NFC Contactless

Submit tap-to-pay encrypted data to Priority's Checkout API — when to use NFC, mobile wallet support, request shape, TLV tag extraction, and best practices.

NFC contactless payments — commonly called "tap to pay" — let customers pay by holding a contactless card or mobile wallet near an NFC-enabled reader. The reader captures the same dynamic cryptogram an EMV chip produces, so NFC and EMV share the same security level and the same submission shape on Priority's Checkout API. The only difference is how the customer physically presents the card.

📌

Who this is for — ISVs whose deployment captures NFC data from a reader — via a vendor SDK, a custom NFC-capable device, or an integrated terminal — and submits it to Priority for authorization.


What Defines an NFC Transaction

ConditionRequired
Contactless card or mobile wallet tapped on the readerApple Pay, Google Pay, Samsung Pay, or a contactless plastic card.
NFC-enabled reader with PPS private key injectedReader returns encrypted EMV-style TLV data on tap.
Encrypted data submitted via cardAccount.emvData + cardAccount.emvDataKsnSame field shape as EMV — posted to /payment.

Because NFC produces the same dynamic cryptogram and TLV envelope as a chip read, the submission to Priority looks identical to an EMV transaction. Differentiating EMV vs NFC at the API level is not required for authorization — both flow through the same fields.


When to Use NFC

Choose NFC when...Notes
The customer has a contactless card or mobile wallet AND the merchant has NFC-enabled equipmentDefault for customer-facing POS where speed matters.
The POS device is customer-facingNFC is built for the customer to tap directly — not for staff to handle the card.
You want a low-friction checkout experienceFastest of the four entry methods.
You want the same security and interchange treatment as EMVNFC qualifies for the same card-present rates and liability shift as EMV.

For card-handling scenarios (counters, restaurants, bars where staff process the card), see Swiped Card or EMV Chip.


Required Equipment

RequirementWhere to source
NFC-capable card reader or terminal, injected with the appropriate PPS private keyPriority hardware fulfillment — see Supported Terminal Devices
PCE-enabled merchant account with access to the Checkout API /payment endpointPriority Account Management

How to Submit an NFC Payment

The submission shape is identical to EMV. The reader supplies the encrypted TLV; you forward it to /payment.

Endpoint

POST /payment (Checkout API)

Authentication

Basic auth — Base64-encoded username:password in the Authorization header.

Authorization: Basic {base64(username:password)}
Content-Type: application/json

Request body

{
  "merchantId": "4xxx0",
  "tenderType": "Card",
  "amount": "0.01",
  "cardAccount": {
    "emvData": "Xym9TXlYqOusxG1JrdlDqThnzBVZHnTziDjptEdBsv0MasvWV8IOF75Ld0OlntfIxxxxxxxxxxxxxxxx/...",
    "emvDataKsn": "8033xxxxxxx000011"
  }
}

Field reference

FieldRequiredDescription
merchantIdYour merchant identifier (MID).
tenderTypeAlways "Card" for card transactions.
amountTransaction amount as a string.
cardAccount.emvDataEncrypted NFC/EMV TLV payload from the reader — extracted from the C2 tag of the TLV.
cardAccount.emvDataKsnKey serial number associated with the NFC transaction data — extracted from the C0 tag of the TLV.

Optional: return the full response with echo=true

To receive the complete payment object in the response (instead of issuing a follow-up GET), append echo=true as a URL parameter:

POST /payment?echo=true

Successful response

HTTP 201 Created with the payment object's status set to Approved when the transaction is authorized.


Extracting Data from the TLV Payload

NFC readers return data in TLV (Tag-Length-Value) format — the same format as EMV. From the payload:

TLV TagGoes into...
C0cardAccount.emvDataKsn
C2cardAccount.emvData

[verify — confirm TLV tag conventions are universal across all PPS-injected readers used with Priority]


Mobile Wallets

NFC supports mobile wallets out of the box — Apple Pay, Google Pay, Samsung Pay, and any wallet implementing standard contactless EMV protocols. From the API's perspective there is no distinction between a contactless plastic card and a tokenized mobile wallet — the reader returns TLV data in both cases, and you submit it the same way.


Where NFC Data Comes From — by Integration Path

Integration pathHow your application gets the NFC TLV data
Vendor-Direct: PAXPAX VTX-HC application returns the encrypted TLV via PAX's SDK.
Vendor-Direct: CloverClover device application returns the TLV via Clover's SDK.
Other certified NFC readersRead via the manufacturer's SDK and forward the TLV.
Priority Terminal APIYou don't submit NFC data yourself — the Terminal API workflow handles capture and submission. Retrieve the final payment record via the Checkout API.

Trade-Offs vs Other Entry Methods

AspectEMVNFCSwipeKeyed
SecurityHighestHighest (same crypto as EMV)LowerLowest
Liability shift availableYesYesNoNo
Interchange rateLowerLowerHigherHighest
Customer experienceSlightly slower (chip read)Fastest (tap)FastSlowest
Hardware requiredEMV readerNFC readerMagstripe readerNone
Mobile wallet supportNoYesNoNo

Sandbox Testing

BehaviorDetail
Default outcomeAll valid-format card numbers approve in Sandbox.
Testing declines, AVS, or CVV failuresUse the documented test cards and scenarios — see Card Test Data.
Hardware requirementA real NFC reader injected with the PPS private key is still required in Sandbox — Sandbox simulates the gateway, not the device.
Testing walletsAny NFC-enabled mobile wallet on a test card or contactless card works for sandbox capture.

Best Practices

PracticeWhy it matters
Use customer-facing reader placementNFC is built for the customer to tap directly — placement matters for the speed advantage.
Verify the reader has the PPS private key injected before going liveAn un-injected reader will return data that fails decryption.
Extract TLV tags correctly (C0 → emvDataKsn, C2 → emvData)Swapped or wrong tags cause authorization failures.
Don't truncate or modify the encrypted payloadThe encryption breaks if any byte is altered.
Use echo=true when you need the full payment object immediatelySaves a follow-up GET request.
Don't differentiate NFC from EMV at the API levelThey share the same submission shape — your routing logic should treat them as one.

Where to Go Next


.readme-logo { display: none !important; }