CyberSource Unified Checkout

Who this is for

Any merchant that already has a live CyberSource production account currently running Hosted Checkout, and wants to migrate to Unified Checkout. No new CyberSource account is needed: this only enables a new service on the existing production merchant ID (MID) and switches OpenApply's configuration over to it.

⚠️ In OpenApply, the CyberSource mode (Hosted Checkout vs Unified Checkout) is a single setting per school, not per user or per session. The moment it is switched, every parent on that school starts using Unified Checkout. As there is no gradual rollout or staff-only preview, please plan accordingly.

Checklist

1. Submit a MID Configuration Request to enable Unified Checkout, Payer Authentication (3DS), and Decision Manager on the production MID
2. Generate a new REST API key once the service is approved
3. During a low-traffic window: back up the Hosted Checkout credentials, then switch OpenApply to Unified Checkout with the new key and the Decision Manager checkbox
4. Set up the Unified Checkout webhook
5. Validate with one real transaction, then keep the cutover or roll back

Step 1: Activate the service (Service Enablement)

In Business Center, open Support → Support Center:

This opens the Visa Acceptance Solutions Support Center. Go to Support cases → MID configuration request:

Submit the form, checking only Service enablement, and request:

• Unified Checkout (REST API)
• Payer Authentication (3DS)
• Decision Manager (if fraud screening is needed)

Under Environment, check Production only. Leave Private checked.

For any CyberSource-specific questions, please reach out to CyberSource support directly.

CyberSource processes this internally (per their public documentation, typically within 3 business days). Nothing else in this runbook can proceed until this is approved, since the REST key created in Step 2 and the Decision Manager checkbox in Step 3 both depend on these services being enabled on the merchant account first.

Step 2: Generate and save the new REST API key

⚠️ The Unified Checkout key is not the same as the Hosted Checkout key, even though both belong to the same merchant/Profile. Hosted Checkout uses a Secure Acceptance Access Key + Secret Key; Unified Checkout uses a separate REST API key (Key ID + Shared Secret). They live in different places in Business Center and are not interchangeable.

Once the service is enabled, go to Business Center → Payment Configuration → Key Management:

Click + Generate key:

Select key type REST - Shared Secret, the recommended type for the REST APIs that Unified Checkout uses:

Ignore the legacy SCMP / SOAP Toolkit options below it (CyberSource has marked them end-of-life) and click Generate key:

Confirm the generation:

Copy (or download) the Key and Shared Secret immediately, since CyberSource only displays the Shared Secret once:

Step 3: Back up Hosted Checkout, then switch OpenApply to Unified Checkout

⚠️ This step immediately routes every parent on the school to Unified Checkout: the Mode setting is shared by the whole school (see the warning at the top), and there's no way to test Unified Checkout without switching to it. You may wish to do this step through Step 5 in one sitting, during a low-traffic window.

Before changing anything, open the school's Payment settings in OpenApply admin and record the current Hosted Checkout configuration (Merchant ID, Profile ID, Access key, Secret key) somewhere safe, in case a rollback is needed later:

Then switch Mode to Unified Checkout and fill in the new values:

• Merchant ID: same value as before; the merchant account doesn't change
• Access key / Secret key: the Key ID and Shared Secret generated in Step 2 (do not reuse the Hosted Checkout Access key/Secret key; see the warning in Step 2)
• Note that Profile ID disappears in this mode: it's a Hosted-Checkout-only field, not used by Unified Checkout
• Environment: select Live Environment
• Check Screen transactions with Decision Manager now, if it was included in the Step 1 request and approved (do this before Step 4: the webhook subscription is built from whatever this checkbox says at setup time)

Step 4: Set up the webhook

Save the Unified Checkout configuration from Step 3 first. Only after it's saved, go to the same settings screen (see the Unified Checkout webhook section in the screenshot above) and click Set up webhook automatically. This generates and registers the encrypted webhook credentials, runs a health check, and creates the subscription. No manual steps needed in Business Center.

Step 5: Validate with one real transaction, then keep the cutover or roll back

1. Confirm the new REST key is saved, and Decision Manager / 3DS / the webhook subscription are all active for the production MID
2. Run one small real transaction and confirm: authorization succeeds, and the charge/invoice status updates correctly in OpenApply
3. If everything checked out, the cutover stands as-is: no further action needed, parents now pay through Unified Checkout. If anything looked wrong, roll back right away

Rollback: switch Mode back to Hosted Checkout and restore the credentials backed up in Step 3. This reverts every parent on the school back to Hosted Checkout immediately.