Orchestrator Oc

This document provides a complete, easy-to-read guide to the Orchestrator Oc (Component Orchestrator) and its companion Token Authority API.

It explains how the system works end-to-end, from authentication through to rendering payment components, and how to embed the Orchestrator Oc into Evo Products.

1. What Is the Orchestrator Oc?

The Orchestrator Oc (pay-group-payments-component-orchestrator) is a Micro Frontend (MFE) that acts as a gateway for loading payment-related UI components inside Evo enabled products.

Think of it as a smart orchestrator: before it shows any payment UI to the user, it first checks that the user is authenticated and authorized (has the Administrator role). Only then does it dynamically load the requested payment component.

In simple terms:

Evo Product --> Orchestrator Oc --> "Are you allowed to see this?" --> Yes --> Load the payment component

2. Architecture Overview

The Orchestrator Oc sits between the Evo Product (your host application) and the payment components your users need to access. Its job is to handle authentication and authorization so the target component can focus on its own functionality.

How the pieces fit together:

 Evo Product (Host Application)
        |
        |                                Embeds the Orchestrator Oc with parameters
        v
 +--------------------------+
 |      Orchestrator Oc           |
 |  (Component Orchestrator)|
 +--------------------------+
        |
        |                                Authenticates the user and checks
        |                                they are authorized to access the
        |                                requested payment component
        v
 +--------------------------+
 |    Target Component      |            e.g., transactions-list, pay-reporting,
 |  (Loaded automatically)  |            adyen-dispute, onboarding
 +--------------------------+

Key points:

The Orchestrator Oc authenticates the user via an Access Button Token obtained from the Evo host.
It verifies the user is authorized (correct role and subscription) and that the merchant is compliant (CreditRisk approved, KYC active) before loading the requested component.
Once authorized, it passes a signed JWT bearer token to the target component.

The orchestrator communicates through the Evo BFF proxy layer. For details, see the Evo BFF Documentation.

3. Environments

Environment	Component Name	Registry URL
Dev	`pay-group-payments-component-orchestrator`	`https://mfe.test.workspace.accessacloud.com/`
Test	`pay-group-payments-component-orchestrator-test`	`https://mfe.test.workspace.accessacloud.com/`
Staging	`pay-group-payments-component-orchestrator-staging`	`https://mfe.test.workspace.accessacloud.com/`
Demo	`pay-group-payments-component-orchestrator-demo`	`https://mfe.workspace.accessacloud.com/`
Production	`pay-group-payments-component-orchestrator`	`https://mfe.workspace.accessacloud.com/`

Note: Dev, Test, and Staging use the test Evo registry (mfe.test.workspace.accessacloud.com), while Demo and Production use the live Evo registry (mfe.workspace.accessacloud.com). When embedding the Orchestrator Oc, make sure you reference the correct component name and registry URL for your target environment.

For testing, use Demo — it is the stable environment recommended for integration testing and validation before going to Production. Dev, Test, and Staging can also be used for testing, but they are less stable and may receive frequent updates.

4. End-to-End Flow

Here is the complete journey from when a user opens a payment feature to when they see the UI:

Step-by-Step Walkthrough

#	What Happens	Details
1	User navigates to a payment feature in an Evo Product	The Evo Product loads the Orchestrator Oc and passes context: which component to show, the application identity, and the subscription identity
2	Orchestrator Oc validates the incoming parameters	If the component name, application ID, or subscription ID are missing or invalid, the user sees an error immediately — no unnecessary backend calls are made
3	Orchestrator Oc obtains an Access Button Token from the Evo host	The token is retrieved from the Evo platform (via the iframe or `window.AccessEvo.mfeHost.getButtonToken`), proving the user has an active Evo session
4	Orchestrator Oc sends an availability request through the Evo BFF	The request includes the component name, application ID, and subscription ID, along with the user's button token for authentication
5	orchestrator API identifies the user from the token	The user's organisation and identity are extracted from the token claims
6	orchestrator API retrieves the user's profile and permissions from EvoPlatform	The API queries Evo Platform to get the user's role (e.g., Administrator), their organisation, and their active application subscriptions
7	orchestrator API verifies the user is authorized	The API checks: (a) the organisation matches, (b) the user holds a subscription for the requested application, (c) the specific subscription ID is valid, and (d) the user has an Administrator role. Non-administrators are denied access
8	orchestrator API verifies merchant compliance	The API verifies: (a) in-product onboarding is enabled, (b) the merchant account exists, (c) CreditRisk assessment is approved, and (d) Adyen KYC status is active. Exception: compliance checks are skipped for the `onboarding` component so merchants can complete their setup
9	orchestrator API issues a signed authorization token (JWT)	A 60-minute JWT is generated containing the organisation, merchant, application, subscription, component type, and granted feature permissions
10	Orchestrator Oc receives the authorization response	The response includes the signed JWT (`authToken`) and the `evoOrganisationId` for tenant context
11	Orchestrator Oc renders the requested payment component	The target component (e.g., transactions list, reporting dashboard) is dynamically loaded from the OC Registry and receives the JWT and organisation ID as props for its own API calls

5. How to Embed the Orchestrator Oc

This section covers the Orchestrator Oc-specific steps needed to embed the component. For the full MFE hosting guide (importmap, initialiseMfes, rendering MFEs, language support, metadata retrieval, and more), refer to the Evo MFE Hosting Documentation:

https://evo-docs.access-workspace.com/docs/mfes/hosting-mfes

5.1 OC Client Scripts

This step is required. Add the appropriate <script> tag to the <head> of your host application's HTML. These scripts enable the OC framework to discover, fetch, and render components from the registry.

