> For the complete documentation index, see [llms.txt](https://docs.saferpay.com/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.saferpay.com/home/interfaces/backoffice/secure-paygate.md).
# Secure PayGate / Payment Links
Create individual payment links and send them by mail
The Saferpay Secure PayGate is a collection of tools that enable easy e-commerce transaction processing, even without a webshop, directly from the [Saferpay Backoffice](/home/interfaces/backoffice.md).
The transactions are securely handled via the [Saferpay Payment Page](/home/integration-guide/licences-and-interfaces/payment-page.md), which offers all payment methods and fraud prevention features like 3D Secure.
This way, the Secure PayGate can cover many use cases, not just for small merchants, such as replacing Mail Phone Order or even POS transactions with a more secure means of processing payments and payment methods that were previously unavailable in these scenarios.
## Requirements for Secure PayGate
Secure PayGate requires the following:
* A Saferpay account and contract
* A [corresponding license](/home/master/licensing.md) which includes Secure PayGate for single-use, multi-use links, or [Saferpay OnSite](/home/interfaces/saferpay-onsite.md).
* A [Secure PayGate terminal ID](/home/master/common-saferpay-terms-glossary.md#secure-paygate-terminal), included in the corresponding license (see above).
## Secure PayGate components
As previously mentioned, the Secure PayGate includes a set of tools aimed at different use cases:
* [Single-use payment links](#create-a-new-link-offer): These cover the classic use case for the Secure PayGate, offering the possibility to send payment links/offers to a single customer, enabling them to pay on their device with the payment method of their choice.\
These can be used instead of your classic Mail Phone Order transaction or for charging open invoices for services, such as in a hotel, without the need for a hardware terminal.\
All the customer needs is their own device (e.g. a phone or tablet).
* [Management API](/home/interfaces/management-api.md#secure-paygate-links): The Management API can be used to create single-use payment links automatically via API, enabling the merchant to automate their process and use their mailing system, which offers more flexibility in terms of the look and feel of their offer emails.
* [Multi-use payment links](#multiuse-links-qr-codes): While single-use payment links offer a great deal of flexibility and a means of tracking individual orders, there are scenarios where it is not feasible to constantly create a new offer/link for each new order.\
This is where the multi-use links come into play. You can create them once, and then as many people as you want can pay via these links. This is useful in cases where there simply is no technical infrastructure at hand to handle incoming orders or where it would simply be too much of an effort to implement such a system.\
These could be simple donation flyers or small, unattended roadside offerings for homemade goods.\
The customer simply scans a QR code, is redirected to our payment site, enters their payment details, and pays with their favourite payment method. Easy and secure.
* [Saferpay OnSite](/home/interfaces/saferpay-onsite.md): This solution is aimed at small POS scenarios. One example could be an artist selling art during a convention or a small food stand at a farmers' market. It offers a simple web application that runs on the merchant's device, where they can easily create new invoices and payment links/QR codes. The customer simply scans the created code with their device and is then redirected to the Saferpay Payment Page, where they can choose their desired payment method.\
Saferpay OnSite will track the payment status and give real-time feedback to the merchant.\
No need for a card terminal; you just need your phone or a tablet, and then you can accept secure online payments.
## Storage and tracking of Secure PayGate payments
The following measures are necessary to ensure you are prepared for any objections (chargebacks) and can provide the acquirer with the necessary documentation on request:
* Send a copy of all e-mails to the "BCC address" and store them, together with the attached GTCs, for at least 24 months.
* Obtain the details of the cardholder's payment, including the MPI log, from the Saferpay Backoffice.
## Accessing Secure PayGate
In the navigation bar, click on "Secure PayGate" or one of the sub-items to access the area concerned. You can then navigate within Secure PayGate via the same items in the menu on the left.
## Settings
To activate Secure PayGate, you must specify the basic settings the first time you access the application.
First, enter the email address where you want payment notifications sent.
By activating the “**Default Authorization Type**” function, you can define whether Secure PayGate transactions should be captured automatically or pre-authorized. Please bear in mind that the authorization must be captured if it is not set to be captured automatically.
Available options are:
* **Normal (final) authorization:** Only the authorization takes place. [The capture](/home/integration-guide/licences-and-interfaces/capture-and-daily-closing.md) must be made manually.
