Payment gateway integration for websites and mobile apps.

BazPay is a direct EU, UK and Commonwealth payment gateway with an integration surface designed for small engineering teams. Hosted fields for the web, native SDKs for mobile, signed plugins for common storefronts and one versioned REST API for everything else — pick the integration path that fits your stack.

Built for merchants across the EU, UK, Australia, Canada and New Zealand: e-commerce sellers, subscription software firms and professional-services companies. Sandbox keys are self-service; a named integration engineer reviews your first pull request before you flip to live.

Talk with sales Read the API reference

Why the integration is short work for small teams

Four properties of the platform decide whether a payment gateway integration in website or mobile app ships in a week or drags on for a quarter. All four are default here.

Short path from key to live traffic

Sandbox keys are self-service. A named integration engineer reviews your first pull request before you flip to live. Most merchants across the EU, UK, Australia, Canada and New Zealand ship the online payment gateway integration in a working week.
One integration surface across every rail

Cards, device wallets, local payment methods and instant rails share the same charge object. You do not need multiple payment gateway integrations to reach the methods your shoppers actually use.
PCI scope stays low from day one

Hosted fields render card inputs inside our PCI DSS Level 1 environment. Your web or mobile app never handles raw PAN, so your annual return stays at merchant SAQ A.
Sandbox parity that catches production bugs

The sandbox replays production-shaped decline codes, 3-D Secure 2 challenges and dispute events. Integration tests that pass on sandbox pass on live traffic — not a best-effort mock.

Four integration paths, one platform

The choice is not between different products — it is between different surfaces on the same gateway. Pick the surface that matches how much of the checkout you want to own.

Hosted

Hosted checkout page

Redirect to a hosted page for the fastest payment gateway integration in website. Card entry, 3-D Secure 2 and receipts render inside our PCI scope. Your storefront never handles a card number.
- Hosted UI
- Fastest go-live
- SAQ A
Drop-in

Hosted fields and drop-in components

Embed our card, expiry and CVC inputs into your own checkout. You control the surrounding page, we serve the sensitive iframes. Merchant scope stays at SAQ A.
- Custom checkout
- SAQ A
- Server-to-server capture
Server

Server-to-server API

Full REST control for merchants running their own PCI-scoped stack. Idempotent create requests, signed webhooks and versioned endpoints — the API contract every fintech engineer expects.
- Full API
- Versioned
- Idempotent
Mobile

Mobile SDKs

Native iOS and Android SDKs handle hosted fields, Apple Pay, Google Pay and 3-D Secure 2 challenge rendering. The mobile payment gateway integration produces the same charge object as the web integration.
- iOS SDK
- Android SDK
- Apple Pay
- Google Pay

Prebuilt checkout surfaces on hosted checkout products. The engineering-foundation view on payment infrastructure.

Integration coverage per stack

The REST API is HTTP-first, so any language works. Below is the shortlist of stacks teams ask about most — plus the maintained plugins that shortcut the work entirely.

Payment gateway integration coverage per stack, framework and language
Stack	Integration path	Notes
Web (React, Vue, plain HTML)	Hosted fields JS + REST API	Any modern front end
WordPress / WooCommerce	Signed plugin	Checkout, refunds, subscriptions
Magento 2 / Adobe Commerce	Signed module	Same feature set as plugin
PrestaShop	Signed module	Checkout, refunds
Shopware 6	Signed plugin	Checkout, refunds, subscriptions
PHP / Laravel / Symfony	REST API + code samples	Payment gateway integration in PHP
Java / Spring	REST API + code samples	Payment gateway integration in Java
Node.js / .NET / Python	REST API + code samples	Any HTTP-capable runtime
iOS	Native SDK	Swift + Objective-C
Android	Native SDK	Payment gateway integration in Android

Full plugin and connector directory on the integrations page. Code samples and SDK references in the developer docs.

The payment gateway integration process, step by step

Six stages from first call to live traffic. Each stage has a named owner on both sides and each stage change is visible in the dashboard.

Scope

A named integration engineer reviews your business model, storefront stack and the payment methods you plan to accept before onboarding starts.
Sandbox

Sandbox keys, webhook signing secret and dashboard invites issued. Engineering starts against the API while boarding continues in parallel.
Wire the client

Drop in hosted fields, the hosted checkout page, the mobile SDK or a maintained storefront plugin — pick the path that fits your stack.
Wire the server

Verify the signed webhook, use idempotency keys on every write and pin the API version header. Sample code in PHP, Java, Node and Python.
Test

Replay approvals, declines, 3-D Secure 2 flows, refunds and dispute events against sandbox — the payloads match production byte for byte.
Go live

First PR review by the integration engineer, live keys enabled, real-time analytics show approval quality from the first hour of live traffic.

Integration features that shorten the timeline

Every capability below is on the standard integration. No premium tier for the sandbox, the mobile SDK or the versioned changelog — the primitives are the platform.

