Gateway-Specific Requirements

​

3GDirectPay

• CompanyID and ServiceType credentials are required; the Company Token also selects sandbox vs production.
• isDigital sets the service description sent to the processor.
• No real-time Void. An authorisation can only be cancelled before its Payment Time Limit lapses, and a paid transaction cannot be cancelled. Refunds are testable in production only.
• 3DS on this gateway works via an external MPI - 3GDirectPay (DPO) does not accept 3DS data submitted through Orchestra’s own 3DS flow.
• A generic Reason Code 999 decline gives no further detail on Orchestra’s side - this needs to be raised with 3GDirectPay/DPO directly.

​

Adyen

{
  "paymentGatewayAccount": {
    "paymentGatewayName": "Adyen",
    "credentials": [
      { "Key": "ApiKey", "Value": "..." },
      { "Key": "MerchantAccount", "Value": "..." },
      { "Key": "ShopperInteraction", "Value": "Ecommerce" }
    ]
  }
}

• Adyen is the Payment API integration. See AdyenCheckout for the separate Checkout API integration - they use different credentials and are not interchangeable.

​

Adyen Checkout (AdyenCheckout)

• This is Adyen’s Checkout API integration, distinct from the plain Adyen (Payment API) entry above. Check which one your Adyen credentials belong to.
• Gateway tokenization is available on this integration only, not on Adyen. The Adyen stored payment method ID is returned as the gateway token. The token is created under the shopper reference in your ShopperReference credential, or your MerchantAccount value when you do not send one. Use the same shopper reference when you charge with that token at Adyen.
• ShopperInteraction (default Ecommerce) and RecurringProcessingModel (default CardOnFile) may be supplied as credentials.
• For gateway tokenization, the zero-amount request uses the currency of the amount you send. A Currency credential, if set, overrides it. With neither, EUR is used.

​

Airwallex

• OrderDesc sets the statement descriptor.
• The CustomerID credential is required in order to tokenize.

​

AMEX

{
  "myRef": "ORDER123456"
}

• There is no fixed length for myRef. Only the first 6 characters are used as the trace number, and those 6 characters cannot be lowercase.
• No Charge or Refund operations are supported. Use PreAuth + Capture, and use Void to reverse a transaction.

​

Authorize.net

{
  "paymentGatewayAccount": {
    "paymentGatewayName": "AuthorizeNet",
    "credentials": [
      { "Key": "ApiLoginId", "Value": "..." },
      { "Key": "TransactionKey", "Value": "..." },
      { "Key": "ECCenabled", "Value": "true" }
    ]
  }
}

​

Azul

• A client certificate must be configured on the account.

​

BAC

• TerminalID, Username and Password credentials are required (Live also needs the service API URL).
• CVV is mandatory (manual-entry mode). Integration documentation is private; you must be a BAC Credomatic bank customer.

​

Better

• Credentials: APIKey, PartnerId, MerchantId.
• OrderDesc may be supplied.
• Tokenisation only happens within a Charge/PreAuth. There is no stand-alone Tokenize call.

​

BML

• Only Charge and Void operations are supported.
• For 3DS via digital wallets (Apple Pay/Google Pay), an ECI value is required; Orchestra uses dummy merchant values for eMPI 3DS unless real merchant data has been configured - set this up if you’re seeing “ECI value must be provided” or similar rejections.
• PP-C-004 typically indicates a wrong key, wrong host, or a UAT/production credential mismatch, not a card-level decline.
• If Apple Pay works but a specific brand (e.g. AMEX) is rejected, check whether your merchant account is enabled for that brand with the processor - this is a merchant-enablement issue, not a Orchestra or wallet issue.

​

Bold

• OrderDesc sets the payment description.
• No PreAuth / Capture.
• Partial refund is not supported.

​

Borgun

• The myRef parameter must be exactly 12 characters, using A-Z and 0-9 only.

​

BorgunBGateway

• The myRef parameter must be exactly 12 characters, using A-Z and 0-9 only.

​

CardNet

• Only Charge and Void operations are supported.
• Partial refund is not supported.

​

Cardstream

{
  "orderDesc": "Premium subscription - 12 months"
}

• Set TransactionType to MOTO to allow charging without CVV.
• Refund is only possible after the transaction has settled (ACCEPTED).

​

Caterpay

{
  "orderDesc": "Premium subscription - 12 months"
}

• CardStream white-label. Set TransactionType to MOTO to allow charging without CVV.

​

CCV

• The Language credential must be one of eng, nld, deu, fra.
• OrderDesc may be supplied; the AuthExemption credential is also available.

