENCE",
    "userFlow": "WEB_REDIRECT",
    "returnUrl": "https://example.com/redirect?reference=UNIQUE-PAYMENT-REFERENCE",
    "paymentDescription": "Acme Webshop order 1234",
    "receiptUrl": "https://example.com/receipts/1234",
    "merchantLegalLinks": {
      "termsOfSaleUrl": "https://example.com/terms-of-sale",
      "privacyPolicyUrl": "https://example.com/privacy-policy"
    }
  }'
```

Both fields in `merchantLegalLinks` are optional and can be used independently:

- `termsOfSaleUrl`: Link to your terms of sale.
- `privacyPolicyUrl`: Link to your privacy policy.

Provide at least one of these links when you include `merchantLegalLinks`.
Use publicly accessible HTTPS URLs so customers can open the documents from the payment app.
Each URL can contain up to 2,500 characters.

The example uses `receiptUrl` to provide an order overview. Alternatively, include a `receipt` object with order lines.

The merchant is responsible for the content of the linked documents and for meeting applicable legal requirements.