REST API

Validating the Transient Token

After receiving the transient token, validate its integrity using the public key embedded within the capture context created at the beginning of this flow. This verifies that
Cybersource
issued the token and that no data tampering occurred during transit. See Example: Capture Context Public Key.
Use the capture context public key to cryptographically validate the JWT provided from a successful
microform.createToken
call. You might have to convert the JSON Web Key (JWK) to privacy-enhanced mail (PEM) format for compatibility with some JWT validation software libraries.
The
Cybersource
SDK has functions that verify the token response. You must verify the response to ensure that no tampering occurs as it passes through the cardholder device. Do so by using the public key generated at the start of the process.