* **Pre-authorization:** Only the authorization takes place. [The capture](/home/integration-guide/licences-and-interfaces/capture-and-daily-closing.md) must be made manually. Use this option when it's likely that the amount will change before the capture takes place or if you want to capture much later (up to 30 days).
{% hint style="info" %}
Note that the amount cannot be increased, only lowered.
Pre-authorizations are only supported with Visa, V PAY, Mastercard, and Maestro.
{% endhint %}
* **Normal (final) authorization with automatic capturing:** The transaction [is captured](/home/integration-guide/licences-and-interfaces/capture-and-daily-closing.md) automatically after successful authorization. **This option is the default.**
**Default Condition** controls the default 3-D Secure behavior.
It offers 3 options:
* **No condition (Default):** 3D Secure will be attempted, if activated, but the result has no impact on the outcome of the transaction.
* **Only with liability shift:** If 3-D Secure does not report the liability shift to be true, the transaction will not be attempted. The payment will fail.
* **Only with liability shift and 3-D Secure challenge:** This option is like the previous one, with the addition of a 3-D Secure challenge flow. This flow will force the user through a full authentication before the transaction is attempted.
{% hint style="warning" %}
We recommend using the latter option for high amounts in order to enable a higher level of security.
{% endhint %}
{% hint style="warning" %}
It is very important to know that this setting only affects the transaction **before** it is attempted.
It is possible for the liability shift to be rejected with the transaction. While these are rare cases, this setting will not prevent these transactions from being overall successful.
Should liability shift be of the utmost importance to you, we do not recommend setting the **Default Authorization Type** option to **Automatic capture**, so you can cancel a transaction if needed.
{% endhint %}
### Linking your own website
Then specify whether you want to retain the preset payment processing messages for cardholders or link clients to your own website.
Optionally, the web address for the confirmation page following a successful, unsuccessful, or aborted payment can contain the placeholder `{{{PAYMENTPAGETOKEN}}}`. After the payment process has ended, the placeholder is replaced by the Payment Page Token. Here is an example:
* Address of the confirmation page once the payment has reached an outcome:\
`https://www.yoursaferpayshop.com/spgreturn/success/{{{PAYMENTPAGETOKEN}}}`
After the Payment Page Token has been received via a confirmation page or via the URL for notification, the JSON API method **PaymentPage/Assert** can be used to obtain the details of the transaction. The transaction can be assigned via the offer's reference number. The reference number is located in the `Transaction.OrderId` field of the **PaymentPage/Assert** response.
A server-to-server message is delivered via the URL for notification for each payment.
{% hint style="warning" %}
The “URL for Notification” from the “Payment Page Configuration” settings in the Saferpay Backoffice has no effect on Secure PayGate.
{% endhint %}
The next step is to enter your "Sender email address", "BCC address", and "Reply to address" for Secure PayGate.
You can choose any prefix for your "Sender email address". This address is what the recipient sees when they receive your message.
The "BCC address" ensures that all emails sent through Secure PayGate are stored in your own email system. We recommend choosing an impersonal address for the "BCC address". This ensures you comply with the contractual conditions regarding the storage of transaction documents.
The "Reply to address" is where you receive notifications about non-deliverable emails or error messages (recipient not available, email could not be delivered).
The last step is to attach your General Terms and Conditions (T\&C) so that they are sent to clients as an attachment to each email. This ensures you comply with the payment acquiring company's requirement to make cardholders aware of your T\&C.
Choose the language and then attach the T\&C in that language. At least one set of T\&C must be attached.
{% hint style="info" %}
Each time an email is sent, the T\&C documents – if available – will be attached automatically in the language chosen for the email.
{% endhint %}
Once you have saved your settings, you will be ready to use the Secure PayGate service.
## Overview
Click on "Overview" to access the Secure PayGate Single-Use Payment Links overview. The overview lists all the single-use links you have created together with their status.
### Search
If the overview contains a large number of offers, you can use **Search** and its filter functions to help find a previously created offer. Just click on the input field and adjust your filters below.
