Add Credit Card Design Options
mscripts supports two workflow designs for “adding” a credit card. In both cases it requires a customer or payment provider hosted webpage that can be shown within an iframe in mscripts. Patients will use this webpage to input their credit card information.
Option 1
The customer or payment provider hosted webpage can pass the token directly to McKesson to add the credit card outside of mscripts.
- When the patient clicks “Add a card”, mscripts can either open the customer hosted webpage within an iframe or re-direct to the webpage in a new browser tab.
- Once the patient enters their credit card information and submits the page, the customer or payment provider will pass the token directly to McKesson outside of mscripts to add the card to McKesson EnterpriseRx.
Assumptions
- The hosted webpage can be embedded within mscripts without security restrictions. i.e., “x-frame-options” have not restricted the page from displaying within an iframe.
- Customer or payment provider will pass the credit card token directly to McKesson outside of mscripts’ application.
This is a preferred approach is it requires less “touch points” to pass the credit card token information. An external API with a customer or payment provider also would not be needed and provides more control to the customer to pass the token to McKesson.
Option 2
In this design, the customer will pass the token back to mscripts and mscripts will relay the token to McKesson.
- When the patient clicks “Add a card”, mscripts will call a customer or payment provider exposed API (e.g., getTransactionToken) which provides an acessToken and returns it back to mscripts front end (ex: 68fe962a-162b-48d9-baf0-4786d6ee68b0&sf).
- Using the token, mscripts front-end creates a URL which is then opened in an iframe.
- The patient enters the credit card details on the page and hits submit. The customer webpage does a redirect to mscripts with a token, and this token is then used to hit a McKesson token API to add the credit card details.
Assumptions
- Customer has an exposable API that can provide the “accessToken”.
- Customer can pass the token back to mscripts to add to McKesson EnterpriseRx.
- The hosted web page can be embedded within mscripts without security restrictions. i.e., “x-frame-options” have not restricted the page from displaying within an iframe.