Bug: add new authentication to communicate between Subscription microservice and payments microservice




diff --git a/config/config.example.toml b/config/config.example.toml
index 91966eaab12..d7273fe35b3 100644
--- a/config/config.example.toml
+++ b/config/config.example.toml
@@ -1269,3 +1269,8 @@ encryption_key = ""                            # Key to encrypt and decrypt chat
 proxy_connector_http_status_code = false    # If enabled, the http status code of the connector will be proxied in the response
 [list_dispute_supported_connectors]
 connector_list = "worldpayvantiv"
+
+# Authentication to communicate between internal services using common_api_key, merchant id and profile id
+[internal_merchant_id_profile_id_auth]
+enabled = false # Enable or disable internal api key, merchant id and profile id based authentication
+internal_api_key = "test_internal_api_key" # API key for internal merchant id and profile id based authentication
\ No newline at end of file
diff --git a/config/deployments/env_specific.toml b/config/deployments/env_specific.toml
index b798d912dc9..d48ab2d148d 100644
--- a/config/deployments/env_specific.toml
+++ b/config/deployments/env_specific.toml
@@ -24,6 +24,10 @@ queue_strategy = "Fifo"   # Add the queue strategy used by the database bb8 clie
 [api_keys]
 hash_key = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" # API key hashing key.
 
+[internal_merchant_id_profile_id_auth]
+enabled = false
+internal_api_key = "test_internal_api_key"
+
 [applepay_decrypt_keys]
 apple_pay_ppc = "APPLE_PAY_PAYMENT_PROCESSING_CERTIFICATE"         # Payment Processing Certificate provided by Apple Pay (https://developer.apple.com/) Certificates, Identifiers & Profiles > Apple Pay Payment Processing Certificate
 apple_pay_ppc_key = "APPLE_PAY_PAYMENT_PROCESSING_CERTIFICATE_KEY" # Private key generated by Elliptic-curve prime256v1 curve. You can use `openssl ecparam -out private.key -name prime256v1 -genkey` to generate the private key
diff --git a/config/deployments/integration_test.toml b/config/deployments/integration_test.toml
index 8219ccf2206..489a865426c 100644
--- a/config/deployments/integration_test.toml
+++ b/config/deployments/integration_test.toml
@@ -904,3 +904,8 @@ connector_list = "worldpayvantiv"
 [grpc_client.unified_connector_service]
 ucs_only_connectors = "paytm, phonepe"    # Comma-separated list of connectors that use UCS only
 ucs_psync_disabled_connectors = "cashtocode"    # Comma-separated list of connectors to disable UCS PSync call
+
+# Authentication to communicate between internal services using common_api_key, merchant id and profile id
+[internal_merchant_id_profile_id_auth]
+enabled = false # Enable or disable internal api key, merchant id and profile id based authentication
+internal_api_key = "test_internal_api_key" # API key for internal merchant id and profile id based authentication
\ No newline at end of file
diff --git a/config/deployments/production.toml b/config/deployments/production.toml
index 394067bd85a..c4247d27839 100644
--- a/config/deployments/production.toml
+++ b/config/deployments/production.toml
@@ -914,3 +914,8 @@ click_to_pay = {connector_list = "adyen, cybersource, trustpay"}
 [grpc_client.unified_connector_service]
 ucs_only_connectors = "paytm, phonepe"    # Comma-separated list of connectors that use UCS only
 ucs_psync_disabled_connectors = "cashtocode"    # Comma-separated list of connectors to disable UCS PSync call
+
+# Authentication to communicate between internal services using common_api_key, merchant id and profile id
+[internal_merchant_id_profile_id_auth]
+enabled = false # Enable or disable internal api key, merchant id and profile id based authentication
+internal_api_key = "test_internal_api_key" # API key for internal merchant id and profile id based authentication
diff --git a/config/deployments/sandbox.toml b/config/deployments/sandbox.toml
index 07333518f64..052f8d1cae2 100644
--- a/config/deployments/sandbox.toml
+++ b/config/deployments/sandbox.toml
@@ -922,3 +922,8 @@ connector_list = "worldpayvantiv"
 [grpc_client.unified_connector_service]
 ucs_only_connectors = "paytm, phonepe"    # Comma-separated list of connectors that use UCS only
 ucs_psync_disabled_connectors = "cashtocode"    # Comma-separated list of connectors to disable UCS PSync call
+
+# Authentication to communicate between internal services using common_api_key, merchant id and profile id
+[internal_merchant_id_profile_id_auth]
+enabled = false # Enable or disable internal api key, merchant id and profile id based authentication
+internal_api_key = "test_internal_api_key" # API key for internal merchant id and profile id based authentication
\ No newline at end of file
diff --git a/config/development.toml b/config/development.toml
index 06283933305..70fca988bad 100644
--- a/config/development.toml
+++ b/config/development.toml
@@ -1383,3 +1383,7 @@ encryption_key = ""
 proxy_connector_http_status_code = false    # If enabled, the http status code of the connector will be proxied in the response
 [list_dispute_supported_connectors]
 connector_list = "worldpayvantiv"
+
+[internal_merchant_id_profile_id_auth]
+enabled = false
+internal_api_key = "test_internal_api_key"
\ No newline at end of file
diff --git a/config/docker_compose.toml b/config/docker_compose.toml
index 881de3aa4dc..0d77e4c66a5 100644
--- a/config/docker_compose.toml
+++ b/config/docker_compose.toml
@@ -1278,3 +1278,8 @@ version = "HOSTNAME"        # value of HOSTNAME from deployment which tells its
 proxy_connector_http_status_code = false    # If enabled, the http status code of the connector will be proxied in the response
 [list_dispute_supported_connectors]
 connector_list = "worldpayvantiv"
+
+# Authentication to communicate between internal services using common_api_key, merchant id and profile id
+[internal_merchant_id_profile_id_auth]
+enabled = false # Enable or disable internal api key, merchant id and profile id based authentication
+internal_api_key = "test_internal_api_key" # API key for internal merchant id and profile id based authentication
\ No newline at end of file
diff --git a/crates/router/src/configs/secrets_transformers.rs b/crates/router/src/configs/secrets_transformers.rs
index 53ce32b033e..67b6854922a 100644
--- a/crates/router/src/configs/secrets_transformers.rs
+++ b/crates/router/src/configs/secrets_transformers.rs
@@ -576,6 +576,7 @@ pub(crate) async fn fetch_raw_secrets(
         debit_routing_config: conf.debit_routing_config,
         clone_connector_allowlist: conf.clone_connector_allowlist,
         merchant_id_auth: conf.merchant_id_auth,
+        internal_merchant_id_profile_id_auth: conf.internal_merchant_id_profile_id_auth,
         infra_values: conf.infra_values,
         enhancement: conf.enhancement,
         proxy_status_mapping: conf.proxy_status_mapping,
diff --git a/crates/router/src/configs/settings.rs b/crates/router/src/configs/settings.rs
index 1923af66b35..5b669885d24 100644
--- a/crates/router/src/configs/settings.rs
+++ b/crates/router/src/configs/settings.rs
@@ -163,6 +163,7 @@ pub struct Settings<S: SecretState> {
     pub revenue_recovery: revenue_recovery::RevenueRecoverySettings,
     pub clone_connector_allowlist: Option<CloneConnectorAllowlistConfig>,
     pub merchant_id_auth: MerchantIdAuthSettings,
+    pub internal_merchant_id_profile_id_auth: InternalMerchantIdProfileIdAuthSettings,
     #[serde(default)]
     pub infra_values: Option<HashMap<String, String>>,
     #[serde(default)]
@@ -849,6 +850,13 @@ pub struct MerchantIdAuthSettings {
     pub merchant_id_auth_enabled: bool,
 }
 
