Coder’s Eye

This weekend I wrote my first Google Checkout integration module in my favorite language, Python. I didn’t expect much, largely because I am used to the more simple and limited offering from PayPal. I thought the initial offering from Google would be simple, limited, and straightforward.

Nope.

It goes about as deep as you’d want to go, but almost all the “deep features” are optional. At the easiest, you can simply post a “buy now” button, much like you can do with PayPal. But at the most advanced, you can have complete order flow tracking with multiple order states, split and recurring payments, with tax-tables, zip-code based shipping tables, and a complete coupon system.

Two Levels

At the basic level, you can simply have Google handle taking payment for your shopping cart. You can have line items for each cart item, and a shipping charge. Once the customer buys, you get an email, and you manage the charge request and the shipment status on Google’s site.

That’s what I am doing on eBookTribe for now. Here’s the Django template for an order from that site:

<?xml version="1.0" encoding="UTF-8"?>
<checkout-shopping-cart xmlns="http://checkout.google.com/schema/2">
<shopping-cart>
<items>
{% for orderitem in cart.orderitems.all %}<item>
<item-name>{{ orderitem.title }}</item-name>
<item-description>{{ orderitem.description }}</item-description>
<unit-price currency="USD">{{ orderitem.price }}</unit-price>
<quantity>{{ orderitem.quantity }}</quantity>
</item>{% endfor %}
</items>
</shopping-cart>
<checkout-flow-support>
<merchant-checkout-flow-support>
{% if edit_url %}<edit-cart-url>{{ edit_url }}</edit-cart-url>{% endif %}
{% if continue_url %}<continue-shopping-url>{{ continue_url }}</continue-shopping-url>{% endif %}
</merchant-checkout-flow-support>
</checkout-flow-support>
</checkout-shopping-cart>


I think that is so clean, almost elegant. The bottom part is support for “continue shopping” and “edit cart” links from Google’s site.

“Level 2″ integration with Google occurs when you give Google a callback url, which must be SSL enabled. Using that callback, Google and your website can communicate regarding status changes, and your site can request card capture, refunds, set shipping status, etc. I’m looking forward to coding this part, but for now, I’m going to launch with just the level 1 integration.

Security

I’ve never been fond of how PayPal forms are so easily modified by customers. All the information is right there in the form, to be manipulated at will. That means that the merchant, me, has to manually verify totals and match it to the order before shipping. Google has a much better solution.

With Google Checkout, you get a merchant ID and key. You convert the shopping cart XML into a base64 representation and post that as one form element, and you post the signed hash for it in another form element. Since your key is private, and visible only on the server side, your customers cannot modify the form prior to submitting it.

An encoded google shopping cart form looks something like this:

<form name="google_form" action="https://sandbox.google.com/cws/v2/Merchant/YOURMERCHANTIDHERE/checkout" method="post">
<input type="hidden" name="cart"
value="PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPGNoZWNrb3V0LXNob3BwaW5n
LWNhcnQgeG1sbnM9Imh0dHA6Ly9jaGVja291dC5nb29nbGUuY29tL3NjaGVtYS8yIj4KICAgIDxz
aG9wcGluZy1jYXJ0PgogICAgICAgIDxpdGVtcz4KICAgICAgICAgICAgPGl0ZW0+CiAgICAgICAg
ICAgICAgICA8aXRlbS1uYW1lPlF1aWNrIEJlYXV0eTwvaXRlbS1uYW1lPgogICAgICAgICAgICAg
ICAgPGl0ZW0tZGVzY3JpcHRpb24+VGl0bGU6IHRlc3Qgb3JkZXIgMTwvaXRlbS1kZXNjcmlwdGlv
bj4KICAgICAgICAgICAgICAgIDx1bml0LXByaWNlIGN1cnJlbmN5PSJVU0QiPjE0Ny4wMDwvdW5p
dC1wcmljZT4KICAgICAgICAgICAgICAgIDxxdWFudGl0eT4xPC9xdWFudGl0eT4KICAgICAgICAg
ICAgPC9pdGVtPgogICAgICAgIDwvaXRlbXM+CiAgICA8L3Nob3BwaW5nLWNhcnQ+CiAgICA8Y2hl
Y2tvdXQtZmxvdy1zdXBwb3J0PgogICAgICAgIDxtZXJjaGFudC1jaGVja291dC1mbG93LXN1cHBv
cnQ+CiAgICAgICAgICAgIAogICAgICAgICAgICAKICAgICAgICA8L21lcmNoYW50LWNoZWNrb3V0
LWZsb3ctc3VwcG9ydD4KICAgIDwvY2hlY2tvdXQtZmxvdy1zdXBwb3J0Pgo8L2NoZWNrb3V0LXNo
b3BwaW5nLWNhcnQ+Cg=="/>
<input type="hidden" name="signature" value="XvnIeUBLq2loVK78RU/+PaqRLXo="/>

Conclusion

Google Checkout is quite a bit more difficult to get working initially than PayPal, but much more rewarding. After working with it for only a weekend, I think that PayPal should be quaking in its books. This is one excellent solution, and one that I really look forward to continuing to explore.

Technorati Tags: python, google checkout, gcheckout, gbuy, paypal