How to Set Up Authorize.net for XFile Ultra
Authorize.net charges cards on your site with Accept.js (card-not-present). Unlike Stripe/PayPal, card fulfillment is synchronous in the app — a successful charge grants Premium/balance without waiting on a webhook.
Authorize.net is built-in — no premium plugin required.
Where to find it
Admin → Settings → Payment → Authorize.net
1. Turn Enable Authorize.net checkout on
2. Paste API Login ID, Transaction Key, and Public Client Key
3. Use Sandbox mode with sandbox credentials first
4. Optional: Cardinal 3DS fields and digital wallet toggles
5. Save settings and test with sandbox cards
Enable for reseller (optional): shows this gateway on reseller balance top-up checkout. Member Premium upgrade and member balance top-up use the main Enable toggle only. Reseller enable needs the Reseller System premium plugin.
Fields in XFile Ultra (required)
| Field | Setting key | From Authorize.net |
|---|---|---|
| Enable | authorize_checkout_enabled |
Main on/off |
| Enable for reseller | authorize_checkout_reseller_enabled |
Reseller top-up |
| API Login ID | authorize_api_login_id |
API Credentials |
| Transaction Key | authorize_transaction_key |
API Credentials |
| Public Client Key | authorize_public_client_key |
Accept.js / Manage Public Client Key |
| Sandbox mode | authorize_sandbox |
apitest.authorize.net + test Accept.js |
Env overrides: AUTHORIZE_NET_API_LOGIN_ID, AUTHORIZE_NET_TRANSACTION_KEY, AUTHORIZE_NET_PUBLIC_CLIENT_KEY.
About webhooks / permissions
Card checkout does not require a webhook for fulfillment in this product — Accept.js charges complete in-app synchronously. You can ignore webhook setup for basic cards.
Required credentials / permissions for cards:
- API Login ID
- Transaction Key
- Public Client Key (Accept.js), with your site domain allowed
Optional wallets / 3DS need extra enrollments and credentials (see below) — those are separate from the card webhook question.
Official: Accept.js
Step 1 — API Login ID and Transaction Key
1. Sign in to the Authorize.net Merchant Interface (or sandbox)
2. Account → Settings → Security Settings → API Credentials & Keys
3. Create / reveal API Login ID
4. Create a new Transaction Key (copy it immediately)
Step 2 — Public Client Key (Accept.js)
1. In the same API Credentials area, manage Public Client Key
2. Generate / copy the Public Client Key
3. Allow your site domain for Accept.js as prompted by Authorize.net
Step 3 — Paste into XFile Ultra
1. Admin → Settings → Payment → Authorize.net
2. Paste all three keys
3. Turn Sandbox mode on with sandbox credentials
4. Enable checkout → Save
5. Checkout on /premium with a sandbox test card
What is Sandbox / Test mode?
Sandbox (sometimes labeled Test mode) means you use the provider’s test environment — fake cards, fake buyers, no real money. Turn it on while learning. When you go live:
1. Turn Sandbox / Test mode off
2. Paste live keys (not test keys)
3. Register live webhooks (Stripe/PayPal have separate Test vs Live webhook endpoints)
Optional — 3D Secure (Payer Authentication)
Under 3D Secure (Payer Authentication) you can add Cardinal credentials (API identifier, API key, org unit ID). These come from Authorize.net support — they are not on the standard API Credentials page. Leave blank if you are not using 3DS yet.
Optional — Digital wallets
Under Digital payment solutions:
- Enable PayPal, Google Pay, and/or Apple Pay toggles only after you also enroll those methods under Authorize.net → Account → Digital Payment Solutions
- Apple Pay needs merchant ID + identity certificate/key PEM fields
- Google Pay needs the payment gateway ID from Authorize.net
Follow Authorize.net’s in-app payments docs for wallet enrollment; XFile Ultra only stores the keys/toggles once that side is ready.
Common problems
Accept.js errors in the browser
Wrong Public Client Key, or domain not allowed for Accept.js.
Sandbox vs live keys mixed
Use sandbox credentials only with Sandbox on; live credentials only with Sandbox off.
Charge succeeds in Authorize.net, no Premium
Rare for sync cards — check Payment transactions and server logs. Do not assume a missing webhook is the cause for basic Accept.js charges.