+#[derive(Debug, Clone, Default, Deserialize)]
+#[serde(default)]
+pub struct InternalMerchantIdProfileIdAuthSettings {
+    pub enabled: bool,
+    pub internal_api_key: Secret<String>,
+}
+
 #[derive(Debug, Clone, Default, Deserialize)]
 #[serde(default)]
 pub struct ProxyStatusMapping {
diff --git a/crates/router/src/lib.rs b/crates/router/src/lib.rs
index c746410aa0d..679ef8aff32 100644
--- a/crates/router/src/lib.rs
+++ b/crates/router/src/lib.rs
@@ -67,6 +67,7 @@ pub mod headers {
     pub const X_API_VERSION: &str = "X-ApiVersion";
     pub const X_FORWARDED_FOR: &str = "X-Forwarded-For";
     pub const X_MERCHANT_ID: &str = "X-Merchant-Id";
+    pub const X_INTERNAL_API_KEY: &str = "X-Internal-Api-Key";
     pub const X_ORGANIZATION_ID: &str = "X-Organization-Id";
     pub const X_LOGIN: &str = "X-Login";
     pub const X_TRANS_KEY: &str = "X-Trans-Key";
diff --git a/crates/router/src/routes/app.rs b/crates/router/src/routes/app.rs
index 0d7da850f11..6aee34e8256 100644
--- a/crates/router/src/routes/app.rs
+++ b/crates/router/src/routes/app.rs
@@ -1174,7 +1174,7 @@ pub struct Subscription;
 #[cfg(all(feature = "oltp", feature = "v1"))]
 impl Subscription {
     pub fn server(state: AppState) -> Scope {
-        let route = web::scope("/subscription").app_data(web::Data::new(state.clone()));
+        let route = web::scope("/subscriptions").app_data(web::Data::new(state.clone()));
 
         route
             .service(web::resource("/create").route(
diff --git a/crates/router/src/routes/payments.rs b/crates/router/src/routes/payments.rs
index c1970b64c28..3bf2f472837 100644
--- a/crates/router/src/routes/payments.rs
+++ b/crates/router/src/routes/payments.rs
@@ -78,6 +78,25 @@ pub async fn payments_create(
 
     let locking_action = payload.get_locking_input(flow.clone());
 
+    let auth_type = match env::which() {
+        env::Env::Production => {
+            &auth::InternalMerchantIdProfileIdAuth(auth::HeaderAuth(auth::ApiKeyAuth {
+                is_connected_allowed: false,
+                is_platform_allowed: true,
+            }))
+        }
+        _ => auth::auth_type(
+            &auth::InternalMerchantIdProfileIdAuth(auth::HeaderAuth(auth::ApiKeyAuth {
+                is_connected_allowed: false,
+                is_platform_allowed: true,
+            })),
+            &auth::InternalMerchantIdProfileIdAuth(auth::JWTAuth {
+                permission: Permission::ProfilePaymentWrite,
+            }),
+            req.headers(),
+        ),
+    };
+
     Box::pin(api::server_wrap(
         flow,
         state,
@@ -98,22 +117,7 @@ pub async fn payments_create(
                 api::AuthFlow::Client,
             )
         },
-        match env::which() {
-            env::Env::Production => &auth::HeaderAuth(auth::ApiKeyAuth {
-                is_connected_allowed: false,
-                is_platform_allowed: true,
-            }),
-            _ => auth::auth_type(
-                &auth::HeaderAuth(auth::ApiKeyAuth {
-                    is_connected_allowed: false,
-                    is_platform_allowed: true,
-                }),
-                &auth::JWTAuth {
-                    permission: Permission::ProfilePaymentWrite,
-                },
-                req.headers(),
-            ),
-        },
+        auth_type,
         locking_action,
     ))
     .await
@@ -569,11 +573,15 @@ pub async fn payments_retrieve(
         is_platform_allowed: true,
     };
 
-    let (auth_type, auth_flow) =
-        match auth::check_client_secret_and_get_auth(req.headers(), &payload, api_auth) {
-            Ok(auth) => auth,
-            Err(err) => return api::log_and_return_error_response(report!(err)),
-        };
+    let (auth_type, auth_flow) = match auth::check_internal_api_key_auth(
+        req.headers(),
+        &payload,
+        api_auth,
+        state.conf.internal_merchant_id_profile_id_auth.clone(),
+    ) {
+        Ok(auth) => auth,
+        Err(err) => return api::log_and_return_error_response(report!(err)),
+    };
 
     let locking_action = payload.get_locking_input(flow.clone());
 
diff --git a/crates/router/src/services/authentication.rs b/crates/router/src/services/authentication.rs
index 851c2cf21b9..13d224a1cd7 100644
--- a/crates/router/src/services/authentication.rs
+++ b/crates/router/src/services/authentication.rs
@@ -38,6 +38,7 @@ use crate::core::errors::UserResult;
 #[cfg(all(feature = "partial-auth", feature = "v1"))]
 use crate::core::metrics;
 use crate::{
+    configs::settings,
     core::{
         api_keys,
         errors::{self, utils::StorageErrorExt, RouterResult},
@@ -155,6 +156,10 @@ pub enum AuthenticationType {
     WebhookAuth {
         merchant_id: id_type::MerchantId,
     },
+    InternalMerchantIdProfileId {
+        merchant_id: id_type::MerchantId,
+        profile_id: Option<id_type::ProfileId>,
+    },
     NoAuth,
 }
 
@@ -184,7 +189,8 @@ impl AuthenticationType {
                 user_id: _,
             }
             | Self::MerchantJwtWithProfileId { merchant_id, .. }
-            | Self::WebhookAuth { merchant_id } => Some(merchant_id),
+            | Self::WebhookAuth { merchant_id }
+            | Self::InternalMerchantIdProfileId { merchant_id, .. } => Some(merchant_id),
             Self::AdminApiKey
             | Self::OrganizationJwt { .. }
             | Self::UserJwt { .. }
@@ -1958,6 +1964,10 @@ impl<'a> HeaderMapStruct<'a> {
             })
     }
 
+    pub fn get_header_value_by_key(&self, key: &str) -> Option<&str> {
+        self.headers.get(key).and_then(|value| value.to_str().ok())
+    }
+
     pub fn get_auth_string_from_header(&self) -> RouterResult<&str> {
         self.headers
             .get(headers::AUTHORIZATION)
@@ -2309,6 +2319,96 @@ where
     }
 }
 
