Search code examples
payment-gatewaybraintree

Does it makes sense to store Braintree token as a reference?


I am currently working on integrating Braintree with our product. Our usual practice is to store the Token generated with initial payments call, so that it can be used while tracking issues with payments. That's what we do with PayPal. Although with Braintree, I am little confused.

  1. Braintree generates two different strings. The first one is called "token", which is used before making communications with Braintree. The second is called "nonce", which is used to complete a transaction.
  2. As I have seen, the generated Token is more than 1500+ characters, and our database is designed to hold 250 chars at most. Storing more than that doesn't make sense to me.

So the questions I have are:

  1. Does it make sense to store the token in our system, or does it lose value after 3-4 hours?
  2. Or will it work if I just store nonce once the payment is successful? In any case, transaction does not take place without nonce.

Solution

  • Full disclosure: I work at Braintree. If you have any further questions, feel free to contact support.

    When Braintree creates a payment method in your vault, it returns a Payment Method response object. This response object contains only one property, which is the token. This token uniquely identifies a payment method in your vault. You can store this token, then use it to reference saved payment methods later. Typically, payment method tokens are no longer than 7 characters.

    This is how creating a payment method and referencing it's token would look in Ruby:

    result = Braintree::PaymentMethod.create(
        :customer_id => "42",
        :payment_method_nonce => nonce_from_the_client
    )
    
    if result.success?
        payment_method_token = result.payment_method.token
    end
    

    Note that the word 'token' is also used for the client token, which is used to configure a client-side integration. These are typically very long. It's likely this is the 1500-character 'token' that you're referencing. The client token has no relationship to any payment method, and there is generally no reason to store it.

    A payment method nonce can only be used once, after which, it is marked as 'consumed'. If you attempt to use a payment method nonce after consuming it, you will receive the validation error: 93107: Cannot use a payment_method_nonce more than once. With this in mind, you generally should not store payment method nonces.