One API for GCash, Maya, QR Ph, cards and BancNet direct debit. Signed endpoints, idempotent charges, encrypted credentials — the parts that make payments painful are already solved.
Reach wallet users, scanner apps, cardholders and ATM cardholders with a single integration.
Because it does. The failure modes that cost gateways real money are handled in the platform, not left to your integration.
HMAC-SHA256 over the raw body binds your idempotency key, timestamp and payload together. Tampering, replays and key swaps are rejected — not processed.
Network retries, double-clicks and webhook redeliveries reuse the key and return the original result. A duplicate is a response, not a second charge.
Money is stored as whole centavos, never floating point. Every movement writes balanced debit/credit pairs — an unbalanced transaction cannot be recorded.
Customer PII and all secrets are AES-256-GCM encrypted at rest with rotatable keys. API keys are pepper-hashed — a database dump yields nothing.
Cards are collected on the provider's hosted page with 3-D Secure. Card numbers never enter our systems, keeping integration at SAQ-A scope.
Signed outbound events with exponential retries and no redirect-following. Deliveries persist before they're attempted, so a crash loses nothing.
POST /v1/payments with amount in centavos and the method. You get a nextAction — a redirect URL for wallets and cards, or a QR payload for QR Ph.
They approve in their wallet, scan the QR, or enter a card on the hosted page. The provider confirms asynchronously to Paygate.
Paygate settles the intent, writes the ledger, and signs a payment.succeeded webhook. Fulfil when you receive it — never on a page redirect.
Every layer assumes the outside is hostile and the inside can be breached.
One create call. One hosted hand-off. One webhook. Done.
# 1. Create a payment POST /v1/payments # signed + idempotent {"amount": 488500, # ₱4,885.00 in centavos "currency": "PHP", "method": "QRPH"} → 201 {"nextAction": {"type": "qr", "payload": "00020101..."}} # render it # 2. Your customer scans it. Paygate settles. # 3. You receive a signed webhook: {"type": "payment.succeeded", "data": {"status": "SUCCEEDED"}} # now fulfil
Interactive docs and the machine-readable spec — point a generator at /openapi.json.
Wallets, QR and cards all look identical to you: nextAction is a redirect or a QR.
A deterministic mock rail lets you exercise success, decline and pending states on sk_test_ keys — no provider accounts needed.
Signed deliveries with retries until you acknowledge, plus delivery attempts surfaced in the portal.
Tell us about your business. Our team reviews every application and typically responds within two business days.