+/// InternalMerchantIdProfileIdAuth authentication which first tries to authenticate using `X-Internal-API-Key`,
+/// `X-Merchant-Id` and `X-Profile-Id` headers. If any of these headers are missing,
+/// it falls back to the provided authentication mechanism.
+#[cfg(feature = "v1")]
+pub struct InternalMerchantIdProfileIdAuth<F>(pub F);
+
+#[cfg(feature = "v1")]
+#[async_trait]
+impl<A, F> AuthenticateAndFetch<AuthenticationData, A> for InternalMerchantIdProfileIdAuth<F>
+where
+    A: SessionStateInfo + Sync + Send,
+    F: AuthenticateAndFetch<AuthenticationData, A> + Sync + Send,
+{
+    async fn authenticate_and_fetch(
+        &self,
+        request_headers: &HeaderMap,
+        state: &A,
+    ) -> RouterResult<(AuthenticationData, AuthenticationType)> {
+        if !state.conf().internal_merchant_id_profile_id_auth.enabled {
+            return self.0.authenticate_and_fetch(request_headers, state).await;
+        }
+        let merchant_id = HeaderMapStruct::new(request_headers)
+            .get_id_type_from_header::<id_type::MerchantId>(headers::X_MERCHANT_ID)
+            .ok();
+        let internal_api_key = HeaderMapStruct::new(request_headers)
+            .get_header_value_by_key(headers::X_INTERNAL_API_KEY)
+            .map(|s| s.to_string());
+        let profile_id = HeaderMapStruct::new(request_headers)
+            .get_id_type_from_header::<id_type::ProfileId>(headers::X_PROFILE_ID)
+            .ok();
+        if let (Some(internal_api_key), Some(merchant_id), Some(profile_id)) =
+            (internal_api_key, merchant_id, profile_id)
+        {
+            let config = state.conf();
+            if internal_api_key
+                != *config
+                    .internal_merchant_id_profile_id_auth
+                    .internal_api_key
+                    .peek()
+            {
+                return Err(errors::ApiErrorResponse::Unauthorized)
+                    .attach_printable("Internal API key authentication failed");
+            }
+            let key_manager_state = &(&state.session_state()).into();
+            let key_store = state
+                .store()
+                .get_merchant_key_store_by_merchant_id(
+                    key_manager_state,
+                    &merchant_id,
+                    &state.store().get_master_key().to_vec().into(),
+                )
+                .await
+                .to_not_found_response(errors::ApiErrorResponse::Unauthorized)?;
+            let _profile = state
+                .store()
+                .find_business_profile_by_merchant_id_profile_id(
+                    key_manager_state,
+                    &key_store,
+                    &merchant_id,
+                    &profile_id,
+                )
+                .await
+                .to_not_found_response(errors::ApiErrorResponse::Unauthorized)?;
+            let merchant = state
+                .store()
+                .find_merchant_account_by_merchant_id(key_manager_state, &merchant_id, &key_store)
+                .await
+                .to_not_found_response(errors::ApiErrorResponse::Unauthorized)?;
+            let auth = AuthenticationData {
+                merchant_account: merchant,
+                key_store,
+                profile_id: Some(profile_id.clone()),
+                platform_merchant_account: None,
+            };
+            Ok((
+                auth.clone(),
+                AuthenticationType::InternalMerchantIdProfileId {
+                    merchant_id,
+                    profile_id: Some(profile_id),
+                },
+            ))
+        } else {
+            Ok(self
+                .0
+                .authenticate_and_fetch(request_headers, state)
+                .await?)
+        }
+    }
+}
+
 #[derive(Debug)]
 #[cfg(feature = "v2")]
 pub struct MerchantIdAndProfileIdAuth {
@@ -4362,6 +4462,41 @@ pub fn is_jwt_auth(headers: &HeaderMap) -> bool {
     }
 }
 
+pub fn is_internal_api_key_merchant_id_profile_id_auth(
+    headers: &HeaderMap,
+    internal_api_key_auth: settings::InternalMerchantIdProfileIdAuthSettings,
+) -> bool {
+    internal_api_key_auth.enabled
+        && headers.contains_key(headers::X_INTERNAL_API_KEY)
+        && headers.contains_key(headers::X_MERCHANT_ID)
+        && headers.contains_key(headers::X_PROFILE_ID)
+}
+
+#[cfg(feature = "v1")]
+pub fn check_internal_api_key_auth<T>(
+    headers: &HeaderMap,
+    payload: &impl ClientSecretFetch,
+    api_auth: ApiKeyAuth,
+    internal_api_key_auth: settings::InternalMerchantIdProfileIdAuthSettings,
+) -> RouterResult<(
+    Box<dyn AuthenticateAndFetch<AuthenticationData, T>>,
+    api::AuthFlow,
+)>
+where
+    T: SessionStateInfo + Sync + Send,
+    ApiKeyAuth: AuthenticateAndFetch<AuthenticationData, T>,
+{
+    if is_internal_api_key_merchant_id_profile_id_auth(headers, internal_api_key_auth) {
+        Ok((
+            // HeaderAuth(api_auth) will never be called in this case as the internal auth will be checked first
+            Box::new(InternalMerchantIdProfileIdAuth(HeaderAuth(api_auth))),
+            api::AuthFlow::Merchant,
+        ))
+    } else {
+        check_client_secret_and_get_auth(headers, payload, api_auth)
+    }
+}
+
 pub async fn decode_jwt<T>(token: &str, state: &impl SessionStateInfo) -> RouterResult<T>
 where
     T: serde::de::DeserializeOwned,
diff --git a/loadtest/config/development.toml b/loadtest/config/development.toml
index 320488eddd2..c0bd9a58d2c 100644
--- a/loadtest/config/development.toml
+++ b/loadtest/config/development.toml
@@ -855,3 +855,8 @@ max_retry_count_for_thirty_day = 20
 [revenue_recovery.card_config.discover]
 max_retries_per_day = 20
 max_retry_count_for_thirty_day = 20
+
+# Authentication to communicate between internal services using common_api_key, merchant id and profile id
+[internal_merchant_id_profile_id_auth]
+enabled = false # Enable or disable internal api key, merchant id and profile id based authentication
+internal_api_key = "test_internal_api_key" # API key for internal merchant id and profile id based authentication
\ No newline at end of file

## Type of Change
<!-- Put an `x` in the boxes that apply -->

- [ ] Bugfix
- [X] New feature
- [ ] Enhancement
- [ ] Refactoring
- [ ] Dependency updates
- [ ] Documentation
- [ ] CI/CD

## Description
<!-- Describe your changes in detail -->
This pull request introduces a new authentication mechanism for internal service communication using a shared API key, merchant ID, and profile ID. The changes add configuration options for this authentication method across all environment config files, update the core settings and secrets transformers to support it, and implement the logic for handling requests authenticated via these headers in the payments route and authentication service.

### Additional Changes

- [ ] This PR modifies the API contract
- [ ] This PR modifies the database schema
- [ ] This PR modifies application configuration/environment variables

<!--
Provide links to the files with corresponding changes.

Following are the paths where you can find config files:
1. `config`
2. `crates/router/src/configs`
3. `loadtest/config`
-->


## Motivation and Context
<!--
Why is this change required? What problem does it solve?
If it fixes an open issue, please link to the issue here.

If you don't have an issue, we'd recommend starting with one first so the PR
can focus on the implementation (unless it is an obvious bug or documentation fix
that will have little conversation).
-->
Considering subscription as microservice, payment will be its dependant service, so for all the calls to payments service we need an authentication mechanism instead of using the actual merchant API key auth. so to achieve this we are adding a new authentication which will accept the merchant_id, profile_id and internal_api_key in the request headers and use it for authentication, API key auth/ Fallback auth will be used if one of the required parameter is missing the request.

## How did you test it?
<!--
Did you write an integration/unit/API test to verify the code changes?
Or did you test this change manually (provide relevant screenshots)?
-->

