> **Description:** Visual walkthrough of the one-time payment QR flow for PSPs using card passthrough with the ePayment API.

> **AI agent:** Read [https://developer.vippsmobilepay.com/docs/knowledge-base/ai-tools.md](https://developer.vippsmobilepay.com/docs/knowledge-base/ai-tools.md) first. It covers keeping API keys and secrets out of generated code.

> **Full site overview:** For every page in this documentation, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).

# How one-time payment QRs work for PSPs

This flow uses a one-time payment QR (a dynamic QR) shown on a screen, for PSPs using `CARD_PASSTHROUGH` with the
ePayment API.

Flow diagram: A one-time payment QR code displayed on a screen. The customer scans the QR
code with the Vipps or MobilePay app to authorize the payment.

The QR directs the customer to the Vipps  or MobilePay  app, where they select a
card and authorize the payment.

## Details

A [one-time payment QR code](https://developer.vippsmobilepay.com/docs/APIs/qr-api/api-guide/one-time-payment.md) is presented on the vending
machine or screen. The QR code is a dynamic representation of the payment URL, and the customer needs to scan it
and pay within 10 minutes.

### 1. The PSP generates a dynamic QR code and payment request

When the customer selects a product, the PSP generates the payment request with a dynamic QR code by sending a
[`POST:/epayment/v1/payments`](https://developer.vippsmobilepay.com/redocusaurus/epayment-swagger-id.yaml) request with:

* `paymentMethod.type` set to `CARD_PASSTHROUGH`
* `userFlow` set to `QR` (optionally specify `qrFormat` and `size` for the QR)
* `"customerInteraction": "CUSTOMER_PRESENT"` (required by regulation)
* [`cardPassthrough`](https://developer.vippsmobilepay.com/docs/APIs/psp-epayment-api/epayment-psp-api-guide.md#cardpassthrough) object with the PSP's server URL specified in
  the `cardCallbackUrl` field
* [Other required parameters](https://developer.vippsmobilepay.com/docs/APIs/psp-epayment-api/epayment-psp-api-guide.md#parameters)

Since the customer scans the QR from their own phone, the PSP doesn't need to supply a phone number.

For a full example, see [Create a QR payment](https://developer.vippsmobilepay.com/docs/APIs/psp-epayment-api/epayment-psp-api-guide.md#create-a-qr-payment).

### 2. Display the QR on the screen

Display the one-time QR on a screen facing the customer.

### 3. The customer scans the QR and selects a card

The customer scans the QR code and is directed to the Vipps or MobilePay app, where they select a stored card and
confirm the payment.

### 4. Vipps MobilePay sends the card token to the PSP

When the customer confirms the payment and selects their card, Vipps MobilePay sends a card token to the PSP's
`cardCallbackUrl`. The PSP must respond within 20 seconds. See [Card callback](https://developer.vippsmobilepay.com/docs/APIs/psp-epayment-api/epayment-psp-api-guide.md#card-callback)
for the request format, HMAC authentication, and expected response.

### 5. The PSP processes the payment

The PSP processes the payment through its own acquiring infrastructure using the card token.

### 6. The PSP updates the payment status

The PSP captures, refunds, or cancels the payment via the ePayment API, keeping the Vipps MobilePay app status in
sync.

## More information

* For technical details, see the [ePayment PSP API guide](https://developer.vippsmobilepay.com/docs/APIs/psp-epayment-api/epayment-psp-api-guide.md).
* For QR code generation options, see [ePayment Features: Payment through a QR](https://developer.vippsmobilepay.com/docs/APIs/epayment-api/api-guide/features/qr-payments.md).