The London Perl and Raku Workshop takes place on 26th Oct 2024. If your company depends on Perl, please consider sponsoring and/or attending.


Business::OnlinePayment::PayflowPro - Payflow Pro backend for Business::OnlinePayment


  use Business::OnlinePayment;
  my $tx = new Business::OnlinePayment(
      'vendor'  => 'your_vendor',
      'partner' => 'your_partner',
      'client_certification_id' => 'GuidUpTo32Chars',
  # See the module documentation for details of content()
      type           => 'VISA',
      action         => 'Normal Authorization',
      description    => 'Business::OnlinePayment::PayflowPro test',
      amount         => '49.95',
      invoice_number => '100100',
      customer_id    => 'jsk',
      name           => 'Jason Kohles',
      address        => '123 Anystreet',
      city           => 'Anywhere',
      state          => 'GA',
      zip            => '30004',
      email          => '',
      card_number    => '4111111111111111',
      expiration     => '12/09',
      cvv2           => '123',
      order_number   => 'string',
      request_id     => 'unique_identifier_for_transaction',
  if ( $tx->is_success() ) {
          "Card processed successfully: ", $tx->authorization, "\n",
          "order number: ",                $tx->order_number,  "\n",
          "CVV2 response: ",               $tx->cvv2_response, "\n",
          "AVS code: ",                    $tx->avs_code,      "\n",
  else {
      my $info = "";
      $info = " (CVV2 mismatch)" if ( $tx->result_code == 114 );
          "Card was rejected: ", $tx->error_message, $info, "\n",
          "order number: ",      $tx->order_number,         "\n",


This module is a back end driver that implements the interface specified by Business::OnlinePayment to support payment handling via the PayPal's Payflow Pro Internet payment solution.

See Business::OnlinePayment for details on the interface this modules supports.

Standard methods


This method sets the 'server' attribute to '' and the port attribute to '443'. This method also sets up the "Module specific methods" described below.


Unofficial methods

This module provides the following methods which are not officially part of the standard Business::OnlinePayment interface (as of 3.00_06) but are nevertheless supported by multiple gateways modules and expected to be standardized soon:


Module specific methods

This module provides the following methods which are not currently part of the standard Business::OnlinePayment interface:


This gets/sets the X-VPS-VITCLIENTCERTIFICATION-ID which is REQUIRED and defaults to "ClientCertificationIdNotSet". This is described in Website Payments Pro HTTPS Interface Developer's Guide as follows:

"A random globally unique identifier (GUID) that is currently required. This requirement will be removed in the future. At this time, you can send any alpha-numeric ID up to 32 characters in length.

NOTE: Once you have created this ID, do not change it. Use the same ID for every transaction."


Timeout value, in seconds, after which this transaction should be aborted. Defaults to 45, the value recommended by the Website Payments Pro HTTPS Interface Developer's Guide.


Enable or disble debugging. The value specified here will also set $Business::OnlinePayment::HTTPS::DEBUG in submit() to aid in troubleshooting problems.


The expdate_mmyy() method takes a single scalar argument (typically the value in $content{expiration}) and attempts to parse and format and put the date in MMYY format as required by PayflowPro specification. If unable to parse the expiration date simply leave it as is and let the PayflowPro system attempt to handle it as-is.


It is recommended that you specify your own unique request_id for each transaction in %content. A request_id is REQUIRED by the PayflowPro processor. If a request_id is not set, then Digest::MD5 is used to attempt to generate a request_id for a transaction.

Deprecated methods

The following methods are deprecated and may be removed in a future release. Values for vendor and partner should now be set as arguments to Business::OnlinePayment->new(). The value for cert_path was used to support passing a path to (a Perl module/SDK from Verisign/Paypal) which is no longer used.



The following default settings exist:

server or if test_transaction() is TRUE



Handling of content(%content)

The following rules apply to content(%content) data:


If 'action' matches one of the following keys it is replaced by the right hand side value:

  'normal authorization' => 'S', # Sale transaction
  'credit'               => 'C', # Credit (refund)
  'authorization only'   => 'A', # Authorization
  'post authorization'   => 'D', # Delayed Capture
  'void'                 => 'V',

If 'action' is 'C', 'D' or 'V' and 'order_number' is not set then 'amount', 'card_number' and 'expiration' must be set.