1. Create Merchant, API Key, Create Connector
2. Create a Payment with API key

Request
```
curl --location 'http://localhost:8080/payments' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'x-feature: router-custom-dbd' \
--header 'api-key: dev_CLbdgP5Lj11ZF7RfJgM4ck8Qk8AK5yzhEgpPr7d0MmSWC7FvLaQAKKUSOfXBasRD' \
--data-raw '{
  "amount": 6540,
  "currency": "USD",
  "confirm": true,
  "capture_method": "automatic",
  "capture_on": "2022-09-10T10:11:12Z",
  "amount_to_capture": 6540,
  "customer_id": "StripeCustomer",
  "email": "guest@example.com",
  "name": "John Doe",
  "phone": "999999999",
  "phone_country_code": "+1",
  "description": "Its my first payment request",
  "authentication_type": "no_three_ds",
  "return_url": "https://google.com",
  "payment_method": "card",
  "payment_method_type": "credit",
  "payment_method_data": {
    "card": {
      "card_number": "4242424242424242",
      "card_exp_month": "10",
      "card_exp_year": "25",
      "card_holder_name": "joseph Doe",
      "card_cvc": "123"
    }
  },
  "billing": {
    "address": {
      "line1": "1467",
      "line2": "Harrison Street",
      "line3": "Harrison Street",
      "city": "San Fransico",
      "state": "California",
      "zip": "94122",
      "country": "US",
      "first_name": "joseph",
      "last_name": "Doe"
    },
    "phone": {
      "number": "8056594427",
      "country_code": "+91"
    }
  },
  "shipping": {
    "address": {
      "line1": "1467",
      "line2": "Harrison Street",
      "line3": "Harrison Street",
      "city": "San Fransico",
      "state": "California",
      "zip": "94122",
      "country": "US",
      "first_name": "joseph",
      "last_name": "Doe"
    },
    "phone": {
      "number": "8056594427",
      "country_code": "+91"
    }
  },
  "statement_descriptor_name": "joseph",
  "statement_descriptor_suffix": "JS",
  "metadata": {
    "udf1": "value1",
    "new_customer": "true",
    "login_date": "2019-09-10T10:11:12Z"
  }
}'
```
Response
```
{"payment_id":"pay_EsecigedwijD3sy0IdXz","merchant_id":"merchant_1758720430","status":"succeeded","amount":6540,"net_amount":6540,"shipping_cost":null,"amount_capturable":0,"amount_received":6540,"connector":"cybersource","client_secret":"pay_EsecigedwijD3sy0IdXz_secret_uzmcKlyyzyDvVfJfYav2","created":"2025-09-24T13:44:59.316Z","currency":"USD","customer_id":"StripeCustomer","customer":{"id":"StripeCustomer","name":"John Doe","email":"guest@example.com","phone":"999999999","phone_country_code":"+1"},"description":"Its my first payment request","refunds":null,"disputes":null,"mandate_id":null,"mandate_data":null,"setup_future_usage":null,"off_session":null,"capture_on":null,"capture_method":"automatic","payment_method":"card","payment_method_data":{"card":{"last4":"4242","card_type":null,"card_network":null,"card_issuer":null,"card_issuing_country":null,"card_isin":"424242","card_extended_bin":null,"card_exp_month":"10","card_exp_year":"25","card_holder_name":"joseph Doe","payment_checks":{"avs_response":{"code":"Y","codeRaw":"Y"},"card_verification":{"resultCode":"M","resultCodeRaw":"M"}},"authentication_data":null},"billing":null},"payment_token":"token_qdq6SaWLktu6jk7HSVeB","shipping":{"address":{"city":"San Fransico","country":"US","line1":"1467","line2":"Harrison Street","line3":"Harrison Street","zip":"94122","state":"California","first_name":"joseph","last_name":"Doe","origin_zip":null},"phone":{"number":"8056594427","country_code":"+91"},"email":null},"billing":{"address":{"city":"San Fransico","country":"US","line1":"1467","line2":"Harrison Street","line3":"Harrison Street","zip":"94122","state":"California","first_name":"joseph","last_name":"Doe","origin_zip":null},"phone":{"number":"8056594427","country_code":"+91"},"email":null},"order_details":null,"email":"guest@example.com","name":"John Doe","phone":"999999999","return_url":"https://google.com/","authentication_type":"no_three_ds","statement_descriptor_name":"joseph","statement_descriptor_suffix":"JS","next_action":null,"cancellation_reason":null,"error_code":null,"error_message":null,"unified_code":null,"unified_message":null,"payment_experience":null,"payment_method_type":"credit","connector_label":null,"business_country":null,"business_label":"default","business_sub_label":null,"allowed_payment_method_types":null,"ephemeral_key":{"customer_id":"StripeCustomer","created_at":1758721499,"expires":1758725099,"secret":"epk_2ff5fccb274e4aaab7e8802e6c06e54c"},"manual_retry_allowed":null,"connector_transaction_id":"7587215004986946903814","frm_message":null,"metadata":{"udf1":"value1","login_date":"2019-09-10T10:11:12Z","new_customer":"true"},"connector_metadata":null,"feature_metadata":{"redirect_response":null,"search_tags":null,"apple_pay_recurring_details":null,"gateway_system":"direct"},"reference_id":"pay_EsecigedwijD3sy0IdXz_1","payment_link":null,"profile_id":"pro_W3ToWs6EezKDjps5wTlv","surcharge_details":null,"attempt_count":1,"merchant_decision":null,"merchant_connector_id":"mca_4rxNg9ZFdVITFBkrkyWO","incremental_authorization_allowed":false,"authorization_count":null,"incremental_authorizations":null,"external_authentication_details":null,"external_3ds_authentication_attempted":false,"expires_on":"2025-09-24T13:59:59.316Z","fingerprint":null,"browser_info":null,"payment_channel":null,"payment_method_id":null,"network_transaction_id":"016153570198200","payment_method_status":null,"updated":"2025-09-24T13:45:01.180Z","split_payments":null,"frm_metadata":null,"extended_authorization_applied":null,"capture_before":null,"merchant_order_reference_id":null,"order_tax_amount":null,"connector_mandate_id":null,"card_discovery":"manual","force_3ds_challenge":false,"force_3ds_challenge_trigger":false,"issuer_error_code":null,"issuer_error_message":null,"is_iframe_redirection_enabled":null,"whole_connector_response":null,"enable_partial_authorization":null,"enable_overcapture":null,"is_overcapture_enabled":null,"network_details":null}
```
3. Create a payment without API key and Internal API key
Request
```
curl --location 'http://localhost:8080/payments' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'x-merchant-id: merchant_1758720430' \
--header 'x-profile-id: pro_W3ToWs6EezKDjps5wTlv' \
--header 'x-internal-api-key: test_internal_api_key' \
--data-raw '{
  "amount": 6540,
  "currency": "USD",
  "confirm": true,
  "capture_method": "automatic",
  "capture_on": "2022-09-10T10:11:12Z",
  "amount_to_capture": 6540,
  "customer_id": "StripeCustomer",
  "email": "guest@example.com",
  "name": "John Doe",
  "phone": "999999999",
  "phone_country_code": "+1",
  "description": "Its my first payment request",
  "authentication_type": "no_three_ds",
  "return_url": "https://google.com",
  "payment_method": "card",
  "payment_method_type": "credit",
  "payment_method_data": {
    "card": {
      "card_number": "4242424242424242",
      "card_exp_month": "10",
      "card_exp_year": "25",
      "card_holder_name": "joseph Doe",
      "card_cvc": "123"
    }
  },
  "billing": {
    "address": {
      "line1": "1467",
      "line2": "Harrison Street",
      "line3": "Harrison Street",
      "city": "San Fransico",
      "state": "California",
      "zip": "94122",
      "country": "US",
      "first_name": "joseph",
      "last_name": "Doe"
    },
    "phone": {
      "number": "8056594427",
      "country_code": "+91"
    }
  },
  "shipping": {
    "address": {
      "line1": "1467",
      "line2": "Harrison Street",
      "line3": "Harrison Street",
      "city": "San Fransico",
      "state": "California",
      "zip": "94122",
      "country": "US",
      "first_name": "joseph",
      "last_name": "Doe"
    },