​

Checkout

• Credentials: SecretKey, PublicKey, URLPrefix (acquirer URL prefix); ProcessingChannelId is optional.
• OrderDesc may be supplied.

​

Credorax

• OrderDesc is sent only when longer than 4 characters.
• VoidType may be AuthVoid (default), CaptureVoid or SaleVoid.

​

CyberSource

• Orchestra integrates 2 separate CyberSource variants: CyberSource and CyberSource3DS, with different credentials - check List All Payment Gateways if unsure which applies to your account.
• For Mastercard 3DS, the relevant fields are ECI, ucafAuthenticationData, and ucafCollectionIndicator=2.

​

Datatrans

• Tokens are created only via a dedicated Tokenize call, not within a Charge/PreAuth.
• Datatrans expects a more complete 3DS field set than the default, plus Type=Plain - an incomplete 3DS payload results in rejections that look unrelated to 3DS.
• An INVALID_ALIAS error usually means your Datatrans merchant profile is configured for alias/card-on-file only, not raw-card direct charges - contact Datatrans to enable raw-card processing (and external-MPI 3DS, if needed).

​

DECTA

• Refund is only possible within 30 days of payment; partial refund is not supported.

​

DLocal

• SplitAccounts (marketplace split payments) and NotificationURL may be supplied.

​

Eigen

• APPID, EPAKey and NodeID credentials are required.

​

Elavon

{
  "paymentGatewayAccount": {
    "paymentGatewayName": "Elavon",
    "credentials": [
      { "Key": "MerchantId", "Value": "..." },
      { "Key": "Password", "Value": "..." },
      { "Key": "RebatePWD", "Value": "your_rebate_password" }
    ]
  }
}

• Refund is allowed up to 115% of the original; the original currency must match.

​

ElavonConvergePay

• Do not send a currency. The account is single-currency and supplying a currency value will error.

​

ElavonFusebox

• Credentials: ClientId, ClientSecret, Chain, Location, Terminal (OAuth).
• OrderDesc may be supplied.

​

ePDQ

• The merchant IP must be whitelisted in the ePDQ back-office.
• A sale cannot be voided (refund only), and partial refund is not supported.

​

eWAY

• PayerDetails.ClientIPAddress is required.

​

FatZebra

• Username and APIToken credentials are required.
• Payer details are required on Charge/PreAuth. PayerDetails.ClientIPAddress is sent as the customer IP.

​

First Data (FirstData)

• Refund re-sends the full card details.

​

First Data IPG (FirstDataIPG)

1. Client certificate authentication - Upload your certificate through the Orchestra Portal and name it in certificateName.
2. Client IP address (recommended) - Provide it in payerDetails.clientIPAddress. Orchestra sends it to First Data; if it is missing, 127.0.0.1 is sent instead.

{
  "payerDetails": {
    "clientIPAddress": "192.168.1.1"
  },
  "certificateName": "your-uploaded-certificate-name"
}

• This gateway is not the same as Payzee.
• Fiserv’s server-to-server IPG sandbox endpoint is test.ipg-online.com/ipgapi/services. Orchestra does not provide Fiserv sandbox credentials; request them directly from Fiserv.

​

Gateline

1. Client certificate authentication - Upload via portal
2. Client IP address - Required in PayerDetails

{
  "payerDetails": {
    "clientIPAddress": "192.168.1.1"
  },
  "certificateName": "your-uploaded-certificate-name"
}

• The myRef parameter must be numeric only.

​

GlobalPayments

• Credentials (AppID/AppKey/XGPVersion) are merchant-specific - obtain them from your GlobalPayments merchant setup, not a generic sandbox.
• A 101 invalid amount error from the 3DS/MPI block usually means servertransid/ds_trans_id was reused across requests - each authentication attempt needs its own value. The relevant MPI fields are authentication_value, eci, message_version (2.2.0), and ds_trans_id.
• Partial capture and partial refund support vary by account configuration - confirm with GlobalPayments if you rely on either.

​

Global Payments WebPay

{
  "myRef": "123456789012345"
}

• PayerDetails.Email is mandatory.
• GPWebPay needs its own orderNumber to identify the payment on the bank statement - this is separate from myRef, which serves a different purpose and isn’t shown on the statement.
• The optional authResponseCode field surfaces the real decline reason from GPWebPay, but it’s part of GPWebPay’s signed response - including it affects response signature validation, so it isn’t included by default.
• Requires a per-integrator AES key + IV issued by GPWebPay for each environment (test and production have separate keys), plus a MerchantNumber (your MID).

