Server-side contactless card activation
Systems, apparatuses, computer-readable media, and methods for activating a contactless card. A server may transmit, to a web browser on a client device, a web page. The server may receive, from the web browser, a request to activate a contactless card, the request including a cryptogram. The server may decrypt the cryptogram based on a key associated with the contactless card. The server may transition, based on the decryption of the cryptogram, the contactless card from an inactive payment state to an active payment state. The server may transmit, to the web page and based on the transition of the contactless card from the inactivated payment state to the activated payment state, an indication to activate a payment applet of the contactless card.
1. A method, comprising:
transmitting, by a server to a web browser on a client device, a web page;
receiving, by the server from the web browser, an activation request to activate a contactless card, the activation request comprising both a cryptogram and an unencrypted customer identifier associated with the contactless card;
identifying, by the server based on the unencrypted customer identifier, a master key and a counter value associated with the contactless card;
incrementing, by the server, the counter value associated with the contactless card;
encrypting, by the server, the counter value as incremented and the master key to generate a diversified key associated with the contactless card;
decrypting, by the server, the cryptogram using the diversified key;
transitioning, by the server based on decrypting the cryptogram, the contactless card from an inactive payment state to an active payment state by storing an indication in a database that the contactless card is in the active payment state; and
transmitting, by the server to the web page and based on transitioning the contactless card from the inactive payment state to the activated payment state, an indication to activate a payment applet of the contactless card.
2. The method of claim 1 , further comprising prior to transitioning the contactless card:
receiving, by the server, a first request to process a payment using the contactless card; and
rejecting, by the server, the first request based on the contactless card being in the inactive payment state.
3. The method of claim 2 , further comprising subsequent to transitioning the contactless card:
receiving, by the server, a second request to process a payment with the contactless card; and
processing, by the server, the second request based on the contactless card being in the active payment state.
4. The method of claim 1 , further comprising:
identifying, by the server in the activation request, an indication specifying the cryptogram was generated by the contactless card.
5. The method of claim 1 , wherein the indication includes a response for processing by the web page to determine whether the server transitioned the contactless card from the inactive payment state to the active payment state and, based thereon, to generate an instruction to activate the payment applet of the contactless card.
6. A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a processor, cause the processor to:
transmit, to a web browser on a client device, a web page;
receive, from the web browser, an activation request to activate a contactless card, the activation request comprising both a cryptogram and an unencrypted customer identifier associated with the contactless card;
identify, based on the unencrypted customer identifier, a master key and a counter value associated with the contactless card;
increment the counter value associated with the contactless card;
encrypt the counter value as incremented and the master key to generate a diversified key associated with the contactless card;
decrypt the cryptogram using the diversified key;
transition, based on decrypting the cryptogram, the contactless card from an inactive payment state to an active payment state by storing an indication in a database that the contactless card is in the active payment state; and
transmit, to the web page and based on transitioning the contactless card from the inactive payment state to the activated payment state, an indication to activate a payment applet of the contactless card.
7. The computer-readable storage medium of claim 6 , wherein the instructions further cause the processor to, prior to transitioning the contactless card:
receive a first request to process a payment using the contactless card; and
reject the first request based on the contactless card being in the inactive payment state.
8. The computer-readable storage medium of claim 7 , wherein the instructions further cause the processor to, subsequent to transitioning the contactless card:
receive a second request to process a payment with the contactless card; and
process the second request based on the contactless card being in the active payment state.
9. The computer-readable storage medium of claim 6 , wherein the instructions further cause the processor to:
identify, in the activation request, an indication specifying the cryptogram was generated by the contactless card.
10. The computer-readable storage medium of claim 6 , wherein the indication includes a response for processing by the web page to determine whether the processor transitioned the contactless card from the inactive payment state to the active payment state and, based thereon, to generate an instruction to activate the payment applet of the contactless card.
11. A computing apparatus comprising:
a processor; and
a memory storing instructions that, when executed by the processor, cause the processor to:
transmit, to a web browser on a client device, a web page;
receive, from the web browser, an activation request to activate a contactless card, the activation request comprising both a cryptogram and an unencrypted customer identifier associated with the contactless card;
identify, based on the unencrypted customer identifier, a master key and a counter value associated with the contactless card;
increment the counter value associated with the contactless card;
encrypt the counter value as incremented and the master key to generate a diversified key associated with the contactless card;
decrypt the cryptogram using the diversified key;
transition, based on decrypting the cryptogram, the contactless card from an inactive payment state to an active payment state by storing an indication in a database in the memory that the contactless card is in the active payment state; and
transmit, to the web page and based on transitioning the contactless card from the inactive payment state to the activated payment state, an indication to activate a payment applet of the contactless card.
12. The computing apparatus of claim 11 , wherein the instructions further cause the processor to, prior to transitioning the contactless card:
receive a first request to process a payment using the contactless card; and
reject the first request based on the contactless card being in the inactive payment state.
13. The computing apparatus of claim 12 , wherein the instructions further cause the processor to, subsequent to transitioning the contactless card:
receive a second request to process a payment with the contactless card; and
process the second request based on the contactless card being in the active payment state.
14. The computing apparatus of claim 11 , wherein the instructions further cause the processor to:
identify, in the activation request, an indication specifying the cryptogram was generated by the contactless card.
15. The computing apparatus of claim 11 , wherein the indication includes a response for processing by the web page to determine whether the processor transitioned the contactless card from the inactive payment state to the active payment state and, based thereon, to generate an instruction to activate the payment applet of the contactless card.