Allowing customer to choose previously saved default payment method when using hosted fields

This is not strictly a bug report, but more of the question. I’m trying to figure out how to show previously stored payment methods for the customer in the web app that’s using v3 JS SDK. While that’s easy with the drop-in UI, I was not able to find anything in the documentation for the hosted fields approach.

There are two ways that I found:

1. Send a list of payment methods associated with the customer from the server.

• I’m not sure this is secure, as CreditCard object on the server-side returns reusable token and not a nonce.

1. Upon reading the drop-in v3 plugin source code, I found this:

    this._client.request({
      endpoint: 'payment_methods',
      method: 'get',
      data: {
        defaultFirst: 1
      }
    }, function (err, paymentMethodsPayload) {
      ...
    });

• Why there’s no public method in the client object (or elsewhere) that does exactly this?
• Is it OK to use the snippet above as-is?
• Any potential compliancy issues if this snippet is used without the braintree-web-drop-in?

Thank you.

[crookedneighbor]

We just released a vault-manager component to assist with this:

<script src="https://js.braintreegateway.com/web/3.11.0/js/client.min.js"></script>
<script src="https://js.braintreegateway.com/web/3.11.0/js/vault-manager.min.js"></script>
<script>
braintree.client.create({authorization: 'your-client-token-with-customer-id'}, function (err, client) {
  braintree.vaultManager.create({client: client}, function (err, vm) {
    vm.fetchPaymentMethods(function (err, paymentMethods) {
       paymentMethods // an array of payment methods
    })
  })
})

See http://braintree.github.io/braintree-web/current/VaultManager.html for docs

[lilaconlee]

At the moment we don’t have a public method just to retrieve payment methods, but it is something we’ve discussed. In the meantime, we recommend using a request from the client shown in this CodePen, which is the same method we use in Drop-in. There are not any compliance issues using the client to retrieve this data.