Versioned REST endpoint

One version header per request. Breaking changes ship on the next major and never quietly on the one you built against.
Idempotency keys

Retry-safe writes across create, capture, refund and payout. A network blip never becomes a double charge.
Signed webhooks

HMAC-signed, replay-protected events for every state change. Delivery retries on an exponential schedule for up to 72 hours.
Hosted fields

Card inputs served inside our PCI environment. Merchant SAQ A stays intact whichever front-end framework you use.
Gateway vault + network tokens

Store credentials once and re-use them across renewals and one-clicks. Automatic PAN refresh after reissue.
3-D Secure 2.2 helpers

Client libraries handle challenge redirection, exemption logic and result binding — you post the charge, we handle the 3-D Secure choreography.
Storefront plugins

Maintained plugins for WooCommerce, Magento 2, PrestaShop and Shopware cover checkout, refunds, capture, webhooks and recurring billing out of the box.
Mobile SDKs

iOS and Android SDKs share the web integration's charge model. One event catalogue across web and native.

The same charge, three server-side stacks

One versioned REST endpoint creates a charge. The examples below show the identical request from PHP, Java and a curl call. Any HTTP-capable runtime works the same way — the request shape is the contract, not the client library.

// PHP
$ch = curl_init('https://api.bazpay.com/v1/charges');
curl_setopt_array($ch, [
  CURLOPT_HTTPHEADER => [
    'Authorization: Bearer sk_live_...',
    'Idempotency-Key: 8f1c-2b3a-9e4d',
    'BazPay-Version: 2026-04-01',
    'Content-Type: application/json',
  ],
  CURLOPT_POSTFIELDS => json_encode([
    'amount' => 4990, 'currency' => 'EUR',
    'payment_method' => 'card', 'capture' => 'auto',
    'three_d_secure' => 'required_if_needed',
    'metadata' => ['order_id' => 'ORD-10842'],
  ]),
  CURLOPT_RETURNTRANSFER => true,
]);
$response = json_decode(curl_exec($ch), true);

// Java
var body = """
  {"amount":4990,"currency":"EUR","payment_method":"card",
   "capture":"auto","three_d_secure":"required_if_needed",
   "metadata":{"order_id":"ORD-10842"}}
""";
var req = HttpRequest.newBuilder()
  .uri(URI.create("https://api.bazpay.com/v1/charges"))
  .header("Authorization", "Bearer sk_live_...")
  .header("Idempotency-Key", "8f1c-2b3a-9e4d")
  .header("BazPay-Version", "2026-04-01")
  .header("Content-Type", "application/json")
  .POST(HttpRequest.BodyPublishers.ofString(body))
  .build();

Same request, curl

The universal form. Use it in a smoke test, a CI check or your first exploration before pulling in a client library.

curl https://api.bazpay.com/v1/charges \
  -H "Authorization: Bearer sk_live_..." \
  -H "Idempotency-Key: 8f1c-2b3a-9e4d" \
  -H "BazPay-Version: 2026-04-01" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 4990,
    "currency": "EUR",
    "payment_method": "card",
    "capture": "auto",
    "three_d_secure": "required_if_needed",
    "metadata": {"order_id": "ORD-10842"}
  }'

iOS, Android, Node, Python and .NET samples live in the developer docs. Full schema in the API reference.

BazPay integration vs a generic gateway integration

Two credible ways to buy a gateway integration. One ships engineering primitives your team already recognises; the other leaves you to bridge the gap. Below is where the time actually goes.

BazPay integration compared with a generic payment gateway integration
Dimension	BazPay integration	Generic gateway integration
Time to sandbox	Self-serve, same session	Sales call before keys
Integration surface	One canonical charge object across rails	Separate contract per method
PCI scope	Merchant SAQ A via hosted fields	Full PCI if PAN passes servers
PR review	Named integration engineer	Ticket queue
Sandbox parity	Production-shaped decline and 3DS replay	Best-effort mocks
API versioning	Version header + deprecation window	Silent breaking changes
Storefront plugins	Maintained for four regional stacks	Community only

Rate structure on the pricing page. The service envelope around the integration on gateway services.

Who runs BazPay's payment gateway integration services

The integration path adapts to the team, not the other way round. Four common shapes below describe where BazPay integrations already land.

New merchants in the EU, UK, Australia, Canada and New Zealand

Merchants launching a regional storefront pick hosted checkout or a signed plugin — the fastest payment gateway integration process for the four common commerce stacks.
Custom-stack e-commerce

DTC brands on bespoke stacks integrate hosted fields plus the REST API. Code samples in PHP, Java, Node and Python cover most back-end teams.
Mobile-first commerce

Native iOS and Android checkout via the mobile SDK. Payment gateway integration in mobile application produces the same charge object as web, so the fulfilment handler is shared.
Migrating from another gateway

Merchants moving from a reseller PSP or another regional acquirer plan the vault migration and webhook cutover with the same named integration engineer.

