---
title: PSP Integration Guide
slug: extensions/psp-integration-guide
docTags: 
createdAt: 2026-09-22T18:20:22.602Z
---

Forter maps payment data to its own schema server-side (see [How Order Data Is Built and Mapped](https://docs.forter.com/extensions/how-order-data-is-built-and-mapped)). This guide covers the integration-side adjustments some PSPs need for Forter to get complete data.

## Timing

`app.post.auth` needs to fire after the PSP authorizes payment, so Forter can read the finished payment data.

PSPs that authorize inside `handlePayments()` and let the base `PlaceOrder` route run already satisfy this. No changes are needed.

PSPs that reimplement `PlaceOrder` or confirm the payment client-side don't fire `app.post.auth` in the standard flow, and need a re-fire added. See [Example: Stripe Payment Element](https://docs.forter.com/extensions/example-stripe-payment-element) for this pattern applied in detail.

## Passthrough

In your PSP's controller, find where it calls the `app.post.auth` hook and add `pspResponse` to the options object:

```javascript
var options = {
    req: req,
    res: res,
    pspResponse: paymentIntent // or adyenResult, braintreeTransaction, etc.
};
```

The cartridge stores it as `order.custom.forterPspAuthResult`. Forter's backend extracts card data, fingerprint, AVS/CVV results, charge ID, and more from the raw response.

This also applies to pre-auth integrations. See [Order Status Sync](https://docs.forter.com/extensions/order-status-sync) for how the status-sync job forwards this data even when post-auth is skipped.

## Hook contention

SFCC's `HookMgr.callHook()` invokes only the first registered implementation of a hook in the cartridge path. If another vendor's cartridge also registers `app.post.auth`, only one implementation runs.

If this happens, register a second hook pointing at Forter's existing handler, then call it from the other cartridge's controller.

In `int_forter_sfra/cartridge/scripts/hooks.json`:

```json
{ "name": "app.forter.post.auth", "script": "./hooks/postAuthorizationHandling" }
```

In the other vendor's cartridge, wherever it calls its own `app.post.auth`:

```javascript
hooksHelper('app.forter.post.auth', 'postAuthorization', handlePaymentResult, order, options);
```

The other vendor keeps `app.post.auth`. Both hooks fire independently.