title: Exposing a payment page as an API
body: <p>I have a payment page designed and hosted on a PCI Compliant environment. My clients can execute a payment through my gateway by posting merchantID, orderID, email, mobile number and amount to a url I have exposed.</p>
  
  <ol>
  <li>When my client post this values to the url,it renders a payment page over a secure SSL communication.</li>
  </ol>
  
  <p>2.Clients can fill up their card details and can execute the payment.</p>
  
  <p>But right now, the url i'm exposing is not an api. Its a plain url which can accept POST requests and will render a payment form.It has no authentication right now. Im identifying my clients using merchantID.</p>
  
  <p>I am trying to build an API using which my clients can post the above parameters. The API will have an authentication header as well on which they have to pass an API key for authorization and it will render the payment page.</p>
  
  <p>I am using phil sturgeon REST API which is buit on codeigniter frame work.During my development test, I found that the page where I have integrated, google has identified it as a phising site.</p>
  
  <p>This is the client side code which my client has to integrate on their side</p>
  
  <pre><code>$ch = curl_init();
  $data = array('emailID' =&gt; $_POST['emailID'], 'mobileNo' =&gt; $_POST['mobileNo'],'orderID'=&gt;$_POST['orderID'],'amount'=&gt;$_POST['amount']);
  
  curl_setopt_array($ch, array(
      CURLOPT_RETURNTRANSFER =&gt; false,
      CURLOPT_URL =&gt; 'http://www.xecute/pay/',
      CURLOPT_HTTPHEADER =&gt;array ('X-API-KEY:123456789'),
      CURLOPT_POSTFIELDS =&gt; $data
  ));
  
  $response = curl_exec($ch) ;
  </code></pre>
  
  <p>But instead of coming to my URL, the page loads in his page itself,that is the address bar url remains the clients and not mine. An may be this is reason why its showing as phishing?</p>
  
  <p>Can anyone suggest how this can be done in a standard way.</p>