    "phone": {
      "number": "8056594427",
      "country_code": "+91"
    }
  },
  "statement_descriptor_name": "joseph",
  "statement_descriptor_suffix": "JS",
  "metadata": {
    "udf1": "value1",
    "new_customer": "true",
    "login_date": "2019-09-10T10:11:12Z"
  }
}'
```
Response
```
{"payment_id":"pay_uBRYL3QTCWj5H21GbWTa","merchant_id":"merchant_1758720430","status":"succeeded","amount":6540,"net_amount":6540,"shipping_cost":null,"amount_capturable":0,"amount_received":6540,"connector":"cybersource","client_secret":"pay_uBRYL3QTCWj5H21GbWTa_secret_RM3Ch7Ux9P8QPFFxwM5p","created":"2025-09-24T13:46:37.902Z","currency":"USD","customer_id":"StripeCustomer","customer":{"id":"StripeCustomer","name":"John Doe","email":"guest@example.com","phone":"999999999","phone_country_code":"+1"},"description":"Its my first payment request","refunds":null,"disputes":null,"mandate_id":null,"mandate_data":null,"setup_future_usage":null,"off_session":null,"capture_on":null,"capture_method":"automatic","payment_method":"card","payment_method_data":{"card":{"last4":"4242","card_type":null,"card_network":null,"card_issuer":null,"card_issuing_country":null,"card_isin":"424242","card_extended_bin":null,"card_exp_month":"10","card_exp_year":"25","card_holder_name":"joseph Doe","payment_checks":{"avs_response":{"code":"Y","codeRaw":"Y"},"card_verification":{"resultCode":"M","resultCodeRaw":"M"}},"authentication_data":null},"billing":null},"payment_token":"token_TBdELmgqZJCVa9guAIIv","shipping":{"address":{"city":"San Fransico","country":"US","line1":"1467","line2":"Harrison Street","line3":"Harrison Street","zip":"94122","state":"California","first_name":"joseph","last_name":"Doe","origin_zip":null},"phone":{"number":"8056594427","country_code":"+91"},"email":null},"billing":{"address":{"city":"San Fransico","country":"US","line1":"1467","line2":"Harrison Street","line3":"Harrison Street","zip":"94122","state":"California","first_name":"joseph","last_name":"Doe","origin_zip":null},"phone":{"number":"8056594427","country_code":"+91"},"email":null},"order_details":null,"email":"guest@example.com","name":"John Doe","phone":"999999999","return_url":"https://google.com/","authentication_type":"no_three_ds","statement_descriptor_name":"joseph","statement_descriptor_suffix":"JS","next_action":null,"cancellation_reason":null,"error_code":null,"error_message":null,"unified_code":null,"unified_message":null,"payment_experience":null,"payment_method_type":"credit","connector_label":null,"business_country":null,"business_label":"default","business_sub_label":null,"allowed_payment_method_types":null,"ephemeral_key":{"customer_id":"StripeCustomer","created_at":1758721597,"expires":1758725197,"secret":"epk_90617482ef1e43e0a833db8cb04fb2e9"},"manual_retry_allowed":null,"connector_transaction_id":"7587215991316984603814","frm_message":null,"metadata":{"udf1":"value1","login_date":"2019-09-10T10:11:12Z","new_customer":"true"},"connector_metadata":null,"feature_metadata":{"redirect_response":null,"search_tags":null,"apple_pay_recurring_details":null,"gateway_system":"direct"},"reference_id":"pay_uBRYL3QTCWj5H21GbWTa_1","payment_link":null,"profile_id":"pro_W3ToWs6EezKDjps5wTlv","surcharge_details":null,"attempt_count":1,"merchant_decision":null,"merchant_connector_id":"mca_4rxNg9ZFdVITFBkrkyWO","incremental_authorization_allowed":false,"authorization_count":null,"incremental_authorizations":null,"external_authentication_details":null,"external_3ds_authentication_attempted":false,"expires_on":"2025-09-24T14:01:37.902Z","fingerprint":null,"browser_info":null,"payment_channel":null,"payment_method_id":null,"network_transaction_id":"016153570198200","payment_method_status":null,"updated":"2025-09-24T13:46:39.783Z","split_payments":null,"frm_metadata":null,"extended_authorization_applied":null,"capture_before":null,"merchant_order_reference_id":null,"order_tax_amount":null,"connector_mandate_id":null,"card_discovery":"manual","force_3ds_challenge":false,"force_3ds_challenge_trigger":false,"issuer_error_code":null,"issuer_error_message":null,"is_iframe_redirection_enabled":null,"whole_connector_response":null,"enable_partial_authorization":null,"enable_overcapture":null,"is_overcapture_enabled":null,"network_details":null}
```
4. Create a payment with both API key and Internal API key missing
Request
```
curl --location 'http://localhost:8080/payments' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data-raw '{
  "amount": 6540,
  "currency": "USD",
  "confirm": true,
  "capture_method": "automatic",
  "capture_on": "2022-09-10T10:11:12Z",
  "amount_to_capture": 6540,
  "customer_id": "StripeCustomer",
  "email": "guest@example.com",
  "name": "John Doe",
  "phone": "999999999",
  "phone_country_code": "+1",
  "description": "Its my first payment request",
  "authentication_type": "no_three_ds",
  "return_url": "https://google.com",
  "payment_method": "card",
  "payment_method_type": "credit",
  "payment_method_data": {
    "card": {
      "card_number": "4242424242424242",
      "card_exp_month": "10",
      "card_exp_year": "25",
      "card_holder_name": "joseph Doe",
      "card_cvc": "123"
    }
  },
  "billing": {
    "address": {
      "line1": "1467",
      "line2": "Harrison Street",
      "line3": "Harrison Street",
      "city": "San Fransico",
      "state": "California",
      "zip": "94122",
      "country": "US",
      "first_name": "joseph",
      "last_name": "Doe"
    },
    "phone": {
      "number": "8056594427",
      "country_code": "+91"
    }
  },
  "shipping": {
    "address": {
      "line1": "1467",
      "line2": "Harrison Street",
      "line3": "Harrison Street",
      "city": "San Fransico",
      "state": "California",
      "zip": "94122",
      "country": "US",
      "first_name": "joseph",
      "last_name": "Doe"
    },
    "phone": {
      "number": "8056594427",
      "country_code": "+91"
    }
  },
  "statement_descriptor_name": "joseph",
  "statement_descriptor_suffix": "JS",
  "metadata": {
    "udf1": "value1",
    "new_customer": "true",
    "login_date": "2019-09-10T10:11:12Z"
  }
}'
```
Response
```
{"error":{"type":"invalid_request","message":"API key not provided or invalid API key used","code":"IR_01"}}
```
5. Create a payment with API Key and one of the required header missing
Request
```
curl --location 'http://localhost:8080/payments' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'x-merchant-id: merchant_1758720430' \
--header 'x-profile-id: pro_W3ToWs6EezKDjps5wTlv' \
--header 'api-key: dev_CLbdgP5Lj11ZF7RfJgM4ck8Qk8AK5yzhEgpPr7d0MmSWC7FvLaQAKKUSOfXBasRD' \
--data-raw '{
  "amount": 6540,
  "currency": "USD",
  "confirm": true,
  "capture_method": "automatic",
  "capture_on": "2022-09-10T10:11:12Z",
  "amount_to_capture": 6540,
  "customer_id": "StripeCustomer",
  "email": "guest@example.com",
  "name": "John Doe",
  "phone": "999999999",
  "phone_country_code": "+1",
  "description": "Its my first payment request",
  "authentication_type": "no_three_ds",
  "return_url": "https://google.com",
  "payment_method": "card",
  "payment_method_type": "credit",
  "payment_method_data": {
    "card": {
      "card_number": "4242424242424242",
      "card_exp_month": "10",
      "card_exp_year": "25",
      "card_holder_name": "joseph Doe",
      "card_cvc": "123"
    }
  },
  "billing": {
    "address": {
      "line1": "1467",
      "line2": "Harrison Street",
      "line3": "Harrison Street",
      "city": "San Fransico",
      "state": "California",
      "zip": "94122",
      "country": "US",
      "first_name": "joseph",
      "last_name": "Doe"
    },
    "phone": {
      "number": "8056594427",
      "country_code": "+91"
