Internet payment gateway for online merchants.
BazPay is an internet payment gateway focused on card-not-present acceptance in browsers, mobile web and in-app checkouts. Hosted fields keep raw PAN out of your stack, 3-D Secure 2.2 defends the authorisation, and one REST API covers cards, wallets, local payment methods and SEPA Instant on the same charge object.
Built for EU, UK and Commonwealth e-commerce sellers, subscription software firms and professional-services companies. There is no POS terminal fleet in the box — every touchpoint is HTTPS, every credential is tokenised.
Why an internet-focused payment gateway matters
Card-not-present traffic behaves differently from a card-present flow. Four commitments below explain what an internet payment provider has to get right for online merchants to survive PSD2 and keep approvals steady across markets.
-
Internet-only, on purpose
BazPay is an online payment platform, not a POS vendor. There is no terminal fleet to manage and no store-side firmware to update — every integration point is HTTPS, every credential is tokenised.
-
Card-not-present designed in
3-D Secure 2.2, hosted fields, gateway-side vaulting and PSD2 exemption logic are the default flow, not an add-on. That is what card-not-present acceptance actually needs to survive PSD2.
-
Browser and mobile web on one integration
One JS drop-in covers desktop browsers, mobile browsers and web-view in-app checkouts. You do not maintain a separate integration for phones.
-
Regional acquiring, global card reach
Direct acquiring on our own regional licence. Non-regional-issued cards authorise on the same contract, so an internet payment gateway that lives in the EU, UK, Australia, Canada and New Zealand still authorises a shopper checking out from anywhere.
The surfaces the internet payment platform covers
Four checkout surfaces run through one integration. Pick the surfaces you need today, and add the rest without a new contract.
-
Browser
Browser checkout
Hosted fields render inside your checkout page. Card, expiry and CVC inputs are served from our PCI environment, so raw PAN never touches your website. Your annual return stays at SAQ A.
- Hosted fields
- Drop-in
- SAQ A
-
Mobile web
Mobile web checkout
The same JS integration adapts to mobile-web viewports, including in-app browsers. Wallet buttons render where the platform supports them; card entry is the fallback.
- Responsive
- Wallet buttons
- In-app browser
-
Hosted
Hosted payment page
A redirect flow for merchants that would rather offload the checkout surface entirely. Full PCI scope shift; your website never receives a card entry event.
- Redirect flow
- Branded page
-
In-app
Native app SDKs
iOS and Android SDKs plug native checkout into the same charge object. Apple Pay and Google Pay are wired in without a separate integration surface.
- iOS SDK
- Android SDK
- Wallets
More on the surfaces on hosted checkout products. The payment-method matrix on card and APM processing.
How the internet payment processing system handles one charge
Six stages sit between the shopper clicking Pay and the money settling into your regional settlement account. Each stage is visible in the dashboard and each stage change fires a signed webhook.
-
Serve
Your checkout page loads hosted fields over HTTPS. Origin is verified before any tokenisation call goes out.
-
Collect
Shoppers type card details inside our iframe. Your servers never see PAN in the clear — only a one-time token.
-
Score
Device fingerprint, session age and network posture are graded before the authorisation request leaves the gateway.
-
Authenticate
3-D Secure 2.2 runs only when the risk earns it; PSD2 exemption logic claims risk analysis, low-value and MIT where allowed.
-
Authorise
The tokenised charge posts to the acquirer with the authentication result and CAVV bound to the transaction for issuer scoring.
-
Settle
Funds reconcile per scheme cycle and land in your local settlement account with interchange++ line detail on every row.
Internet payment gateway vs card-present POS
The internet and card-present channels are two different products with different rules, different hardware requirements and different fraud profiles. The comparison below is useful when a hybrid merchant is deciding where the boundary sits.
| Dimension | BazPay (internet CNP) | Card-present POS setup |
|---|---|---|
| Channel | Internet / CNP only | Card-present with a POS terminal |
| Hardware | None — HTTPS integration | Terminal fleet, EMV kernels |
| Authentication | 3-D Secure 2.2 with exemption logic | Chip + PIN or contactless |
| PCI scope | Merchant SAQ A (hosted fields) | SAQ B / B-IP / D depending on setup |
| Deployment | Ship a code change | Ship devices |
| Suitable for | E-commerce, SaaS, professional services | Retail floors and hospitality |
For the buyer's comparison across processors, see payment processors. For the wider network layer, network payment gateway.
Features the internet payment gateway ships by default
Every capability below is available on the standard integration. Turn features on with a request flag or a dashboard toggle — no enterprise-tier gate on the primitives.
-
HTTPS-only endpoints
Every API call and every hosted-field script is served over TLS. There is no legacy HTTP fallback anywhere in the internet payment processing system.
-
Hosted fields
Card, expiry and CVC inputs served from our PCI environment inside your checkout — the safest way to keep PAN out of your logs.
-
Gateway-side vault
Store credentials once and re-use them across renewals, upgrades and one-clicks — portable if you ever change stack.
-
Network tokens
Visa and Mastercard network tokens refresh automatically when a card is reissued; card-on-file charges keep working.
-
3-D Secure 2.2 engine
Frictionless flow first; PSD2 exemption logic claims TRA, low-value, trusted-beneficiary and MIT where permitted.
-
Signed webhooks
HMAC-signed, replay-protected events for every state change. Delivery retries on an exponential schedule for up to 72 hours.
