> For the complete documentation index, see [llms.txt](https://docs.omni.integratedcommerce.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.omni.integratedcommerce.io/payments/card-not-present.md).

# Card not present

Online payments through Hosted Payment Forms, with AVS and CVV validation.

For online payments, the API provides Hosted Payment Forms for payment transactions and secure card data collection for tokenization. Card data is entered into the form, which is hosted outside your environment. It never touches your servers.

There are two ways to render that form:

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Hosted Payment Form</strong></td><td>Embed a short-lived iframe URL. Least code, no wallet buttons.</td><td><a href="/hosted-payment-form/hosted-payment-form.md">Overview</a></td></tr><tr><td><strong>Payment SDK</strong></td><td>Mount a web component. Adds Apple Pay and Google Pay, and JavaScript callbacks.</td><td><a href="/payment-sdk/payment-sdk.md">Overview</a></td></tr></tbody></table>

Both are driven by the same endpoints and return the same `sessionId`.

## Supported transaction types

The API supports the following Card Not Present transaction types:

* **Authorization** - Verification with the Issuer if the card is valid for payment. The authorization amount is reserved, but not captured/settled. Includes AVS (Address Verification Service) and CVV validation support.
* **Capture** - Complete a previously authorized transaction. The cardholder is billed for the transaction, and the transaction is settled to the merchant.
* **Sale** - Combined authorization and capture in a single step. Includes AVS and CVV validation support.
* **Refund** - Process reversal of a previous sale transaction (automatically performs a void if the transaction is in the current batch, or a refund if already settled).
* **Void** - Cancel a previously completed transaction (sale, authorization or capture) if it is still in the current batch (typically same day).

## Endpoints

| Operation                       | Endpoint                          |
| ------------------------------- | --------------------------------- |
| Sale                            | `POST /transactions/virtual-sale` |
| Authorization                   | `POST /transactions/virtual-auth` |
| Capture                         | `POST /transactions/capture`      |
| Refund                          | `POST /transactions/refund`       |
| Void                            | `POST /transactions/void`         |
| Tokenize a card or bank account | `POST /payment-methods/virtual`   |

Each of the three session-creating endpoints returns a `sessionId`, a short-lived iframe URL, and an expiration timestamp.

## AVS and CVV

Address Verification Service and CVV validation are supported on card-not-present sales and authorizations. How much address data you collect is controlled by [`formConfig.billingInfoCaptureLevel`](/hosted-payment-form/form-configuration.md) - `Minimal` collects country and ZIP or postal code for basic AVS.

## 3D Secure

Card-not-present sessions can opt into 3DS2 cardholder authentication, which shifts chargeback liability for fraud to the issuer on successfully authenticated transactions. See [3D Secure](/hosted-payment-form/3d-secure.md).

## Testing

See [Test cards](/going-live/test-cards.md#virtual-test-cards-for-card-not-present-transactions) for the approved, declined, and error-scenario card numbers.