    }
  },
  "shipping": {
    "address": {
      "line1": "1467",
      "line2": "Harrison Street",
      "line3": "Harrison Street",
      "city": "San Fransico",
      "state": "California",
      "zip": "94122",
      "country": "US",
      "first_name": "joseph",
      "last_name": "Doe"
    },
    "phone": {
      "number": "8056594427",
      "country_code": "+91"
    }
  },
  "statement_descriptor_name": "joseph",
  "statement_descriptor_suffix": "JS",
  "metadata": {
    "udf1": "value1",
    "new_customer": "true",
    "login_date": "2019-09-10T10:11:12Z"
  }
}'
```
Response
```
{"payment_id":"pay_jZTH3Kb5c8W15TZ9lzWN","merchant_id":"merchant_1758720430","status":"succeeded","amount":6540,"net_amount":6540,"shipping_cost":null,"amount_capturable":0,"amount_received":6540,"connector":"cybersource","client_secret":"pay_jZTH3Kb5c8W15TZ9lzWN_secret_rLDuvU2PG61w94lS0DTI","created":"2025-09-24T13:48:50.432Z","currency":"USD","customer_id":"StripeCustomer","customer":{"id":"StripeCustomer","name":"John Doe","email":"guest@example.com","phone":"999999999","phone_country_code":"+1"},"description":"Its my first payment request","refunds":null,"disputes":null,"mandate_id":null,"mandate_data":null,"setup_future_usage":null,"off_session":null,"capture_on":null,"capture_method":"automatic","payment_method":"card","payment_method_data":{"card":{"last4":"4242","card_type":null,"card_network":null,"card_issuer":null,"card_issuing_country":null,"card_isin":"424242","card_extended_bin":null,"card_exp_month":"10","card_exp_year":"25","card_holder_name":"joseph Doe","payment_checks":{"avs_response":{"code":"Y","codeRaw":"Y"},"card_verification":{"resultCode":"M","resultCodeRaw":"M"}},"authentication_data":null},"billing":null},"payment_token":"token_pthFLPrsyFFd7LKMNIN9","shipping":{"address":{"city":"San Fransico","country":"US","line1":"1467","line2":"Harrison Street","line3":"Harrison Street","zip":"94122","state":"California","first_name":"joseph","last_name":"Doe","origin_zip":null},"phone":{"number":"8056594427","country_code":"+91"},"email":null},"billing":{"address":{"city":"San Fransico","country":"US","line1":"1467","line2":"Harrison Street","line3":"Harrison Street","zip":"94122","state":"California","first_name":"joseph","last_name":"Doe","origin_zip":null},"phone":{"number":"8056594427","country_code":"+91"},"email":null},"order_details":null,"email":"guest@example.com","name":"John Doe","phone":"999999999","return_url":"https://google.com/","authentication_type":"no_three_ds","statement_descriptor_name":"joseph","statement_descriptor_suffix":"JS","next_action":null,"cancellation_reason":null,"error_code":null,"error_message":null,"unified_code":null,"unified_message":null,"payment_experience":null,"payment_method_type":"credit","connector_label":null,"business_country":null,"business_label":"default","business_sub_label":null,"allowed_payment_method_types":null,"ephemeral_key":{"customer_id":"StripeCustomer","created_at":1758721730,"expires":1758725330,"secret":"epk_2bd324735af649278a7afdc0fab609fd"},"manual_retry_allowed":null,"connector_transaction_id":"7587217314886872803813","frm_message":null,"metadata":{"udf1":"value1","login_date":"2019-09-10T10:11:12Z","new_customer":"true"},"connector_metadata":null,"feature_metadata":{"redirect_response":null,"search_tags":null,"apple_pay_recurring_details":null,"gateway_system":"direct"},"reference_id":"pay_jZTH3Kb5c8W15TZ9lzWN_1","payment_link":null,"profile_id":"pro_W3ToWs6EezKDjps5wTlv","surcharge_details":null,"attempt_count":1,"merchant_decision":null,"merchant_connector_id":"mca_4rxNg9ZFdVITFBkrkyWO","incremental_authorization_allowed":false,"authorization_count":null,"incremental_authorizations":null,"external_authentication_details":null,"external_3ds_authentication_attempted":false,"expires_on":"2025-09-24T14:03:50.432Z","fingerprint":null,"browser_info":null,"payment_channel":null,"payment_method_id":null,"network_transaction_id":"016153570198200","payment_method_status":null,"updated":"2025-09-24T13:48:52.097Z","split_payments":null,"frm_metadata":null,"extended_authorization_applied":null,"capture_before":null,"merchant_order_reference_id":null,"order_tax_amount":null,"connector_mandate_id":null,"card_discovery":"manual","force_3ds_challenge":false,"force_3ds_challenge_trigger":false,"issuer_error_code":null,"issuer_error_message":null,"is_iframe_redirection_enabled":null,"whole_connector_response":null,"enable_partial_authorization":null,"enable_overcapture":null,"is_overcapture_enabled":null,"network_details":null}
```
6. Create a payment with API key and all required headers for Internal API Auth with incorrect internal API key
Request
```
curl --location 'http://localhost:8080/payments' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'x-merchant-id: merchant_1758720430' \
--header 'x-profile-id: pro_W3ToWs6EezKDjps5wTlv' \
--header 'x-internal-api-key: test_internal_api_keys' \
--header 'api-key: dev_CLbdgP5Lj11ZF7RfJgM4ck8Qk8AK5yzhEgpPr7d0MmSWC7FvLaQAKKUSOfXBasRD' \
--data-raw '{
  "amount": 6540,
  "currency": "USD",
  "confirm": true,
  "capture_method": "automatic",
  "capture_on": "2022-09-10T10:11:12Z",
  "amount_to_capture": 6540,
  "customer_id": "StripeCustomer",
  "email": "guest@example.com",
  "name": "John Doe",
  "phone": "999999999",
  "phone_country_code": "+1",
  "description": "Its my first payment request",
  "authentication_type": "no_three_ds",
  "return_url": "https://google.com",
  "payment_method": "card",
  "payment_method_type": "credit",
  "payment_method_data": {
    "card": {
      "card_number": "4242424242424242",
      "card_exp_month": "10",
      "card_exp_year": "25",
      "card_holder_name": "joseph Doe",
      "card_cvc": "123"
    }
  },
  "billing": {
    "address": {
      "line1": "1467",
      "line2": "Harrison Street",
      "line3": "Harrison Street",
      "city": "San Fransico",
      "state": "California",
      "zip": "94122",
      "country": "US",
      "first_name": "joseph",
      "last_name": "Doe"
    },
    "phone": {
      "number": "8056594427",
      "country_code": "+91"
    }
  },
  "shipping": {
    "address": {
      "line1": "1467",
      "line2": "Harrison Street",
      "line3": "Harrison Street",
      "city": "San Fransico",
      "state": "California",
      "zip": "94122",
      "country": "US",
      "first_name": "joseph",
      "last_name": "Doe"
    },
    "phone": {
      "number": "8056594427",
      "country_code": "+91"
    }
  },
  "statement_descriptor_name": "joseph",
  "statement_descriptor_suffix": "JS",
  "metadata": {
    "udf1": "value1",
    "new_customer": "true",
    "login_date": "2019-09-10T10:11:12Z"
  }
}'
```
Response
```
{"error":{"type":"invalid_request","message":"API key not provided or invalid API key used","code":"IR_01"}}
```
7. Payment Sync with client secret
```
curl --location 'http://localhost:8080/payments/pay_b5o0Y2uk1KNGXHqTQxCF?client_secret=pay_b5o0Y2uk1KNGXHqTQxCF_secret_CD48nj9Ef7Os5peUPMHt' \
--header 'Accept: application/json' \
--header 'api-key: pk_dev_78bec5909ea84a92bee1f6ae9e243ea8'
```
Response
```
{
    "payment_id": "pay_b5o0Y2uk1KNGXHqTQxCF",
    "merchant_id": "merchant_1758799800",
    "status": "succeeded",
    "amount": 6540,
    "net_amount": 6540,
    "shipping_cost": null,
    "amount_capturable": 0,
    "amount_received": 6540,
    "connector": "cybersource",
    "client_secret": "pay_b5o0Y2uk1KNGXHqTQxCF_secret_CD48nj9Ef7Os5peUPMHt",
    "created": "2025-09-25T14:31:26.721Z",
    "currency": "USD",
    "customer_id": "StripeCustomer",
    "customer": {
        "id": "StripeCustomer",
        "name": "John Doe",