​

Heartland

1. myRef must be numeric only (no letters or special characters)
2. Integration certification required - Orchestra’s integration is certified

{
  "myRef": "123456789"
}

• Set CertiMode to 1 for certification mode, which then also requires the DeveloperID and VersionNumber credentials.

​

Ingenico

• SkipAuthentication may be supplied.
• Refund is only possible after the transaction is COMPLETED.

​

Kortapay

{
  "paymentGatewayAccount": {
    "paymentGatewayName": "KortaPay",
    "credentials": [
      { "Key": "Username", "Value": "..." },
      { "Key": "Password", "Value": "..." },
      { "Key": "SiteID", "Value": "..." },
      { "Key": "TerminalID", "Value": "..." },
      { "Key": "MerchantNumber", "Value": "..." },
      { "Key": "OriginalAmount", "Value": "125.50" }
    ]
  }
}

• myRef has a maximum of 15 characters.
• Partial refund is not supported.

​

LianLianPay

• Product credentials are required: ProductID, ProductName, ProductSKU, ProductURL, ProductShippingProvider (plus optional shipping fields).
• No PreAuth / Capture.

​

MaksuPay

• Credentials: MerchantId, PrivateKey, PublicKeyHash.
• OrderDesc may be supplied.

​

Monek

• Credentials MerchantID and APIKey are required. Merchants who used Monek’s older Secure Hosting platform need this new pair from Monek; the old credentials alone are not enough.
• Void works on the same day only. After that, use Refund.

​

Moneris

• The ProcessingCountry credential is required.
• Void is only possible after completion.

​

MyPOS

• Credentials include PrivateKey and PublicKey (used to sign requests and encrypt card / CVV data), plus SID, WalletNumber, KeyIndex, IPCVersion, Language.
• isDigital sets the cart item description.

​

NETS

• A Sale can only be refunded (not voided); only an Auth can be voided.

​

Network.ae

• APIKey and OutletReference credentials are required.

​

NEXI

• OrderDesc may be supplied.
• Apple Pay payments with American Express cards are not accepted through NEXI. Visa and Mastercard work.
• PreAuth settles instead of just holding if Nexi-specific fields (parametriAggiuntivi/TCONTAB) aren’t set correctly for a hold - verify these before relying on PreAuth-then-Capture behavior.
• With generateToken: true, the token NEXI returns is passed back to you in the gatewayToken response field. See Gateway Tokenization.
• Nexi’s MOTO endpoint is used only when the card is submitted without a 3DS result - if you’re sending 3DS data, a different endpoint path applies internally.

​

NMI

• Authenticate with either an APIKey credential, or Username + Password. NMI is deprecating username/password authentication in favor of APIKey by December 2026 - migrate before then.
• NMI rejects near-duplicate transactions within a short time window (Error 300) even with a unique myRef - NMI’s own duplicate-transaction control keys off other fields, not myRef (which NMI receives as orderid).

​

NomuPay

• The Region credential is required; AuthorizationType and CaptureType credentials are also available.
• Tokenisation is not available in Turkey.

​

OpenPay

• MerchantID and PrivateKey credentials are required.
• The cardholder device IP is forwarded as X-Forwarded-For (required by Mexican anti-fraud rules).
• OrderDesc sets the payment description.
• Void is processed as a Refund and works cleanly with MXN.

​

PayArc

• OrderDesc must be under 25 characters; address fields must be at least 5 characters.

​

PayDollar

• Credentials: MerchantId, LoginId, Password, SecureHashSecretKey (AsiaPay secure-hash signing).

​

PayGate

• The payer country must be a 3-letter code.

​

PayPalPaymentsPro

• Credentials: Username, Password, Vendor, Partner (PayPal Payflow Pro).
• The billing country must be a 3-digit numeric country code; cardholder IP is forwarded when present.
• For a full refund omit the amount. Distinct from PayPalWebsitePaymentsPro.
• Orchestra integrates 3 separate PayPal variants: PayPal, PayPalPaymentsPro (this entry, Payflow Pro), and PayPalWebsitePaymentsPro (NVP DoDirectPayment) below. Check List All Payment Gateways if unsure which your credentials match. Credentials for all three come from the PayPal Developer Dashboard.

​

PayPalWebsitePaymentsPro

• Credentials: Username, Password, Signature, Version (PayPal NVP DoDirectPayment).
• US / UK / CA only. For a full refund omit the amount. Distinct from PayPalPaymentsPro (Payflow Pro).

