How to add a payment gateway to your website.
Adding a payment gateway to a website comes down to four choices — the checkout surface, the integration path, the webhook handler and the underwriting scope. This page walks through all four with BazPay, a regional acquirer and gateway that ships storefront plugins alongside a small REST API.
Built for EU, UK and Commonwealth e-commerce sellers, subscription software firms and professional-services companies. Direct regional acquiring on our own licence — no aggregated MID and no reseller layer in between.
Why merchants add BazPay as their website's payment gateway
Four things stay true whether you install a plugin at 10am or wire the API by hand. They are the practical reasons an integration goes from key to live inside a working week.
-
A short path from key to first charge
Sandbox keys are issued at sign-up. A storefront on WooCommerce, Magento 2, PrestaShop or Shopware can be posting test charges the same afternoon. A custom stack calls one REST endpoint and reads one signed webhook.
-
Card data stays out of your website
Hosted fields render card, expiry and CVC inputs inside our PCI DSS Level 1 environment. Your annual return stays at merchant SAQ A no matter how deep the integration goes — no full PCI environment to run.
-
One gateway covers every rail
Adding the payment gateway once opens cards, Apple Pay, Google Pay and local payment methods on the same integration. No new contract to enable a method later — just a dashboard toggle.
-
Real support during the cutover
A named integration engineer reviews the first pull request and signs off on the sandbox before live keys are enabled. The shared channel is monitored during the go-live window, not just during the sales call.
Four ways to add the payment gateway to a website
Pick the surface that matches your stack and how much of the checkout you want to keep on your own domain. Every surface uses the same underlying charge object and event stream.
-
Plugin
Install a maintained storefront plugin
Fastest path if your website already runs on WooCommerce, Magento 2, PrestaShop or Shopware. Install the plugin, paste your API keys, save. Checkout, refunds, capture, webhooks and recurring billing come pre-configured.
- WooCommerce
- Magento 2
- PrestaShop
- Shopware 6
-
Hosted
Redirect to a hosted checkout page
The lightest custom path. Your website posts an amount and currency; BazPay serves the payment page and returns the shopper afterwards. No PCI concerns on your side at all.
- Hosted page
- Themed link
-
Fields
Embed hosted fields inside your checkout
Keeps the shopper on your domain while card inputs render from our PCI environment. The right balance of brand control and low scope.
- Drop-in JS
- Custom styling
-
REST
Call the REST API from your backend
For teams building a bespoke checkout or an admin flow. One versioned endpoint creates a charge across every rail; the response shape stays stable regardless of the payment method.
- Versioned
- Idempotent
Full plugin coverage on the integrations directory. Prebuilt hosted pages and drop-in components on hosted checkout products. The abstract build motion on integrated payment solutions.
Seven steps to add the gateway and go live
The concrete walkthrough. Each step is a checkable item you can tick off; each stage change fires a signed webhook so your team knows where the integration stands.
-
Open a sandbox
Sign up on bazpay.com; sandbox keys, a webhook signing secret and dashboard invites are issued at the same time. No sales call required.
-
Pick a checkout surface
Plugin, hosted page, hosted fields or bespoke REST — the four supported entry points to add the gateway to your website.
-
Wire the integration
Install the plugin or write the create-charge call. Use the shipped webhook-verification helper to check the HMAC signature on inbound events.
-
Test on sandbox data
Replay approvals, declines, 3-D Secure 2 flows and dispute events. Sandbox output matches the live surface, so tests exercise the real paths.
-
Get the first PR reviewed
A named integration engineer reviews your integration PR, checks webhook wiring and signs off on the sandbox before live keys are enabled.
-
Submit underwriting
KYC and merchant review. Documents, ownership and revenue model reviewed against our regional underwriting policy.
-
Flip live keys
Live API keys enabled. Real-time analytics show approval quality from the first hour and the shared channel is monitored during cutover.
Plugin path vs custom REST path
The two most common ways to add the payment gateway have different trade-offs. Both are first-class integration paths; picking one is a stack decision rather than a tier one.
| Dimension | Plugin path | Custom REST path |
|---|---|---|
| Best for | Storefronts on major regional stacks | Bespoke websites or custom checkouts |
| Time to first test | One afternoon | One to three days |
| Code written | Config, no code | One create-charge call + one webhook handler |
| PCI scope | Merchant SAQ A | Merchant SAQ A (via hosted fields) |
| 3-D Secure 2 | Bundled | Bundled |
| Recurring billing | Bundled | Wire the subscription endpoint |
| Update path | Plugin release notes | Versioned API + deprecation window |
Fees and settlement on the pricing page. Buyer's-shortlist context on payment processors; the operational envelope on payment gateway services.
Features you actually touch during setup
The eight capabilities below are the ones a team hits while adding the payment gateway to a website. Every one ships on the standard integration.
-
Self-serve sandbox
Test keys and a matching dashboard the moment you sign up — no gated demo before you write code.
-
Hosted fields
Card, expiry and CVC inputs served from our PCI environment inside your existing checkout, keeping merchant SAQ A intact.
-
Storefront plugins
Maintained plugins for WooCommerce, Magento 2, PrestaShop and Shopware — checkout, refunds, capture, webhooks and recurring billing on install.
-
3-D Secure 2.2 engine
Authentication with automatic exemption logic — you do not code exemption rules by hand; the platform applies them where PSD2 allows.
-
Signed webhooks
HMAC-signed, replay-protected events for every state change. Delivery retries on an exponential schedule for up to 72 hours.
