Payment integration for the platform you already run
BazPay is a payment integration platform for merchants across the EU, UK, Australia, Canada and New Zealand. Add card and regional APM acceptance to a website with a pre-built plugin, drop hosted fields into a custom checkout, or wire the REST API into an ERP or back-office system. All three routes reach the same gateway, share one set of keys and settle into one reconciliation file.
Reviewed against API version 2026-04-01.
Three routes in
- Install a plugin Your storefront is one of the five below. Keys in, methods on, live this week.
- Drop in hosted fields Custom checkout, our iframes for the card inputs. Your layout, our PCI scope.
- Call the API direct Server-to-server REST. You own routing, exemptions, payouts and reconciliation.
Undecided? Compare what each route costs you in PCI scope, control and engineering days.
Five carts, five connectors, no custom development
A plugin gap means bespoke work: weeks of it, and a bill nobody planned for. We ship the connector instead, and we maintain it against the platform's release train.
-
WooCommerce
WordPress 6.3+ · WooCommerce 8.2+
Block checkout and the classic shortcode, HPOS-ready, refunds from the order screen and a REST webhook route.
- Block checkout and the classic shortcode
- Declared compatible with high-performance order storage
- Refunds, partial refunds and captures from the order screen
-
Magento
Open Source / Adobe Commerce 2.4.6+
Composer install, per-store-view method mixes, invoices mapped to captures and credit memos mapped to refunds.
Read the guide -
PrestaShop
PrestaShop 8.0+ · 1.7.8 on the legacy branch
Installed from the back office, worked from the order screen. Credit slips, custom order states and multistore keys.
Read the guide -
Shopware
Shopware 6.5 / 6.6 · PHP 8.2+
Rule Builder decides which methods appear, the state machine records what happened, Flow Builder reacts to it.
Read the guide -
OpenCart
OpenCart 4.0.2+ · 3.0.3 on the legacy branch
A deliberately small build for small catalogues. Hosted fields, status mapping, and a short list of things it does not do.
Read the guide
What you get from BazPay payment integration services
Four properties stay true whether you install a plugin, drop hosted fields into a checkout, or wire the API into an ERP. They are the reasons product, engineering and finance teams choose one integration over four.
-
One contract for cards and APMs
Card acquiring, Apple Pay, Google Pay and local methods sit behind a single BazPay contract. No brokered PSP layer, no per-scheme onboarding, no separate keys.
-
Reduced PCI scope for website payment integration
Hosted fields render the card, expiry and CVC inputs from our PCI environment. Merchants stay at SAQ A, so the annual return is short and no PAN touches your servers.
-
One integration, every rail
The same charge object handles cards, wallets, iDEAL, Bancontact, BLIK, pay by bank, PayTo, Interac and SEPA Instant. Turn a rail on with a dashboard toggle instead of a new integration.
-
Signed webhooks, idempotent API
Every event is HMAC-signed with a replay-safe timestamp. Every create request accepts an Idempotency-Key, so retries after a network blip never double-charge.
What each connector actually does
Published as a matrix rather than as five feature lists, because the useful question is not "does it support refunds" — it is "which of these does the thing my finance team needs on a Tuesday". Where a connector is limited, the limit is printed in the cell.