If 'type' matches one of the following keys it is replaced by the right hand side value:

  'visa'               => 'C',
  'mastercard'         => 'C',
  'american express'   => 'C',
  'discover'           => 'C',
  'cc'                 => 'C',

The value of 'type' is used to set transaction_type(). Currently this module only supports a transaction_type() of 'C' any other values will cause Carp::croak() to be called in submit().

Note: Payflow Pro supports multiple credit card types, including: American Express/Optima, Diners Club, Discover/Novus, Enroute, JCB, MasterCard and Visa.

Setting Payflow Pro parameters from content(%content)

The following rules are applied to map data to Payflow Pro parameters from content(%content):

      # PFP param => $content{<key>}
      VENDOR      => $self->vendor ? \( $self->vendor ) : 'login',
      PARTNER     => \( $self->partner ),
      USER        => 'login',
      PWD         => 'password',
      TRXTYPE     => 'action',
      TENDER      => 'type',
      ORIGID      => 'order_number',
      COMMENT1    => 'description',
      COMMENT2    => 'invoice_number',

      ACCT        => 'card_number',
      CVV2        => 'cvv2',
      EXPDATE     => \( $month.$year ), # MM/YY from 'expiration'
      AMT         => 'amount',

      FIRSTNAME   => 'first_name',
      LASTNAME    => 'last_name',
      NAME        => 'name',
      EMAIL       => 'email',
      COMPANYNAME => 'company',
      STREET      => 'address',
      CITY        => 'city',
      STATE       => 'state',
      ZIP         => \$zip, # 'zip' with non-alphanumerics removed
      COUNTRY     => 'country',

      # As of 8/18/2009: CUSTCODE appears to be cut off at 18
      # characters and isn't currently reportable.  Consider storing
      # local customer ids in the COMMENT1/2 fields as a workaround.
      CUSTCODE    => 'customer_id',

      SHIPTOFIRSTNAME => 'ship_first_name',
      SHIPTOLASTNAME  => 'ship_last_name',
      SHIPTOSTREET    => 'ship_address',
      SHIPTOCITY      => 'ship_city',
      SHIPTOSTATE     => 'ship_state',
      SHIPTOZIP       => 'ship_zip',
      SHIPTOCOUNTRY   => 'ship_country',

The required Payflow Pro parameters for credit card transactions are:


Mapping Payflow Pro transaction responses to object methods

The following methods provides access to the transaction response data resulting from a Payflow Pro request (after submit()) is called:


This order_number() method returns the PNREF field, also known as the PayPal Reference ID, which is a unique number that identifies the transaction.


The result_code() method returns the RESULT field, which is the numeric return code indicating the outcome of the attempted transaction.

A RESULT of 0 (zero) indicates the transaction was approved and is_success() will return '1' (one/TRUE). Any other RESULT value indicates a decline or error and is_success() will return '0' (zero/FALSE).


The error_message() method returns the RESPMSG field, which is a response message returned with the transaction result.


The authorization() method returns the AUTHCODE field, which is the approval code obtained from the processing network.


The avs_code() method returns a combination of the AVSADDR and AVSZIP fields from the transaction result. The value in avs_code is as follows:

  Y     - Address and ZIP match
  A     - Address matches but not ZIP
  Z     - ZIP matches but not address
  N     - no match
  undef - AVS values not available


The cvv2_response() method returns the CVV2MATCH field, which is a response message returned with the transaction result.


As of 0.07, this module communicates with the Payflow gateway directly and no longer requires the Payflow Pro SDK or other download. Thanks to Phil Lobbes for this great work and Josh Rosenbaum for additional enhancements and bug fixes.


Ivan Kohler <>

Phil Lobbes <phil at>

Based on Business::OnlinePayment::AuthorizeNet written by Jason Kohles.


perl(1), Business::OnlinePayment, Carp, and the PayPal Integration Center Payflow Pro resources at