#### Offer status
An offer can have one of three to four statuses, displayed in the **State** column of the overview:
**Open offers:** Open offers are where the buyer has not yet made their payment.
**Paid offers:** These offers have been paid by the customer.
**Expired offers:** Expired offers are where the buyer has allowed the payment deadline to lapse.
**Sent offers:** While this is more of a sub-status, an offer that has been sent through the Saferpay Backoffice will be indicated by the date on which it was sent in the Delivery column. Other links, for example those sent via our [Management API](/home/interfaces/management-api.md#secure-paygate-links), will be indicated by the **`No email`** tag.
## Create a new Link/Offer
Create an individual offer for processing a specific transaction.
By clicking Create, you'll open the creation dialog right away to create an individual offer. Clicking the arrow will allow you to either [use a template](#templates) or [upload a batch file](#batch-upload) to create multiple links.
### Creating the offer
**(1) Sales description:** Here you can leave a short description that will be displayed inside the [transaction details](/home/interfaces/backoffice/transactions/journal-details.md) once a transaction is made, and on the Saferpay Payment Page for your customer. This text can be anything, such as an order number or a short description of what the customer is buying.
**(2) Reference number:** Also sometimes called [OrderId](/home/master/common-saferpay-terms-glossary.md#orderid), the reference number is your internal order number. It will be displayed in the transaction journal, where you can also search for this number, in the transaction details, and in your reconciliation files. The latter makes this ID very important for accounting purposes, as it helps you keep track of your transaction.
{% hint style="warning" %}
We highly recommend using it.
Furthermore, you should make sure that the ID is unique for each order, as redundant IDs can cause issues, especially if you have automated accounting systems that rely on unique reference numbers.
{% endhint %}
**(3) Terminal:** A terminal is where all your payment methods and their attributes (currencies, account number, and other features, such as 3D Secure) are connected. Usually, only one Secure PayGate terminal is activated, but you can have more if you wish. This can be useful if you want to split offers between countries and/or allocate revenue to other bank accounts, as there can usually only be one bank account per payment method and only one type of payment method per terminal.
You will be presented with a full list of terminals. However, you may also search for a given terminal and its description/name, which you can set under [Settings => Terminals](/home/interfaces/backoffice/settings.md#payment-means-terminals), making it easier to keep track of your terminals.
**(5) Amount & (6) Currency:** Here you can set the desired amount and currency (decimals are supported).
{% hint style="warning" %}
Note that the currency dropdown will only display the currencies that are activated on that terminal.
Furthermore, while a payment method may be generally available, it will not be displayed to your customer if the selected currency is not activated. You can check this under [Settings => Terminals](/home/interfaces/backoffice/settings.md#payment-means-terminals).
{% endhint %}
{% hint style="info" %}
You can type inside the currency dropdown to filter for specific currencies.
{% endhint %}
**(8) Payment Page configuration:** Select a [Payment Page configuration](/home/interfaces/backoffice/settings/payment-page-configuration.md), if available, allowing you to adjust the Payment Page look and feel to your corporate design.
**(9) Language:** Select the desired language Saferpay will display its contents in.
**(10) Customer email configuration:** This option controls whether the customer needs to enter their email. It has three options:
* **Required field:** The customer must enter their email on the Saferpay Payment Page in order to progress.
* **Optional field:** The customer can enter their email, but does not have to.
* **Hidden:** No email field is displayed and the customer thus cannot enter it.
\
**(12) Merchant Notification:** Saferpay will send a confirmation email to the provided merchant email address(es) once a payment has been made.
**(13) Expiry date:** Choose when the offer/link expires, either by setting a custom date and time or selecting one of the provided options.
**(14) Maximum number of attempts:** This option controls the maximum number of payment attempts the payer has. This can be useful to prevent fraud or other attacks, such as PAN enumeration attacks.\
You can choose between:
* Unlimited attempts
* One attempt
* Three attempts
* Five attempts - **This is the default.**
* 10 attempts
**(15) Payment link:** This is your payment link, which the customer will be redirected to. You can either use the Saferpay-provided mailing option or copy the link so you can insert it into your own email application.
**(16) QR code:** Your payment link as a QR code. This code will also be sent via email.
#### Customer Address
Next, you can enter the customer address and/or select the "Customer is allowed to change address data" option so the customer may enter it themselves or edit it should your inputs be faulty.
If no address is needed, you can also deactivate this area for no address to be captured.