Out of scope for BazPay: adult, gambling, gaming, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection and MLM. BazPay is not a merchant of record and not a marketplace of third-party PSPs.

Security and change safety for a long-lived integration

Integrations rot when their underlying platform breaks silently. BazPay runs inside a PCI DSS Level 1 environment with hosted fields, gateway vaulting and versioned API releases with a documented deprecation window — the integration you ship stays valid.

PCI DSS Level 1: Annual assessment on the acquiring and gateway environment
Merchant SAQ A: Hosted fields and gateway vault keep card data out of your stack
Authentication: 3-D Secure 2.2 with automatic exemption logic on every card charge
GDPR: In-region data residency; DPA on request
Change management: Versioned API, published deprecation policy, audit-logged dashboard actions

Questions engineering teams ask about the integration

What is the payment gateway integration process on BazPay?

Six stages: scoping call with an integration engineer, sandbox provisioning, client-side wiring (hosted checkout, hosted fields, mobile SDK or storefront plugin), server-side wiring (idempotency, webhook verification, version pinning), sandbox test suite and live-key enablement. Boarding runs in parallel with integration engineering, so live traffic depends on when you are ready, not on when we finish paperwork.

How does payment gateway integration in website work if I use React or Vue?

Load the hosted fields script from our CDN, mount the card, expiry and CVC iframes inside your React or Vue checkout, and post the resulting payment intent to your back end. The iframes render inside our PCI environment, so your React or Vue app never touches raw PAN, and your annual return stays at SAQ A.

Is payment gateway integration in PHP or Java supported?

Yes. The REST API is HTTP-first, so any server-side runtime works — PHP (including Laravel and Symfony), Java (including Spring), Node.js, Python, Go and .NET have code samples in the developer docs. Maintained WooCommerce, Magento 2, PrestaShop and Shopware plugins cover the common PHP storefronts directly.

Do you support payment gateway integration in mobile applications on iOS and Android?

Yes. Native iOS and Android SDKs render hosted fields, Apple Pay, Google Pay and 3-D Secure 2 challenges. The mobile SDK produces the same canonical charge object as the web integration and shares the signed webhook stream, so the fulfilment code you already run for web works for the mobile app without changes.

I need multiple payment gateway integrations — how does BazPay compare?

Most "multiple gateway" plans exist to reach different payment methods on different rails. BazPay handles cards, device wallets, local payment methods and SEPA Instant on one integration against one API, so a single BazPay integration usually replaces two or three stitched vendors. See the payment network and card and APM processing pages for the full method list.

Do you offer gambling payment gateway integration services or gaming payment gateway integration services?

No. BazPay does not board gambling or gaming merchants. Underwriting is scoped to merchants across the EU, UK, Australia, Canada and New Zealand — e-commerce sellers, subscription software firms, professional-services businesses and digital publishers. Merchants operating regulated gambling or real-money gaming should look for a specialised processor.

How is the integration reviewed before we go live?

Your named integration engineer reviews the first pull request (or the equivalent PR in your review tool) and validates the sandbox test run. Live keys are enabled once the review confirms webhook verification, idempotency and 3-D Secure 2 handling are in place. There is no separate certification track — the review is the checkpoint.

What if I need help mid-integration — is a payment gateway integration company involved?

No third party — the integration engineer, the developer docs, sandbox and shared support channel come with the platform. You are welcome to work with a payment gateway integration company or system integrator alongside BazPay, but nothing in the API surface requires one.

How is the integration migrated between processors without downtime?

Vault imports and network-token portability are supported under scheme-approved migration processes, subject to the receiving bank's consent letters. Old and new webhook streams typically run in parallel during cutover so subscription renewals and instant-fulfilment flows never miss a beat.

Start the payment gateway integration today

Open a sandbox and post your first charge in the same session. Prefer a walkthrough first? A payments specialist can map your stack, your rails and your migration path with you. See also payment processors, payments solutions and merchant acquiring.

Talk with sales Read the developer docs

Payment gateway integration for websites and mobile apps.

Short path from key to live traffic

One integration surface across every rail

PCI scope stays low from day one

Sandbox parity that catches production bugs

Hosted checkout page

Hosted fields and drop-in components

Server-to-server API

Mobile SDKs

Scope

Sandbox

Wire the client

Wire the server

Test

Go live

Versioned REST endpoint

Idempotency keys

Signed webhooks

Hosted fields

Gateway vault + network tokens

3-D Secure 2.2 helpers

Storefront plugins

Mobile SDKs

The same charge, three server-side stacks

New merchants in the EU, UK, Australia, Canada and New Zealand

Custom-stack e-commerce

Mobile-first commerce

Migrating from another gateway

Security and change safety for a long-lived integration

Start the payment gateway integration today