        "email": "guest@example.com",
        "phone": "999999999",
        "phone_country_code": "+1"
    },
    "description": "Its my first payment request",
    "refunds": null,
    "disputes": null,
    "mandate_id": null,
    "mandate_data": null,
    "setup_future_usage": null,
    "off_session": null,
    "capture_on": null,
    "capture_method": "automatic",
    "payment_method": "card",
    "payment_method_data": {
        "card": {
            "last4": "4242",
            "card_type": null,
            "card_network": null,
            "card_issuer": null,
            "card_issuing_country": null,
            "card_isin": "424242",
            "card_extended_bin": null,
            "card_exp_month": "10",
            "card_exp_year": "25",
            "card_holder_name": "joseph Doe",
            "payment_checks": {
                "avs_response": {
                    "code": "Y",
                    "codeRaw": "Y"
                },
                "card_verification": {
                    "resultCode": "M",
                    "resultCodeRaw": "M"
                }
            },
            "authentication_data": null
        },
        "billing": null
    },
    "payment_token": "token_R5qt6L28kHcTGNklyS2v",
    "shipping": {
        "address": {
            "city": "San Fransico",
            "country": "US",
            "line1": "1467",
            "line2": "Harrison Street",
            "line3": "Harrison Street",
            "zip": "94122",
            "state": "California",
            "first_name": "joseph",
            "last_name": "Doe",
            "origin_zip": null
        },
        "phone": {
            "number": "8056594427",
            "country_code": "+91"
        },
        "email": null
    },
    "billing": {
        "address": {
            "city": "San Fransico",
            "country": "US",
            "line1": "1467",
            "line2": "Harrison Street",
            "line3": "Harrison Street",
            "zip": "94122",
            "state": "California",
            "first_name": "joseph",
            "last_name": "Doe",
            "origin_zip": null
        },
        "phone": {
            "number": "8056594427",
            "country_code": "+91"
        },
        "email": null
    },
    "order_details": null,
    "email": "guest@example.com",
    "name": "John Doe",
    "phone": "999999999",
    "return_url": "https://google.com/",
    "authentication_type": "no_three_ds",
    "statement_descriptor_name": "joseph",
    "statement_descriptor_suffix": "JS",
    "next_action": null,
    "cancellation_reason": null,
    "error_code": null,
    "error_message": null,
    "unified_code": null,
    "unified_message": null,
    "payment_experience": null,
    "payment_method_type": "credit",
    "connector_label": null,
    "business_country": null,
    "business_label": "default",
    "business_sub_label": null,
    "allowed_payment_method_types": null,
    "ephemeral_key": null,
    "manual_retry_allowed": null,
    "connector_transaction_id": "7588106881976314703814",
    "frm_message": null,
    "metadata": {
        "udf1": "value1",
        "login_date": "2019-09-10T10:11:12Z",
        "new_customer": "true"
    },
    "connector_metadata": null,
    "feature_metadata": {
        "redirect_response": null,
        "search_tags": null,
        "apple_pay_recurring_details": null,
        "gateway_system": "direct"
    },
    "reference_id": "pay_b5o0Y2uk1KNGXHqTQxCF_1",
    "payment_link": null,
    "profile_id": "pro_ZLxuLxjbtAvxP8UluouT",
    "surcharge_details": null,
    "attempt_count": 1,
    "merchant_decision": null,
    "merchant_connector_id": "mca_szN2aVSuqzlKQWlg5Uxx",
    "incremental_authorization_allowed": false,
    "authorization_count": null,
    "incremental_authorizations": null,
    "external_authentication_details": null,
    "external_3ds_authentication_attempted": false,
    "expires_on": "2025-09-25T14:46:26.721Z",
    "fingerprint": null,
    "browser_info": null,
    "payment_channel": null,
    "payment_method_id": null,
    "network_transaction_id": "016153570198200",
    "payment_method_status": null,
    "updated": "2025-09-25T14:31:29.010Z",
    "split_payments": null,
    "frm_metadata": null,
    "extended_authorization_applied": null,
    "capture_before": null,
    "merchant_order_reference_id": null,
    "order_tax_amount": null,
    "connector_mandate_id": null,
    "card_discovery": "manual",
    "force_3ds_challenge": false,
    "force_3ds_challenge_trigger": false,
    "issuer_error_code": null,
    "issuer_error_message": null,
    "is_iframe_redirection_enabled": null,
    "whole_connector_response": null,
    "enable_partial_authorization": null,
    "enable_overcapture": null,
    "is_overcapture_enabled": null,
    "network_details": null
}
```
8. Payment Sync with API key
```
curl --location 'http://localhost:8080/payments/pay_b5o0Y2uk1KNGXHqTQxCF' \
--header 'Accept: application/json' \
--header 'api-key: dev_MjuJcRJNsddyqcjvIgQornBitkJdxnLjtpCxWr6kCZ99TacNP92VykGNqyIUgBns'
```
Response
```
{
    "payment_id": "pay_b5o0Y2uk1KNGXHqTQxCF",
    "merchant_id": "merchant_1758799800",
    "status": "succeeded",
    "amount": 6540,
    "net_amount": 6540,
    "shipping_cost": null,
    "amount_capturable": 0,
    "amount_received": 6540,
    "connector": "cybersource",
    "client_secret": "pay_b5o0Y2uk1KNGXHqTQxCF_secret_CD48nj9Ef7Os5peUPMHt",
    "created": "2025-09-25T14:31:26.721Z",
    "currency": "USD",
    "customer_id": "StripeCustomer",
    "customer": {
        "id": "StripeCustomer",
        "name": "John Doe",
        "email": "guest@example.com",
        "phone": "999999999",
        "phone_country_code": "+1"
    },
    "description": "Its my first payment request",
    "refunds": null,
    "disputes": null,
    "mandate_id": null,
    "mandate_data": null,
    "setup_future_usage": null,
    "off_session": null,
    "capture_on": null,
    "capture_method": "automatic",
    "payment_method": "card",
    "payment_method_data": {
        "card": {
            "last4": "4242",
            "card_type": null,
            "card_network": null,
            "card_issuer": null,
            "card_issuing_country": null,
            "card_isin": "424242",
            "card_extended_bin": null,
            "card_exp_month": "10",
            "card_exp_year": "25",
            "card_holder_name": "joseph Doe",
            "payment_checks": {
                "avs_response": {
                    "code": "Y",
                    "codeRaw": "Y"
                },
                "card_verification": {
                    "resultCode": "M",
                    "resultCodeRaw": "M"
                }
            },
            "authentication_data": null
        },
        "billing": null
    },
    "payment_token": "token_R5qt6L28kHcTGNklyS2v",
    "shipping": {
        "address": {
            "city": "San Fransico",
            "country": "US",
            "line1": "1467",
            "line2": "Harrison Street",
            "line3": "Harrison Street",
            "zip": "94122",
            "state": "California",
            "first_name": "joseph",
            "last_name": "Doe",
            "origin_zip": null
        },
        "phone": {
            "number": "8056594427",
            "country_code": "+91"
        },
        "email": null
    },
    "billing": {
        "address": {
            "city": "San Fransico",
            "country": "US",
            "line1": "1467",
            "line2": "Harrison Street",
            "line3": "Harrison Street",
            "zip": "94122",
            "state": "California",
            "first_name": "joseph",