| Capability | WooCommerce | Magento | PrestaShop | Shopware | OpenCart |
|---|---|---|---|---|---|
| Hosted fields Card inputs are our iframes inside your own checkout, so the PAN never reaches your server. | Supported | Supported | Supported | Supported | Supported |
| Hosted checkout redirect The fallback every plugin can use while a themed checkout is still being built. | Supported | Supported | Supported | Supported | Supported |
| Bank & A2A methods iDEAL, Bancontact, BLIK, EPS and Przelewy24, each a toggle rather than a contract. | Supported | Supported | Supported | Supported | Supported |
| Apple Pay and Google Pay In-page wallet buttons on the product, cart and checkout pages. | Supported | Supported | Supported | Supported | With a limit Google Pay only; Apple Pay needs the 4.1 branch |
| Refunds from the admin Full and partial refunds worked from the order screen, without a second dashboard. | Supported | Supported | Supported | Supported | With a limit Full refunds only; partials go through the API |
| Delayed capture Authorise at checkout, capture when the parcel actually leaves the warehouse. | Supported | Supported | With a limit Capture in full; partial capture is API-side | Supported | Not in the plugin |
| Stored credentials Tokenised cards and SEPA Direct Debit or BACS mandates for subscriptions and repeat billing. | Supported Via WooCommerce Subscriptions | With a limit Vaulting yes; scheduling stays with your own job | With a limit Mandates yes; no scheduler in the module | Supported | Not in the plugin |
| Multi-store keys A separate method mix, descriptor and key pair per storefront. | With a limit One key set per site in a multisite network | Supported | Supported | Supported | With a limit Per store, but the method mix is shared |
| Webhook-driven order state The order moves when the signed event lands, not when the shopper comes back. | Supported | Supported | Supported | Supported | Supported |
| Debug log in the admin Request ids you can paste into a support message instead of describing a symptom. | Supported | Supported | Supported | With a limit Written to var/log, not surfaced in the admin | Supported |
Every connector is free, source-available to merchants using it, and released under the same version cadence as the API. A capability marked as a limit is normally reachable through the API — the plugin simply does not put a control in the admin for it.
No plugin for your stack? Nothing is held back
The connectors above call the same public API you would. There is no private endpoint, no partner-only parameter and no capability reserved for the plugins. If you are on a bespoke storefront, a headless front end or a marketplace, you build against the same contract — and you get the same methods.
- Guide Build on the REST API Hosted checkout, hosted fields or server-to-server. What each path costs you in PCI scope, control and time.
- Reference The EU, UK and Commonwealth method library Every method we settle, by market, currency, rail and shopper flow — with what each one does about refunds and repeat billing.
Where payment integration solutions land
The same BazPay gateway powers four distinct integration shapes. Pick the one that matches how buyers reach you today — you can add another later without a second contract.
-
Website payment integration
Add a card and APM checkout to a WordPress, Magento, PrestaShop, Shopware or OpenCart storefront using the maintained plugin. Online payment integration in a website usually goes live inside a working week.
-
Custom online checkout
Headless commerce, bespoke storefronts and mobile web apps embed hosted fields for the PAN inputs, keeping the rest of the checkout in the merchant's own DOM.
-
ERP payment integration
Finance and back-office systems call the REST API to raise charges against saved cards, issue refunds, and reconcile settled batches against ledger accounts.
-
Forms with payment integration
Registration, quote, application and donation forms embed the hosted checkout iframe, so payment collection inherits the same PCI scope reduction as the main store.
Building a headless storefront or a marketplace? The custom REST integration shows the endpoints, and the API reference covers the full object model.
Features engineered into every integration
The primitives below ship with every BazPay account. Plugins expose them through the admin; the API exposes them through parameters and headers. No enterprise-tier gate on the underlying capabilities.
-
Hosted fields
Card inputs served from BazPay's PCI environment inside your checkout DOM.
-
Gateway-side vault
Store credentials once, charge them for renewals, upgrades and one-clicks.
-
Network tokens
Automatic PAN refresh through Visa and Mastercard token services.
-
3-D Secure 2.2
Frictionless flow first, challenge only when the issuer or your rules demand it.
-
Interchange++ reports
Scheme fees, interchange and gateway margin split on every settled line.
-
Real-time decline data
Reason codes visible in the dashboard within seconds and streamed via webhook.
-
SEPA and SEPA Instant
Direct-debit collection and instant payouts in supported regional corridors.
-
Forms with payment integration
Drop-in hosted checkout for order forms, quote forms and application forms.
One API call, one payload, every rail
The charge endpoint is the same whether the buyer pays with a Visa credit card, Apple Pay, SEPA Instant or a BACS Direct Debit. Change the payment_method value; the request and response shapes hold.
Idempotent charge request
POST /v1/charges
Idempotency-Key: 8f1c-2b3a-9e4d
{
"amount": 4990,
"currency": "EUR",
"payment_method": "card",
"capture": "auto",
"three_d_secure": "required_if_needed",
"customer": "cus_5F9k",
"metadata": { "order_id": "ORD-10842" }
} Signed webhook event
BazPay-Signature: t=1717257600,
v1=8b3f1c...9d2e
Content-Type: application/json
{
"id": "evt_02H9",
"type": "charge.succeeded",
"created": 1717257600,
"data": { "object": { "id": "ch_..." } }
} Handler samples for common ERP and framework stacks live in the quickstart.
