Payment integration for the platform you already run

BazPay is a payment integration platform for merchants across the EU, UK, Australia, Canada and New Zealand. Add card and regional APM acceptance to a website with a pre-built plugin, drop hosted fields into a custom checkout, or wire the REST API into an ERP or back-office system. All three routes reach the same gateway, share one set of keys and settle into one reconciliation file.

Reviewed against API version 2026-04-01.

Three routes in

  1. Install a plugin Your storefront is one of the five below. Keys in, methods on, live this week. Fastest
  2. Drop in hosted fields Custom checkout, our iframes for the card inputs. Your layout, our PCI scope. Most control per hour spent
  3. Call the API direct Server-to-server REST. You own routing, exemptions, payouts and reconciliation. Platforms and marketplaces

Undecided? Compare what each route costs you in PCI scope, control and engineering days.

What you get from BazPay payment integration services

Four properties stay true whether you install a plugin, drop hosted fields into a checkout, or wire the API into an ERP. They are the reasons product, engineering and finance teams choose one integration over four.

  • One contract for cards and APMs

    Card acquiring, Apple Pay, Google Pay and local methods sit behind a single BazPay contract. No brokered PSP layer, no per-scheme onboarding, no separate keys.

  • Reduced PCI scope for website payment integration

    Hosted fields render the card, expiry and CVC inputs from our PCI environment. Merchants stay at SAQ A, so the annual return is short and no PAN touches your servers.

  • One integration, every rail

    The same charge object handles cards, wallets, iDEAL, Bancontact, BLIK, pay by bank, PayTo, Interac and SEPA Instant. Turn a rail on with a dashboard toggle instead of a new integration.

  • Signed webhooks, idempotent API

    Every event is HMAC-signed with a replay-safe timestamp. Every create request accepts an Idempotency-Key, so retries after a network blip never double-charge.

What each connector actually does

Published as a matrix rather than as five feature lists, because the useful question is not "does it support refunds" — it is "which of these does the thing my finance team needs on a Tuesday". Where a connector is limited, the limit is printed in the cell.

Capability by cart connector — reviewed 31 July 2026
Capability WooCommerceMagentoPrestaShopShopwareOpenCart
Hosted fields Card inputs are our iframes inside your own checkout, so the PAN never reaches your server. Supported Supported Supported Supported Supported
Hosted checkout redirect The fallback every plugin can use while a themed checkout is still being built. Supported Supported Supported Supported Supported
Bank & A2A methods iDEAL, Bancontact, BLIK, EPS and Przelewy24, each a toggle rather than a contract. Supported Supported Supported Supported Supported
Apple Pay and Google Pay In-page wallet buttons on the product, cart and checkout pages. Supported Supported Supported Supported With a limit Google Pay only; Apple Pay needs the 4.1 branch
Refunds from the admin Full and partial refunds worked from the order screen, without a second dashboard. Supported Supported Supported Supported With a limit Full refunds only; partials go through the API
Delayed capture Authorise at checkout, capture when the parcel actually leaves the warehouse. Supported Supported With a limit Capture in full; partial capture is API-side Supported Not in the plugin
Stored credentials Tokenised cards and SEPA Direct Debit or BACS mandates for subscriptions and repeat billing. Supported Via WooCommerce Subscriptions With a limit Vaulting yes; scheduling stays with your own job With a limit Mandates yes; no scheduler in the module Supported Not in the plugin
Multi-store keys A separate method mix, descriptor and key pair per storefront. With a limit One key set per site in a multisite network Supported Supported Supported With a limit Per store, but the method mix is shared
Webhook-driven order state The order moves when the signed event lands, not when the shopper comes back. Supported Supported Supported Supported Supported
Debug log in the admin Request ids you can paste into a support message instead of describing a symptom. Supported Supported Supported With a limit Written to var/log, not surfaced in the admin Supported

Every connector is free, source-available to merchants using it, and released under the same version cadence as the API. A capability marked as a limit is normally reachable through the API — the plugin simply does not put a control in the admin for it.

No plugin for your stack? Nothing is held back

The connectors above call the same public API you would. There is no private endpoint, no partner-only parameter and no capability reserved for the plugins. If you are on a bespoke storefront, a headless front end or a marketplace, you build against the same contract — and you get the same methods.

Where payment integration solutions land

The same BazPay gateway powers four distinct integration shapes. Pick the one that matches how buyers reach you today — you can add another later without a second contract.

  • Website payment integration

    Add a card and APM checkout to a WordPress, Magento, PrestaShop, Shopware or OpenCart storefront using the maintained plugin. Online payment integration in a website usually goes live inside a working week.

  • Custom online checkout

    Headless commerce, bespoke storefronts and mobile web apps embed hosted fields for the PAN inputs, keeping the rest of the checkout in the merchant's own DOM.

  • ERP payment integration

    Finance and back-office systems call the REST API to raise charges against saved cards, issue refunds, and reconcile settled batches against ledger accounts.

  • Forms with payment integration

    Registration, quote, application and donation forms embed the hosted checkout iframe, so payment collection inherits the same PCI scope reduction as the main store.

Building a headless storefront or a marketplace? The custom REST integration shows the endpoints, and the API reference covers the full object model.

Features engineered into every integration

The primitives below ship with every BazPay account. Plugins expose them through the admin; the API exposes them through parameters and headers. No enterprise-tier gate on the underlying capabilities.

  • Hosted fields

    Card inputs served from BazPay's PCI environment inside your checkout DOM.