            "last_name": "Doe",
            "origin_zip": null
        },
        "phone": {
            "number": "8056594427",
            "country_code": "+91"
        },
        "email": null
    },
    "order_details": null,
    "email": "guest@example.com",
    "name": "John Doe",
    "phone": "999999999",
    "return_url": "https://google.com/",
    "authentication_type": "no_three_ds",
    "statement_descriptor_name": "joseph",
    "statement_descriptor_suffix": "JS",
    "next_action": null,
    "cancellation_reason": null,
    "error_code": null,
    "error_message": null,
    "unified_code": null,
    "unified_message": null,
    "payment_experience": null,
    "payment_method_type": "credit",
    "connector_label": null,
    "business_country": null,
    "business_label": "default",
    "business_sub_label": null,
    "allowed_payment_method_types": null,
    "ephemeral_key": null,
    "manual_retry_allowed": null,
    "connector_transaction_id": "7588106881976314703814",
    "frm_message": null,
    "metadata": {
        "udf1": "value1",
        "login_date": "2019-09-10T10:11:12Z",
        "new_customer": "true"
    },
    "connector_metadata": null,
    "feature_metadata": {
        "redirect_response": null,
        "search_tags": null,
        "apple_pay_recurring_details": null,
        "gateway_system": "direct"
    },
    "reference_id": "pay_b5o0Y2uk1KNGXHqTQxCF_1",
    "payment_link": null,
    "profile_id": "pro_ZLxuLxjbtAvxP8UluouT",
    "surcharge_details": null,
    "attempt_count": 1,
    "merchant_decision": null,
    "merchant_connector_id": "mca_szN2aVSuqzlKQWlg5Uxx",
    "incremental_authorization_allowed": false,
    "authorization_count": null,
    "incremental_authorizations": null,
    "external_authentication_details": null,
    "external_3ds_authentication_attempted": false,
    "expires_on": "2025-09-25T14:46:26.721Z",
    "fingerprint": null,
    "browser_info": null,
    "payment_channel": null,
    "payment_method_id": null,
    "network_transaction_id": "016153570198200",
    "payment_method_status": null,
    "updated": "2025-09-25T14:31:29.010Z",
    "split_payments": null,
    "frm_metadata": null,
    "extended_authorization_applied": null,
    "capture_before": null,
    "merchant_order_reference_id": null,
    "order_tax_amount": null,
    "connector_mandate_id": null,
    "card_discovery": "manual",
    "force_3ds_challenge": false,
    "force_3ds_challenge_trigger": false,
    "issuer_error_code": null,
    "issuer_error_message": null,
    "is_iframe_redirection_enabled": null,
    "whole_connector_response": null,
    "enable_partial_authorization": null,
    "enable_overcapture": null,
    "is_overcapture_enabled": null,
    "network_details": null
}
```
9. Payment Sync with Internal API Key
```
curl --location 'http://localhost:8080/payments/pay_b5o0Y2uk1KNGXHqTQxCF' \
--header 'Accept: application/json' \
--header 'x-merchant-id: merchant_1758799800' \
--header 'x-profile-id: pro_ZLxuLxjbtAvxP8UluouT' \
--header 'x-internal-api-key: test_internal_api_key'
```
Response
```
{"payment_id":"pay_b5o0Y2uk1KNGXHqTQxCF","merchant_id":"merchant_1758799800","status":"succeeded","amount":6540,"net_amount":6540,"shipping_cost":null,"amount_capturable":0,"amount_received":6540,"connector":"cybersource","client_secret":"pay_b5o0Y2uk1KNGXHqTQxCF_secret_CD48nj9Ef7Os5peUPMHt","created":"2025-09-25T14:31:26.721Z","currency":"USD","customer_id":"StripeCustomer","customer":{"id":"StripeCustomer","name":"John Doe","email":"guest@example.com","phone":"999999999","phone_country_code":"+1"},"description":"Its my first payment request","refunds":null,"disputes":null,"mandate_id":null,"mandate_data":null,"setup_future_usage":null,"off_session":null,"capture_on":null,"capture_method":"automatic","payment_method":"card","payment_method_data":{"card":{"last4":"4242","card_type":null,"card_network":null,"card_issuer":null,"card_issuing_country":null,"card_isin":"424242","card_extended_bin":null,"card_exp_month":"10","card_exp_year":"25","card_holder_name":"joseph Doe","payment_checks":{"avs_response":{"code":"Y","codeRaw":"Y"},"card_verification":{"resultCode":"M","resultCodeRaw":"M"}},"authentication_data":null},"billing":null},"payment_token":"token_R5qt6L28kHcTGNklyS2v","shipping":{"address":{"city":"San Fransico","country":"US","line1":"1467","line2":"Harrison Street","line3":"Harrison Street","zip":"94122","state":"California","first_name":"joseph","last_name":"Doe","origin_zip":null},"phone":{"number":"8056594427","country_code":"+91"},"email":null},"billing":{"address":{"city":"San Fransico","country":"US","line1":"1467","line2":"Harrison Street","line3":"Harrison Street","zip":"94122","state":"California","first_name":"joseph","last_name":"Doe","origin_zip":null},"phone":{"number":"8056594427","country_code":"+91"},"email":null},"order_details":null,"email":"guest@example.com","name":"John Doe","phone":"999999999","return_url":"https://google.com/","authentication_type":"no_three_ds","statement_descriptor_name":"joseph","statement_descriptor_suffix":"JS","next_action":null,"cancellation_reason":null,"error_code":null,"error_message":null,"unified_code":null,"unified_message":null,"payment_experience":null,"payment_method_type":"credit","connector_label":null,"business_country":null,"business_label":"default","business_sub_label":null,"allowed_payment_method_types":null,"ephemeral_key":null,"manual_retry_allowed":null,"connector_transaction_id":"7588106881976314703814","frm_message":null,"metadata":{"udf1":"value1","login_date":"2019-09-10T10:11:12Z","new_customer":"true"},"connector_metadata":null,"feature_metadata":{"redirect_response":null,"search_tags":null,"apple_pay_recurring_details":null,"gateway_system":"direct"},"reference_id":"pay_b5o0Y2uk1KNGXHqTQxCF_1","payment_link":null,"profile_id":"pro_ZLxuLxjbtAvxP8UluouT","surcharge_details":null,"attempt_count":1,"merchant_decision":null,"merchant_connector_id":"mca_szN2aVSuqzlKQWlg5Uxx","incremental_authorization_allowed":false,"authorization_count":null,"incremental_authorizations":null,"external_authentication_details":null,"external_3ds_authentication_attempted":false,"expires_on":"2025-09-25T14:46:26.721Z","fingerprint":null,"browser_info":null,"payment_channel":null,"payment_method_id":null,"network_transaction_id":"016153570198200","payment_method_status":null,"updated":"2025-09-25T14:31:29.010Z","split_payments":null,"frm_metadata":null,"extended_authorization_applied":null,"capture_before":null,"merchant_order_reference_id":null,"order_tax_amount":null,"connector_mandate_id":null,"card_discovery":"manual","force_3ds_challenge":false,"force_3ds_challenge_trigger":false,"issuer_error_code":null,"issuer_error_message":null,"is_iframe_redirection_enabled":null,"whole_connector_response":null,"enable_partial_authorization":null,"enable_overcapture":null,"is_overcapture_enabled":null,"network_details":null}
```

10. Payment Sync with invalid Internal API Key
```
curl --location 'http://localhost:8080/payments/pay_b5o0Y2uk1KNGXHqTQxCF' \
--header 'Accept: application/json' \
--header 'x-merchant-id: merchant_1758799800' \
--header 'x-profile-id: pro_ZLxuLxjbtAvxP8UluouT' \
--header 'x-internal-api-key: test_internal_api_keys'
```
Response
```
{
    "error": {
        "type": "invalid_request",
        "message": "API key not provided or invalid API key used",
        "code": "IR_01"
    }
}
```
## Checklist
<!-- Put an `x` in the boxes that apply -->

- [ ] I formatted the code `cargo +nightly fmt --all`
- [ ] I addressed lints thrown by `cargo clippy`
- [ ] I reviewed the submitted code
- [ ] I added unit tests for my changes where possible
