v0.1.0

First release of the two Hosted Fields integration examples: the same payment implemented on two
servers, with a browser half that is byte-for-byte identical between them.

What the examples show

Card number, expiry and CVV are iframes served by the payment gateway, so the card never reaches
the merchant server. Everything around them is the merchant's: the layout, the light and dark
themes, the result panel — and one of the merchant's own inputs, the cardholder name, sitting
between the gateway's fields in the same visual row. A redirect to a hosted payment page cannot
do that.

Both examples cover the whole flow: the single-use ephemeral ticket, tokenization, the Sale with
hosted_fields_token, status polling, and the 3DS return whose control checksum is verified
before the page renders.

Artefacts

File	Contents	Requires
hosted-fields-examples-go_v0.1.0_linux_amd64.tar.gz	one static binary with the pages compiled in, plus deploy/	nothing
hosted-fields-examples-go_v0.1.0_linux_arm64.tar.gz	the same, for arm64	nothing
hosted-fields-examples-nodejs-express-js_v0.1.0.tar.gz	bundled server.js with public/, views/ and deploy/	Node 20+, no node_modules

Verify with sha256sum -c SHA256SUMS.

Running one

Every setting comes from the environment and none of them has a default: both apps refuse to
start until the gateway URLs, the endpoint, the merchant login, the control key and the RSA
private key are all provided. See deploy/*.env.example in either archive, and the README for
what to ask the gateway for.

Each app mounts everything under a URL prefix, so several of them fit behind one nginx; deploy/
carries the systemd unit and the nginx snippet.

Notes

• The RSA key signs the server calls and never leaves the server. It is not in this repository
  and must not be committed.
• Field validation messages the payer sees come from the SDK the gateway serves, not from this
  code. To show them in a language of your own, switch on error.code rather than printing
  error.payerMessage.