FAQ

How long does the token expire?

As long as the customer's credit card is not expired, the token won't expire and still be usable.

How many tokens can a user create?

One card will be linked to one token. A customer can generate multiple tokens. Coda will have rules to avoid risk patterns of the same user creating too many tokens in a short period of time.

Once a user has activated a token, within the validity period, can the user initiate payment directly?

Once the user has the token, the charge can be initiated. There is no delay between tokenization and charge actions.

In the case of failed notification, does Coda have a retry mechanism? What is the retry strategy?

Currently we don't have a retry feature for webhooks sending, but partners can use the "Retrieve Charges" feature to check the latest status of an entity.

We may have retry functionality in the future, which is why we encourage partners to check webhook idempotency (mentioned in the documentation).

Is it required to install an SSL server certificate in order to use Tokenization API 2.0?

It is not required to install a custom SSL certificate.

Is USD supported in Tokenization API 2.0?

Currently, we only support local currency.

For the "charges" interface, will Codapay return a Success / Failed response and redirect customer to the merchant page?

At the moment we have no ability to manage return URLs.

In fraud cases, are there instances of payment rejection occurring directly with the bank or channel without the merchant's authorization? (Malicious refunds, refusals to pay)

Succeeded charges are always coming from authorized charges.

How to check the token status?

Call the Retrieve Token

How does Coda handle chargeback for Tokenization API in the future?

There will be no changes to the current process for Tokenization 2.0. Coda Risk Operations will contact the publisher for proof of delivery when disputes are received from payment channels, and Coda will contest the dispute on behalf of the publisher.

One-click payments do pose a greater risk as they allow users to conduct recurring transactions without having to re-enter their card details. Any additional authentication, the control measure are managed by the payment channels (Gopay, Mada, Dana) risk systems.

What is the definition of a valid token?

token with status code = authorised

Does Coda Mada support removing the bound card information?

No, we do not support the cancellation of token/payment info functionality for Card- Mada at the moment.