  • Gateway-side vault

    Store credentials once, charge them for renewals, upgrades and one-clicks.

  • Network tokens

    Automatic PAN refresh through Visa and Mastercard token services.

  • 3-D Secure 2.2

    Frictionless flow first, challenge only when the issuer or your rules demand it.

  • Interchange++ reports

    Scheme fees, interchange and gateway margin split on every settled line.

  • Real-time decline data

    Reason codes visible in the dashboard within seconds and streamed via webhook.

  • SEPA and SEPA Instant

    Direct-debit collection and instant payouts in supported regional corridors.

  • Forms with payment integration

    Drop-in hosted checkout for order forms, quote forms and application forms.

One API call, one payload, every rail

The charge endpoint is the same whether the buyer pays with a Visa credit card, Apple Pay, SEPA Instant or a BACS Direct Debit. Change the payment_method value; the request and response shapes hold.

Idempotent charge request

POST /v1/charges
Idempotency-Key: 8f1c-2b3a-9e4d
{
  "amount": 4990,
  "currency": "EUR",
  "payment_method": "card",
  "capture": "auto",
  "three_d_secure": "required_if_needed",
  "customer": "cus_5F9k",
  "metadata": { "order_id": "ORD-10842" }
}

Signed webhook event

BazPay-Signature: t=1717257600,
  v1=8b3f1c...9d2e
Content-Type: application/json

{
  "id": "evt_02H9",
  "type": "charge.succeeded",
  "created": 1717257600,
  "data": { "object": { "id": "ch_..." } }
}

Handler samples for common ERP and framework stacks live in the quickstart.

Security and compliance behind the integration

Whichever route you take, the underlying environment is the same: PCI DSS Level 1 on the gateway and acquiring side, PSD2-compliant strong authentication, GDPR-aligned data residency in-region. The plugin does not lower the standard; the API does not raise it.

PCI DSS Level 1
Annual assessment on the acquiring and gateway environment
Merchant SAQ A
Hosted fields keep raw PAN off your infrastructure
Authentication
3-D Secure 2.2 with exemption engine on every card charge
GDPR
In-region data residency, DPA available on request
SEPA / SEPA Instant
Direct participant for approved payout corridors

From test key to first live payment

Four steps, and no procurement cycle in the middle of them. Underwriting runs in parallel with your build rather than in front of it.

  1. Open a sandbox

    Sign up and the test keys are visible immediately. No sales call, no demo booking, no waiting list.

  2. Install or integrate

    Add the connector for your platform, or call the API from your own stack. Both hit the same endpoints.

  3. Turn on the methods

    Pick methods per market in the dashboard. Each one is a toggle, not a fresh contract with a new provider.

  4. Swap the keys

    Underwriting returns live keys. Your webhooks, routing rules and reports carry over unchanged.

The detail lives in the documentation: the quickstart for the first payment, sandbox behaviour for forcing named declines, and the go-live checklist for the twelve technical checks before cut-over.

Payment integration questions merchants ask first

Short answers to the questions we hear most in sandbox calls, from product managers, finance leads and integration engineers.

What is payment integration, and what does BazPay provide?

Payment integration is the technical work of connecting a website or application to a payment gateway so it can accept cards and local payment methods. BazPay provides three routes: maintained plugins for the main EU, UK and Commonwealth e-commerce platforms, hosted fields for custom checkouts, and a REST API for headless and ERP systems.

How long does online payment integration for a website usually take?

With a maintained plugin the end-to-end path — install, sandbox test, underwriting, key swap, go-live — commonly completes within a working week. A hosted-fields integration adds a few days for the checkout layout. A custom REST integration depends on your team's scope.

Does BazPay support ACH payment integration?

ACH is a US bank rail. BazPay is a regional payment gateway, so the equivalent capabilities we ship are SEPA Instant Core direct debit and SEPA Credit Transfer, together with open banking pay-by-bank flows. If your buyers are in-region, SEPA Instant is the direct analogue for what you would use ACH for in the US.

Do you offer crypto payment integration?

No. BazPay does not process cryptocurrency transactions and does not board crypto-exchange or crypto-brokerage merchants. Our underwriting is scoped to merchants across the EU, UK, Australia, Canada and New Zealand on card and APM rails.

Can BazPay handle ERP payment integration?

Yes. Finance systems and ERPs integrate through the REST API. Common patterns include raising charges against vaulted cards for recurring invoices, importing signed webhook events into the ledger, and reconciling settled batches against interchange++ reports.

What about credit card integration in a website that does not run WordPress or Magento?

Use hosted fields inside your existing checkout. The card, expiry and CVC inputs render from our PCI environment, so the PAN never touches your origin. Your checkout HTML, styling and analytics stay entirely under your control.

Is there a difference between the plugin route and the API for capabilities?

No capability is reserved for the plugins. Every plugin calls the same public API you would. Where a plugin does not surface a control in the admin, the same operation is available through the API — the capability matrix flags any such limits explicitly.

Which industries can integrate BazPay?

BazPay is scoped to EU, UK and Commonwealth e-commerce sellers, subscription software businesses, professional-services firms and digital publishers. BazPay does not board adult, gambling, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection or MLM merchants.

Start in the sandbox today

Test keys arrive with the account, and you build against the same endpoints your live traffic will use. Pricing is published, so the cost model is settled before anyone writes a line of code.

  • PCI DSS Level 1
  • PSD2-compliant
  • 3-D Secure 2 certified
  • SEPA Instant participant