Registry Script URLs by Environment:

Environment	PaySuite OC Registry Script	Pay MFE Registry Script
Demo	`<script src="https://oc-registry.stage.guestline.app/registry/oc-client/client.js"></script>`	`<script src="https://mfe.pay.accessacloud.com/registry/oc-client/client.js"></script>`
Production	`<script src="https://oc-registry.eu.guestline.app/registry/oc-client/client.js"></script>`	`<script src="https://mfe.pay.accessacloud.com/registry/oc-client/client.js"></script>`

Example (Demo):

Add both registry scripts to the <head> of your host application:

<head>
  <!-- OC Registry Script -->
  <script src="https://oc-registry.stage.guestline.app/registry/oc-client/client.js"></script>
  <!-- Pay MFE Registry Script -->
  <script src="https://mfe.pay.accessacloud.com/registry/oc-client/client.js"></script>
</head>

For Evo Products integrated under the tab you should use:

<EvoIframeMfesProvider>
  <EvoMfeApp
    key={`${componentName}-${APPLICATION_ID}`}
    instanceId="b11aa345-55e9-4672-8a67-cd5f980c37cb"
    name="pay-group-payments-component-orchestrator"
    version="x.x.12"
    parameters={{
      componentName,
      componentVersion: 'x.x.x',
      applicationId: ${APPLICATION_ID},
      applicationSubscriptionId: ${APPLICATION_SUBSCRIPTION_ID},
    }}
  />
</EvoIframeMfesProvider>

When you run an Evo Product standalone using:

<EvoMfesProvider>
  <EvoMfeApp
    key={`${componentName}-${APPLICATION_ID}`}
    instanceId="b11aa345-55e9-4672-8a67-cd5f980c37cb"
    name="pay-group-payments-component-orchestrator"
    version="x.x.12"
    parameters={{
      componentName,
      componentVersion: 'x.x.x',
      applicationId: ${APPLICATION_ID},
      applicationSubscriptionId: ${APPLICATION_SUBSCRIPTION_ID},
    }}
  />
</EvoMfesProvider>

You're not inside the Evo tab you need to manually set:

window.AccessEvo.mfeHost.getButtonToken = getButtonToken()

5.2 Orchestrator Oc Parameters

When rendering the Orchestrator Oc via window.AccessEvo.mfes.add, the following parameters are required:

(See the Evo MFE Hosting Docs on how to set up and call this function)

Parameter	Type	Required	Description
`componentName`	`string`	Yes	Name of the component to load: `"transactions-list"`, `"pay-reporting"`, `"adyen-dispute"`, or `"onboarding"`
`componentVersion`	`string`	Yes	Version of the target component (e.g., `"1.0.0"`)
`applicationId`	`string` (UUID)	Yes	Your Evo Application Identifier
`applicationSubscriptionId`	`string` (UUID)	Yes	Your Application Subscription Identifier

Example:

const mfe = window.AccessEvo.mfes.add({
  instanceId: "unique-instance-id-here",
  name: "pay-group-payments-component-orchestrator",
  container: document.getElementById("mfe"),
  parameters: {
    componentName: "transactions-list",
    componentVersion: "1.0.0",
    applicationId: "6bc086b7-4c22-4a0b-a246-37393eeebec9",
    applicationSubscriptionId: "b5246234-caed-4204-b4b7-075bd35feaea",
  },
});

React Example (using EvoMfeApp):

import { EvoMfeApp } from '@access-evo/evo-api';

// Must be nested inside EvoMfesProvider in the component tree
<EvoMfeApp
  instanceId="unique-instance-id-here"
  name="pay-group-payments-component-orchestrator"
  parameters={{
    componentName: "transactions-list",
    componentVersion: "1.0.0",
    applicationId: "6bc086b7-4c22-4a0b-a246-37393eeebec9",
    applicationSubscriptionId: "b5246234-caed-4204-b4b7-075bd35feaea",
  }}
/>

6. Supported Components

Component Name	Description	Onboarding Required?	Guide
`onboarding`	Merchant onboarding workflow — data collection, credit risk, Adyen KYC, and application status.	No	Onboarding OC
`transactions-list`	Query, filter, and manage payment transactions. Supports refunds, cancellations, captures, and CSV export.	Yes	Transactions List
`pay-reporting`	Financial settlement and payout reporting. Four report types with CSV/XLSX export.	Yes	Pay Reporting
`dispute`	Dispute and chargeback management via Adyen Platform Experience SDK. Permission-based read-only or full management views.	Yes	Disputes

1. What Is the Orchestrator Oc?​

2. Architecture Overview​

3. Environments​

4. End-to-End Flow​

Step-by-Step Walkthrough​

5. How to Embed the Orchestrator Oc​

5.1 OC Client Scripts​

5.2 Orchestrator Oc Parameters​

6. Supported Components​