ePayment PSP API changelog

View as Markdown (opens in a new tab)

Install AI tools

Our plugin gives your assistant up-to-date guidance for payments and login. Full instructions

Claude Code

Run both commands, in order.

claude plugin marketplace add vippsas/agent-toolkit
claude plugin install vipps@agent-toolkit

Cursor

Open Settings, then Plugins.

Add vippsas/agent-toolkit as a plugin marketplace, then install the "vipps" plugin.

Codex

See the Codex plugin docs at developers.openai.com/codex.

Add vippsas/agent-toolkit as a plugin marketplace, then install the "vipps" plugin.

Any editor

No plugin needed. Paste this into your assistant.

Read https://developer.vippsmobilepay.com/llms.txt for the Vipps MobilePay developer documentation.

Note

This page covers ePayment API changes that are specific to PSP integrations. There may be additional changes that apply to all ePayment API integrations — see the ePayment API changelog.

June 2026

• softDeclineCompletedRedirectUrl is now a required field in the PSP card callback request. PSPs implementing the card passthrough callback must include this field.

May 2026

• Added the PSP card callback endpoint specification for PSP card passthrough payments. Vipps MobilePay POSTs card details to your cardCallbackUrl; your server must respond with the authorization result within 20 seconds.
  • The request body (CardCallbackRequest) includes pspReference, authorizationAttemptId, merchantSerialNumber, amount, softDeclineCompletedRedirectUrl, and cardInfo.
  • cardInfo contains maskedCardNumber, cardType, cardIssuedInCountryCode, cardDataType, and either a networkToken object or encryptedPan string depending on cardDataType.
  • The response (CardCallbackResponse) must have a status of RESERVE, SOFT_DECLINE, or FAIL, with corresponding required fields (networkTransactionReference, softDeclineUrl, or errorCode/errorMessage).
  • Callback requests are authenticated using HMAC-SHA256 signed with the PSP's client_secret. Verify the Authorization, X-Vipps-Authorization, x-ms-date, and x-ms-content-sha256 headers.

March 2026

• Added PSP support via the new CARD_PASSTHROUGH payment method type. PSPs can now create payments where the user's card token is sent to a PSP-controlled callback URL for processing. This requires:
  • paymentMethod.type set to CARD_PASSTHROUGH
  • A new cardPassthrough object in the create payment request body, specifying the callback URL, allowed card types, and optionally a public encryption key ID for receiving encrypted PANs
  • The Psp-Id header on all requests
  • See ePayment PSP API guide for details.