Improvement
Data Classification Markers in the API References
Fields that carry regulated data now show a classification marker next to the parameter name throughout the API references.pci-pan marks a card number, or
a value from which one can be reconstructed; pci-sad marks sensitive
authentication data such as security codes and cryptograms; pii marks personal
data under the GDPR. You can see which parts of a payload attract handling
obligations before writing any code against them.Most fields carry no marker, and that absence is deliberate: it states the field
holds none of those categories, not that nobody has looked yet. Masked and
truncated card numbers are the common case — 411111 •••••• 1111 identifies
nobody on its own, so it carries no marker.The marker is also a gate. Sending values into pci-pan or pci-sad fields
requires your PCI DSS certification on file at SAQ-D or a full Report on
Compliance; sending personal data into pii fields requires a data processing
agreement. Contact support@hellgate.io to put
either in place.Account Information now marks the personal data it holds — names, dates of
birth, social security numbers, email addresses, postal addresses, phone
numbers, and the account-holder and beneficial-owner details on a payout
account. The full legend is on the
Authentication API overview.Nothing about any endpoint changed — this is documentation only.Improvement
Hellgate Web SDK (v3.11.0)
Central Control Over Card Saving
Decide once, when you create a session, whether cards are saved — always, never, or left to the cardholder — and the SDK enforces that policy at checkout. Your card-retention rules stay consistent across every page that embeds the SDK, with nothing extra to implement in each frontend. The SDK also tells you which policy is active, so you can show a “Save my card” checkbox only when the cardholder really has the choice.Improvements and bugfixes
- A cardholder’s decision not to save their card is now always honored. Previously, in some integrations, declining to save a card could still result in a saved card.
New Release
Link documentation now public
Link — the protocol-abstraction runtime of the Composable Payment Architecture — now has public documentation. Link is the platform’s PSP and provider connectivity layer: define a versioned API contract (a protocol) once and bind it to any provider through declarative backends, so integration becomes configuration, not code. It is the component Commerce routes through to reach acquirers and PSPs, and that Specter reaches through to call external risk engines.Explore the overview, core concepts, and the API reference.New ReleaseImprovement
Hellgate Web SDK (v3.10.0)
Cardholder-Aware Token Lifecycles
Align token retention with what your cardholder actually agreed to. A new optionalephemeral?: boolean argument on process() and tokenize() defaults to true,
meaning the cardholder is not remembered. Flip it to false only on explicit
consent — for example, when a customer ticks a “Save my card” box at checkout.Smarter Scheme Validation
Allowed card schemes configured on the session now flow through to client-side card number validation. Cardholders see scheme errors immediately, before the request ever leaves the browser.Improvements and bugfixes
- Empty
card_schemesconfiguration now correctly allows all schemes. - Separate expiry month/year inputs now treat
'1'as a valid month and properly reject past-expiry dates. - Demo: a new “Save my card” checkbox in the tokenization demo wires straight into the new ephemeral toggle so you can try it end-to-end.
New Release
Hellgate Web SDK (v3.9.0)
Added support to split the expiriy input fields in the Web SDK.New ReleaseImprovement
Hellgate Android SDK (v1.1.0)
The Android SDK now encrypts the full payload — including any additional data — into a single JWE and returns it to your app, instead of calling the tokenization backend directly. This simplifies your integration and keeps sensitive data encrypted end to end.Improvements and bugfixes
- Additional cardholder data is now encrypted as part of the JWE token.
- Hellgate error responses now surface with clearer, more actionable detail.
- Removed support for tokenizing through an external token provider.
- Updated environment URLs.
Improvement
Hellgate Web SDK (v3.7.0)
Add ‘onSessionComplete’ handler to Hellgate® client with result data.Improvement
Hellgate Web SDK (v3.5.3)
Improved the SDK with small but important fixes:- Fix masked input behaviour
- Reject cardHandler.process() promise if BE responds 40x / 50x status code
- Await cardHandler.process() throws exceptions if card date is not complete or invalid
- Show full CVC code up to 4 digits
- Card scheme validation by default
- UnionPay card number input
- Encrypt additional_data payload on tokenize
- User can refresh CVC2 code of a token from WebSDK
New Release