Security and compliance behind the integration
Whichever route you take, the underlying environment is the same: PCI DSS Level 1 on the gateway and acquiring side, PSD2-compliant strong authentication, GDPR-aligned data residency in-region. The plugin does not lower the standard; the API does not raise it.
- PCI DSS Level 1
- Annual assessment on the acquiring and gateway environment
- Merchant SAQ A
- Hosted fields keep raw PAN off your infrastructure
- Authentication
- 3-D Secure 2.2 with exemption engine on every card charge
- GDPR
- In-region data residency, DPA available on request
- SEPA / SEPA Instant
- Direct participant for approved payout corridors
From test key to first live payment
Four steps, and no procurement cycle in the middle of them. Underwriting runs in parallel with your build rather than in front of it.
-
Open a sandbox
Sign up and the test keys are visible immediately. No sales call, no demo booking, no waiting list.
-
Install or integrate
Add the connector for your platform, or call the API from your own stack. Both hit the same endpoints.
-
Turn on the methods
Pick methods per market in the dashboard. Each one is a toggle, not a fresh contract with a new provider.
-
Swap the keys
Underwriting returns live keys. Your webhooks, routing rules and reports carry over unchanged.
The detail lives in the documentation: the quickstart for the first payment, sandbox behaviour for forcing named declines, and the go-live checklist for the twelve technical checks before cut-over.
Payment integration questions merchants ask first
Short answers to the questions we hear most in sandbox calls, from product managers, finance leads and integration engineers.
What is payment integration, and what does BazPay provide?
Payment integration is the technical work of connecting a website or application to a payment gateway so it can accept cards and local payment methods. BazPay provides three routes: maintained plugins for the main EU, UK and Commonwealth e-commerce platforms, hosted fields for custom checkouts, and a REST API for headless and ERP systems.
How long does online payment integration for a website usually take?
With a maintained plugin the end-to-end path — install, sandbox test, underwriting, key swap, go-live — commonly completes within a working week. A hosted-fields integration adds a few days for the checkout layout. A custom REST integration depends on your team's scope.
Does BazPay support ACH payment integration?
ACH is a US bank rail. BazPay is a regional payment gateway, so the equivalent capabilities we ship are SEPA Instant Core direct debit and SEPA Credit Transfer, together with open banking pay-by-bank flows. If your buyers are in-region, SEPA Instant is the direct analogue for what you would use ACH for in the US.
Do you offer crypto payment integration?
No. BazPay does not process cryptocurrency transactions and does not board crypto-exchange or crypto-brokerage merchants. Our underwriting is scoped to merchants across the EU, UK, Australia, Canada and New Zealand on card and APM rails.
Can BazPay handle ERP payment integration?
Yes. Finance systems and ERPs integrate through the REST API. Common patterns include raising charges against vaulted cards for recurring invoices, importing signed webhook events into the ledger, and reconciling settled batches against interchange++ reports.
What about credit card integration in a website that does not run WordPress or Magento?
Use hosted fields inside your existing checkout. The card, expiry and CVC inputs render from our PCI environment, so the PAN never touches your origin. Your checkout HTML, styling and analytics stay entirely under your control.
Is there a difference between the plugin route and the API for capabilities?
No capability is reserved for the plugins. Every plugin calls the same public API you would. Where a plugin does not surface a control in the admin, the same operation is available through the API — the capability matrix flags any such limits explicitly.
Which industries can integrate BazPay?
BazPay is scoped to EU, UK and Commonwealth e-commerce sellers, subscription software businesses, professional-services firms and digital publishers. BazPay does not board adult, gambling, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection or MLM merchants.
Start in the sandbox today
Test keys arrive with the account, and you build against the same endpoints your live traffic will use. Pricing is published, so the cost model is settled before anyone writes a line of code.
- PCI DSS Level 1
- PSD2-compliant
- 3-D Secure 2 certified
- SEPA Instant participant
Checkout products Card and APM processing Open banking Recurring billing Fraud and 3-D Secure Analytics