Authorize.Net

What you need

The API Login ID and Transaction Key always travel together. The Signature Key is independent.

Why we ask for each field

API Login ID

Names your account on API calls. It works only when paired with the Transaction Key.

Transaction Key

The secret that proves an API request is yours. With the API Login ID, it lets us build the hosted payment form, so the charge runs through your account.

Signature Key

Proves an incoming webhook is genuinely from Authorize.Net, so nobody can forge a "paid" event. It is a separate value from the Transaction Key.

Success and Cancel URL

Plain settings: where the buyer lands after paying or backing out. Not secret.

Set up

1. Create a free sandbox account (no payment)

   You do not need a paid merchant account to test. Authorize.Net offers a free sandbox that mirrors production, with no credit card required.

   1. Go to developer.authorize.net/hello_world/sandbox.html and sign up for a sandbox account. Use that link, not the main signup or pricing page (which is the paid live application).
   2. Sign in to the sandbox Merchant Interface at sandbox.authorize.net.

   The signature scheme is identical to production, so anything you verify in the sandbox behaves the same way live.

2. Copy your three credentials

   Same path in both sandbox and live: Account → Settings → Security Settings → General Security Settings → API Credentials and Keys.

   • API Login ID is shown at the top.
   • Transaction Key: select "New Transaction Key", confirm, and copy it immediately (it is shown once).
   • Signature Key: select "New Signature Key", confirm, and copy it right away.

   

3. Add the webhook
   1. Account → Settings → Business Settings → Webhooks, add an endpoint.
   2. Set the endpoint URL to your project webhook address (below).
   3. Subscribe to events. One-time payments: net.authorize.payment.authorization.created, authcapture.created, capture.created, priorAuthCapture.created, refund.created, void.created, and the fraud.* events (held, approved, declined). Subscriptions (Automated Recurring Billing): the net.authorize.customer.subscription.* events. Renewals arrive as authcapture.created, already covered. Extra events are harmless.
   4. Save. Authorize.Net signs each delivery with your Signature Key.

   https://<your Coin Moebius host>/webhook/authorizenet/<your project id>

   

   Coin Moebius records each event id once and ignores duplicates, so replayed webhooks are handled for you.

4. Test with sandbox cards

   Sandbox cards never charge a real card. Use any future expiration (for example 12/2030) and any CVV (3 digits, or 4 for American Express).

   Network	Card
   Visa	4111111111111111
   Mastercard	5424000000000015
   American Express	370000000000002
   Discover	6011000000000012

5. Connect in the dashboard

   Add provider → Authorize.Net. Enter Success URL, Cancel URL, and the Live group (API Login ID, Transaction Key, Signature Key). Add the optional Sandbox group to test. The Sandbox group is all-or-nothing: all three fields, or none. Live and sandbox are checked separately.

After you connect

Run one test payment before going live:

1. Create a product and set its Environment to Testing. That runs the product on your sandbox credentials, so you can place a full order without moving money. (If you skipped the sandbox set, a Testing product falls back to live, so add it first.)
2. Place the buy button on a page (a local HTML file works) pointed at your project.
3. Complete checkout with a sandbox test card from above.
4. Open the Transactions tab. A new row appears, tagged Testing. When its status reaches succeeded, your credentials and webhook are both working end to end.

Switch the product Environment to Live when you are ready for real payments.

Troubleshooting

Start with Verify. In the dashboard, click Verify (or Verify test credentials for the sandbox set) to check your API Login ID and Transaction Key.

Verify fails.

The API Login ID and Transaction Key must be the pair from the same account (live or sandbox). Re-copy both.

Signature verification fails.

The Signature Key is a different value from the Transaction Key. Copy the Signature Key from the same screen. The scheme is identical in sandbox and live.

Payment completes but the order stays pending.

Confirm the webhook URL matches exactly and that you subscribed to the payment events.

A test product charged a live card.

A product marked as test falls back to your live credentials when no complete sandbox set is configured. Add all three sandbox fields, or unmark the product as test.

Confirm it end to end.

Authorize.Net only pings inactive webhooks: set the endpoint inactive, send a ping, then re-activate it, and watch the order update.

Good to know

Tokens are short-lived. The hosted form token lasts about 15 minutes. We mint a fresh one per checkout.

Currency. Authorize.Net is primarily a US, USD gateway. Non-USD depends on your processor agreement.

Rotating keys. Generate a new Transaction Key or Signature Key anytime, then paste it in. Secret fields stay blank on edit.

Questions? [email protected]