> Documentation index: [Saleor](/llms.txt) · [This section](/developer/llms.txt)
> Source: https://docs.saleor.io/developer/app-store/legacy-plugins/braintree

# Braintree Plugin

<a id="creating-payment"></a>

## Creating payment

The [`checkoutPaymentCreate`](/api-reference/deprecated/checkout/mutations/checkout-payment-create.md) mutation takes the following arguments:

-   `id`: the checkout id (if required by a payment gateway).
-   `input`: [PaymentInput](/api-reference/payments/inputs/payment-input.md) object:
-   `gateway`: the ID of the selected payment gateway (a list of the available payment gateways can be fetched from the `Checkout.availablePaymentGateways` field). The selected gateway must support the checkout currency.
-   `token`: a client-side generated payment token (if required).
-   `amount`: the total amount of this operation.
-   `returnUrl`: URL of a storefront view where the user should be redirected after requiring additional actions. Payment with additional actions will not be finished if this field is not provided.
-   `storePaymentMethod`: the type of payment storage in a gateway. [StorePaymentMethod](/api-reference/payments/enums/store-payment-method-enum.md) value. If not provided, defaults to `NONE`.
-   `metadata`: a list of [MetadataInput](/api-reference/miscellaneous/inputs/metadata-input.md).

This mutation returns the following fields:

-   `checkout`: the updated checkout object.
-   `payment`: the newly created payment object.
-   `errors`: a list of errors that occurred during mutation execution.

```graphql
mutation {
  checkoutPaymentCreate(
    id: "Q2hlY2tvdXQ6ZTEzZDFjOTItOWJkNi00ODViLTgyMDctZTNhM2I5NjVkZTQw"
    input: {
      gateway: "mirumee.payments.braintree"
      token: "tokencc_bh_s3bjkh_24smq8_6c6zhq_w4v6b9_8vz"
      amount: 25.99
      storePaymentMethod: ON_SESSION
      metadata: [{ key: "user_id", value: "#1234" }]
    }
  ) {
    payment {
      id
      chargeStatus
      metadata {
        key
        value
      }
    }
    paymentErrors {
      field
      message
    }
  }
}
```

As a result, we get the payment object:

```json
{
  "data": {
    "checkoutPaymentCreate": {
      "payment": {
        "id": "UGF5bWVudDox",
        "chargeStatus": "NOT_CHARGED",
        "metadata": [
          {
            "key": "user_id",
            "value": "#1234"
          }
        ]
      },
      "errors": []
    }
  }
}
```

Afterward we can call [`checkoutComplete`](/api-reference/checkout/mutations/checkout-complete.md) mutation to finalize checkout.

<a id="pci-dss-compliance"></a>

## PCI DSS compliance

The following diagram shows the flow of sensitive data between services when using the Braintree plugin:

```mermaid
sequenceDiagram
    box Merchant controlled
    actor User via storefront
    end
    participant Saleor
    participant Braintree

    rect rgba(240,150,150,0.5)
        note right of User via storefront: Primary Account Number (PAN) Flow
        User via storefront <<->> Braintree: Pass sensitive data, including credit card number and PIIs<br/>to render the payment UI
    end

    User via storefront ->> Saleor: Pass non-sensitive payment data*
    create participant Saleor database
    Saleor ->> Saleor database: Store internal transaction model (non sensitive)
    Saleor ->> Braintree: Pass through non-sensitive payment data*

    Braintree ->> Saleor: Pass non-sensitive payment data* from Braintree
    Saleor ->> Saleor database: Update transaction model (non sensitive)
    Saleor ->> Saleor database: Save non-sensitive payment data* from Braintree
    Saleor ->> User via storefront: Pass through non-sensitive payment data* from Braintree

    rect rgba(240,150,150,0.5)
        note right of User via storefront: Sensitive Authentication Data (SAD) Flow
        User via storefront <<->> Braintree: Process payment, 3d secure flow
    end
```

\*Passes non-PCI DSS regulated payment information, such as customer IP address, customer email, customer billing address.

For more information about Braintree PCI DSS compliance - see their [docs](https://developer.paypal.com/braintree/articles/risk-and-security/compliance/pci-compliance).