-
Idempotent requests
Retry-safe create requests keyed to your idempotency header. A network blip never becomes a double charge.
-
Storefront plugins
Maintained plugins for WooCommerce, Magento 2, PrestaShop and Shopware 6 mean the internet payment gateway drops into common regional stacks.
One REST call from the browser to the acquirer
The charge object is the unit of work. The browser posts a payment_method token created by hosted fields, your server creates the charge, and the response returns with the authorisation code and any 3-D Secure 2 next action bound to it.
POST /v1/charges
Idempotency-Key: 8f1c-2b3a-9e4d
{
"amount": 4990,
"currency": "EUR",
"payment_method": "pm_02H9F...",
"capture": "auto",
"three_d_secure": "required_if_needed",
"channel": "web",
"metadata": { "order_id": "ORD-10842" }
}
Switch channel to mobile_web or in_app and the
gateway records the surface for reporting. The response shape does not change. Read the
complete schema in the API reference.
Who runs on BazPay's internet payment solutions
The gateway is scoped to four merchant profiles with predictable chargeback ratios and clean AML posture. If your model fits, boarding takes days rather than weeks.
-
E-commerce sellers
DTC brands and multi-country storefronts running Shopware, Magento 2, WooCommerce or PrestaShop. Local card and APM acceptance across our markets on one integration.
-
Subscription software
SaaS teams billing monthly and annual plans with saved-card renewals, MIT exemptions and dunning-aware retries.
-
Professional services
Agencies, consultancies and B2B service firms invoicing recurring retainers through hosted payment pages.
-
Digital publishers
Membership renewals, single-issue purchases and paywall unlocks reconciled per SKU on one MID.
Out of scope for BazPay: adult, gambling, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection and MLM. BazPay does not sell POS hardware and is not a merchant of record.
Security and compliance for internet acceptance
The internet payment gateway runs inside a PCI DSS Level 1 environment assessed each year. Hosted fields, network tokens and gateway-side vaulting keep your annual return at merchant SAQ A. Authentication runs on every card charge with automatic exemption logic where the rules allow.
- PCI DSS Level 1
- Annual assessment on the acquiring and gateway environment
- Merchant SAQ A
- Hosted fields and gateway vault keep card data out of your stack
- Authentication
- 3-D Secure 2.2 with automatic exemption logic on every card charge
- GDPR
- In-region data residency; DPA on request
- TLS-only
- HTTPS on every endpoint; HSTS on merchant-facing surfaces
Questions merchants ask about internet payment providers
What is an internet payment gateway, and where does BazPay sit?
An internet payment gateway is the software that moves card and bank data from a shopper's browser or mobile app to a payment processor and returns the authorisation result. Because the shopper is not physically present with a card at a terminal, the flow is called card-not-present. BazPay is an internet payment gateway for merchants across the EU, UK, Australia, Canada and New Zealand — one API, one dashboard, no POS hardware.
How do internet payment systems differ from a POS terminal integration?
Internet payment systems handle traffic where the card and the shopper are not in the same room as the merchant. That changes what has to defend against fraud (3-D Secure 2, device fingerprinting, address verification) and how PCI scope is proven (hosted fields keep merchant scope at SAQ A). POS terminals rely on chip-and-PIN or contactless, and have their own PCI programme. BazPay ships only the internet side.
Do you provide a virtual terminal for MOTO acceptance?
A basic virtual-terminal-style flow can be run from the dashboard for one-off merchant-initiated charges against a saved credential, but BazPay is not marketed as a MOTO gateway. If mail-order or telephone-order volume is your primary channel, this is not the right internet payment provider for you.
Which internet payment gateway providers should be compared with BazPay?
Any provider that offers a direct regional acquiring relationship, hosted fields, 3-D Secure 2.2, PSD2 exemption logic, PCI DSS Level 1 and interchange++ reporting is a fair comparison. Providers that only wrap a downstream acquirer under an aggregated MID are a different category — see the payment processors comparison for how the two models diverge.
Is a native mobile app supported, or only mobile web?
Both. The mobile-web integration adapts responsively; native iOS and Android SDKs are also available and produce the same charge object as the web integration. Apple Pay and Google Pay are wired to the same platform, so you do not maintain separate flows.
What PCI scope does an internet payment platform on hosted fields leave me with?
Merchant SAQ A in most integrations. Hosted fields render inside our PCI DSS Level 1 environment, so the raw card number never touches your servers. Your annual PCI return stays at the smallest scope available to a card-accepting merchant.
Are payouts and recurring billing part of the same internet payment solutions?
Yes. The same platform ships hosted checkout, recurring billing, payouts and fraud controls. Cards, wallets, local APMs and SEPA Instant account-to-account rails all sit behind the same charge object and the same signed webhook envelope.
Which industries can board on this internet payment provider?
BazPay boards merchants across the EU, UK, Australia, Canada and New Zealand: e-commerce sellers, subscription software firms, professional-services businesses and digital publishers. BazPay does not board adult, gambling, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection or MLM merchants, and it is not a marketplace of third-party PSPs.
Wire up an internet checkout in an afternoon
Open a sandbox and post your first card-not-present charge in the same hour. Prefer to talk it through first? An integration engineer can scope the browser and mobile-web surfaces alongside gateway services, merchant acquiring and the wider payments solutions bundle.