The only way to buy anything using a mobile app is through a Payment API Integration Development provider. The actual payment processor (a bank) and the customer's desired transaction are connected through it. Why are mediators necessary in the first place? We have implemented security measures to prevent direct interaction between our app and payment processors.

Most of these companies use some framework which includes an IDL (Interface Definition Language), and a transport (typically RPC/HTTP). A few popular ones are Protocol Buffer (used at Google), Thrift (used at Facebook, Twitter, ...), and Avro (used at LinkedIn). These frameworks allow applications to expose its interface in an IDL file (.proto, .thrift, etc.). Applications communicate to other applications by calling services (exposed at the server side using the IDL) over RPC/HTTP. Services can be written in any language supported by the framework. Similarly, clients too can be written in any language. These frameworks also support versioning that allows compatibility of newer implementation of services with older implementations of the clients and vice-versa. Other sophisticated features include compression, efficient serialization/de-serialization, etc. Some smaller companies use just HTTP REST. For details, please see:1: Protocol Buffers2: Apache Thrift3: Apache Avro

Devise-Two-Factor only worries about the backend, leaving the details of the integration up to you. This means that you're responsible for building the UI that drives the gem. While there is an example Rails application included in the gem, it is important to remember that this gem is intentionally very open-ended, and you should build a user experience which fits your individual application.