`Secure Acceptance` `Hosted Checkout Integration` Transaction Flow {#sa-payments-txn-flow}
==========================================================================================

#### Figure: {#sa-payments-txn-flow_cybshosted}

`Hosted Checkout Integration` Transaction Flow  
![](/content/dam/new-documentation/documentation/en-us/topics/payments-processing/card-processing/secure-acceptance/images/Secure_Acceptance_WM.bmp/jcr:content/renditions/cq5dam.web.1280.1280.jpeg)

1. The customer clicks the pay button on your website, which triggers an HTTPS POST that directs the customer to the hosted `Secure Acceptance` page that you configured in the Business Center. The HTTPS POST includes the signature and signed data fields containing the order information.  
   `Hosted Checkout Integration` works best with JavaScript and cookies enabled in the customer browser.

> Your system should sign all request fields with the exception of fields that contain data the customer is entering. To prevent malicious actors from impersonating ` Cybersource `, do not allow unauthorized access to the signing function. See [Required Signed Fields](/content/cybsdeveloper2021/amer/en/docs/cybs/en-us/sa/developer/all/sa-hosted/secure-acceptance/sa-payment-txns/sa-required-signed-fields.md "").

2. `Secure Acceptance` verifies the signature to ensure that the order details were not amended or tampered with and displays the `Hosted Checkout Integration` page. The customer enters and submits payment details and their billing and shipping information. The customer confirms the payment, and the transaction is processed.
3. `Cybersource` recommends that you configure a custom receipt page in the Business Center so that the signed transaction response is sent back to your merchant server through the browser. See [Merchant Notifications](/content/cybsdeveloper2021/amer/en/docs/cybs/en-us/sa/developer/all/sa-hosted/secure-acceptance/sa-payment-configuration/sa-merchant-notifications.md ""). You must validate the response signature to confirm that the response data was not amended or tampered with. `Hosted Checkout Integration` can also display a standard receipt page to your customer, and you can verify the result of the transaction search in the Business Center or the standard `Cybersource` reports. If the response signature in the response field does not match the signature calculated based on the response data, treat the POST as malicious and disregard it. ` Secure Acceptance ` signs every response field. Ignore any response fields in the POST that are not in the **signed_fields** field.
   4. `Cybersource` recommends that you implement the merchant POST URL notification as a backup means of determining the transaction result. This method does not rely on your customer's browser. You receive the transaction result even if your customer lost connection after confirming the payment. See [Merchant Notifications](/content/cybsdeveloper2021/amer/en/docs/cybs/en-us/sa/developer/all/sa-hosted/secure-acceptance/sa-payment-configuration/sa-merchant-notifications.md "").  
      If the transaction type if sale, it is immediately submitted for settlement. If the transaction type is `authorization`, use the `Cybersource` Simple Order API to submit a capture request when goods are shipped.