-
Idempotency keys
Retry-safe writes across create, capture, refund and payout. A network blip while adding the gateway never becomes a double charge.
-
Dashboard admin
Users, roles, audit log, API keys, webhook secrets, rule builder — everything the merchant team needs after the site is live.
-
Real-time analytics
Approval, decline, fraud verdict and payout data visible within seconds after the first live charge — the first thing to watch during go-live.
The two calls that add a payment gateway on a custom website
Custom stacks need one create-charge call from the backend and one signed-webhook handler. That is the whole minimum viable integration. Everything else — captures, refunds, subscriptions, disputes — reuses the same shape.
POST /v1/charges
Idempotency-Key: 8f1c-2b3a-9e4d
BazPay-Version: 2026-04-01
{
"amount": 4990,
"currency": "EUR",
"payment_method": "card",
"capture": "auto",
"three_d_secure": "required_if_needed",
"metadata": { "order_id": "ORD-10842" }
}The response returns a canonical charge object with the authorisation code, the network it landed on and any exemption applied. Full schema in the API reference; walkthrough samples in the developer docs.
Where teams add the payment gateway most
The four website profiles below already run BazPay-shaped integrations in production. The path depends on the stack; the underlying platform is the same.
-
WordPress storefronts
Install the WooCommerce plugin, paste sandbox keys, run the reference checkout flow, then submit underwriting for live keys.
-
Magento 2 / Adobe Commerce
Add the module through Composer, configure keys and payment methods, verify a signed webhook in the built-in event logs.
-
PrestaShop and Shopware sites
Both stacks ship maintained modules — enable them, configure recurring billing if needed, and the checkout renders BazPay hosted fields.
-
Bespoke websites and admins
One create-charge call plus a signed-webhook verification handler is enough for a fully custom checkout. The API surface is designed for a small team.
Out of scope for BazPay: adult, gambling, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection and MLM. BazPay is not a merchant of record and does not act as a marketplace of third-party PSPs.
Security and boarding requirements
The environment that handles card data is assessed under PCI DSS Level 1 each year. Hosted fields keep the merchant scope at SAQ A. Authentication runs on every card charge with automatic exemption logic. Underwriting is scoped to merchants across the EU, UK, Australia, Canada and New Zealand — the explicit board list matters, so review it before starting integration.
- PCI DSS Level 1
- Annual assessment on the acquiring and gateway environment
- Merchant SAQ A
- Hosted fields and gateway vault keep card data out of your stack
- Authentication
- 3-D Secure 2.2 with automatic exemption logic on every card charge
- GDPR
- In-region data residency; DPA on request
- Underwriting scope
- Merchants across the EU, UK, Australia, Canada and New Zealand — explicit board list
Common questions when adding a payment gateway to a website
How do I actually add a payment gateway to my website with BazPay?
Sign up for a sandbox account, pick a checkout surface (plugin, hosted page, hosted fields or REST), wire the integration, verify a signed webhook against your handler, replay test flows in sandbox, get the first PR reviewed by a named engineer, submit underwriting, and flip live keys. The full walkthrough with dashboard screenshots lives in the developer docs.
How long does it take to add the payment system to a website?
A storefront on WooCommerce, Magento 2, PrestaShop or Shopware can be posting sandbox charges the same afternoon. A bespoke website with a small dev team typically wires the create-charge call and the webhook handler in one to three days. Underwriting for live keys usually clears in a few business days for merchants across the EU, UK, Australia, Canada and New Zealand once the KYC pack lands.
Do I need a developer to add the payment gateway to a website?
Not if your site runs on WooCommerce, Magento 2, PrestaShop or Shopware — the maintained plugin does the wiring. A bespoke site needs a developer to make the create-charge call and verify one signed webhook. The API surface is small and documented; a competent developer completes the first integration in a working day.
Which website platforms does the payment gateway add-in support out of the box?
Maintained plugins ship for WooCommerce (WordPress), Magento 2 / Adobe Commerce, PrestaShop and Shopware 6. Each handles checkout, refunds, capture, webhooks and recurring billing on install. Other platforms integrate through the REST API using the same endpoints the plugins call.
Will adding this payment gateway push my website into full PCI scope?
No. Hosted fields render card, expiry and CVC inputs inside BazPay's PCI DSS Level 1 environment, so raw PAN never touches your website's servers. Your annual return stays at merchant SAQ A regardless of how deep the integration goes on the rest of your product.
How is 3-D Secure 2 handled when we add the payment gateway?
The platform runs 3-D Secure 2.2 with automatic PSD2 exemption logic. You do not code exemption rules by hand; the gateway applies TRA, low-value, trusted-beneficiary or MIT exemptions where PSD2 permits. When a challenge does fire, the shopper is prompted in their issuer's flow and liability shifts to the issuer.
Which merchant types can add BazPay to their website?
Merchants across the EU, UK, Australia, Canada and New Zealand: e-commerce sellers, subscription software firms, professional-services businesses and digital publishers. BazPay does not board adult, gambling, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection or MLM merchants, and does not support marketplace-style MOR flows.
Can I migrate saved cards when I add BazPay to replace another gateway?
Yes. Stored credentials and existing network tokens can be imported from an incumbent processor under a scheme-approved migration, subject to the receiving bank's consent letters. Old and new webhook streams typically run in parallel during cutover so no renewal cycle is missed.
Add BazPay to your website this week
Share your stack, storefront platform and business model. An integration engineer will confirm boarding fit and map the wiring inside one working day. See also integrated payment solutions, gateway services and payment processors.