Accept.js tokenization (PCI SAQ A-EP) with direct card fields (no iframe) Accept Hosted (PCI SAQ A) supported as an alternative hosted flow Apple Pay: server-side merchant validation, cert management via env.php, domain verification support Google Pay: native sheet UX + automatic gateway ID detectio