#### Sending the offer
The Secure PayGate also offers the possibility to send the payment link via email. If you activate this option, you can adjust the subject, message text, salutation/signature, and, of course, the recipient of the sent email.
By default, the Secure PayGate will use the email address(es) you have configured in the [Settings Tab](/home/interfaces/backoffice/secure-paygate.md#settings). However, you can change these addresses by clicking **Change**.
If you want to include additional documents, such as your AGB or a receipt, you can select and add one or more attachments by clicking **Browse** under **Attachments**. The total size of the email may not exceed 5 MB. Permitted file types are `.doc`, `.docx`, `.xls`, `.xlsx`, `.pdf`, `.jpg`, `.gif`, and `.png`. Please note that an attachment is only required if the email is being sent via the Backoffice. If you are using your local email application, the attachments from the Backoffice are not included for technical reasons.
Furthermore, you can also configure a reminder email that is sent at a fixed time before the offer expires to remind the payer that it is still open if not already paid.
{% hint style="warning" %}
The reminder email is based on the offer's expiration date ([see above](#creating-the-offer)), not on the time when the offer was sent. So this reminder will be sent an amount of time before the set expiration date is reached.
So please also make sure that you set the reminder at a time that is in the future, based on the expiration date. Otherwise, you'll receive an error preventing the offer from being sent or saved.
{% endhint %}
#### Customize the payer confirmation mail
Furthermore, you can create an automated payment confirmation in the case of successful payment. As soon as the payment has gone through, your customer will receive a payment confirmation by email. The email is then delivered to the **recipient** address to which the offer has been sent.
Once all the details have been entered, the email can be sent. If you click "**Send offer**", Secure PayGate sends the offer along with the attachment to the cardholder in the chosen language.
Using the “**Save**” button, the displayed payment link is copied to the clipboard, e.g. to embed it in an electronic invoice.
Alongside the **Save** and **Save & Send** options at the bottom of the page, you can also send the offer via an email program installed on your PC by clicking the "**Open in email program**" button.
{% hint style="info" %}
Note that Save & Send, as well as Save & Open, will only be displayed if you activated the **Send link to payer via email** switch, as shown above.
{% endhint %}
Once the offer has been sent, it is displayed in the overview and can be used again.
## Batch upload
Saferpay also offers the option to create multiple single-use links via a batch file upload. To do so, please navigate to the order [Overview](#overview) and click **Create new links by file**.
### Upload
You will be redirected to the upload page, where you can select your desired Secure PayGate Terminal and upload your file.
#### File specification
If you need a file specification, you can find it on this page, as mentioned there, or see this screenshot.
## Templates
### Creating a template
If a quote is used frequently, it makes sense to create a template. To do this, click on **Templates** and then on **Insert new template**.
You'll find that template creation looks and works in the same way as normal order creation, only missing the address section, as it is always different.
Give your template a name, select the terminal, fill in all fields contained in the form, and click **Create**. Once saved, the template is shown in the list of all templates.
The template can then be used to create an offer.
### Creating an offer using a template
To create an offer using a template, first switch to the [overview](/home/interfaces/backoffice/secure-paygate.md#overview). Click **Create new link**.
The familiar selection screen will appear, with your templates being listed at the bottom. Using the text field above, you can search through your templates.
## Adapting the email design
You can add a design and logo to your offer and confirmation emails, which are sent to the customer. To do this, switch to the menu item “Settings” → “[Payment Page Configuration](/home/interfaces/backoffice/settings/payment-page-configuration.md)” in the Saferpay Backoffice and create a new configuration. Then mark the configuration as “Default” in the overview to use this design for your offer emails.
## Payment by the buyer
Once the offer has been sent, the buyer receives an email with a payment link:
When they click “Pay Now”, the client's browser is connected directly to the Saferpay Payment Page via a secure connection. From there, the client can select a payment method supported by you and make the payment. Once the payment has been processed successfully, both you and the client receive a payment confirmation via email. The payment appears in the Saferpay Backoffice journal as a reservation.
## Secure PayGate API
Secure PayGate links and orders can also be created via our Management API, which allows an application to automatically create and handle Secure PayGate offers. Please refer to our [Management API](/home/interfaces/management-api.md#secure-paygate-offers) to learn more.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.saferpay.com/home/interfaces/backoffice/secure-paygate.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