​

Payplug

• OrderDesc may be supplied.
• Do not send a currency. The account is single-currency.
• A GatewayResultCode of 1003 (“received HASH doesn’t match”) is Payplug/Dalenys’s own error code, unrelated to Orchestra’s -1003 - it almost always means a credentials problem. The Dalenys test environment is secure-test.dalenys.com.

​

Paystack

• Capture / Void are not supported.
• In a Payments Library card session, Paystack opens its own authentication page for the payer.

​

Paystation

• OrderDesc may be supplied.
• No Void.

​

PayULatam

• OrderDesc may be supplied.
• The Country credential drives behaviour.
• In Panama only Charge is supported (no PreAuth/Capture).

​

PayWay

• Australia and AUD only. Visa, Mastercard, American Express and JCB.
• Credentials: SecretAPIKey, PublishableAPIKey, MerchantID. ClassicUsername and ClassicPassword are reserved for 3D Secure and are not used today.
• 3D Secure is not currently available on this gateway. Tokens carrying 3DS data are charged without it.

​

PayZen

• The CaptureDelayDays credential sets the capture delay at authorization (0 = same-night); there is no separate Capture call.
• A Void must be issued before the capture date arrives - once PayZen’s nightly batch has captured the funds, use Refund instead.
• Refunds need roughly a 24-hour backoff after the nightly capture batch runs before they’ll succeed; an immediate refund attempt fails with PSP_101.

​

Payzone

{
  "orderDesc": "Room 204, 2 nights",
  "payerDetails": { "email": "guest@example.com", "countryCode": "MA" },
  "paymentGatewayAccount": {
    "paymentGatewayName": "Payzone",
    "credentials": [
      { "Key": "CallerName", "Value": "..." },
      { "Key": "CallerPassword", "Value": "..." },
      { "Key": "MerchantName", "Value": "..." },
      { "Key": "CustomerID", "Value": "guest-10482" }
    ]
  }
}

• Capture, Void and Refund do not use CustomerID. No authorization code is returned.
• Sandbox/test transactions require CVV 000 exactly.
• Result codes: 199 = declined for a request-level issue (for example missing CVV or invalid countryCode). 521 or 524 with gateway status CHARGE_PENDING = Payzone requires 3D Secure, and the result is reported as Rejected. Either send 3D Secure data with the charge, or ask Payzone to accept charges without 3D Secure on your merchant account (no liability shift).

​

PCIBookingEU

• The Region credential is required.

​

PCIBookingUSA

• OrderDesc, CaptureSeq + CaptureTotal (partial capture) may be supplied.
• SendReceipt (Yes/No) may be supplied.

​

Pelecard

1. Gateway tokenization is not supported. To charge a stored card, use an Orchestra token (see Tokenization).
2. Instalments and credit payments cannot be requested. Every transaction is sent as a single payment.

• A PreAuth cannot be voided online. A VoidPreAuth request is rejected by the gateway, and the hold is left to expire.

​

Pesopay

1. myRef must be unique on every submission
2. Void operations must use the GatewayReference from the PreAuth response, not Capture

{
  "myRef": "UNIQUE-REF-20240115-001"
}

​

PomeloPay

• Only Charge and Void operations are supported.
• For 3DS via digital wallets (Apple Pay/Google Pay), an ECI value is required; Orchestra uses dummy merchant values for eMPI 3DS unless real merchant data has been configured - set this up if you’re seeing “ECI value must be provided” or similar rejections.
• PP-C-004 typically indicates a wrong key, wrong host, or a UAT/production credential mismatch, not a card-level decline.
• If Apple Pay works but a specific brand (e.g. AMEX) is rejected, check whether your merchant account is enabled for that brand with the processor - this is a merchant-enablement issue, not a Orchestra or wallet issue.

​

PXP

• MerchantID, StoreID, UserID and Password credentials are required.
• VoidType may be reversalSale or reversalPreAuthorization (defaults to pre-auth reversal).
• An amount is required on every operation, including Void / Capture / Refund.

​

Quickpay

• The APIKey credential is required.
• Card tokenisation is rejected for EEA cards.

​

RapydCardPayments

• AccessKey and SecretKey credentials (HMAC request signing) are required.
• The card brand is currently sent as Visa regardless of the actual card. Confirm with support before use.

​

Ryft

• OrderDesc sets the statement descriptor.

​

SaferPay

• OrderDesc (payer note) may be supplied.
• Merchant IP allow-listing is required.
• Send PayerDetails with the cardholder’s IPv4 address in ClientIPAddress on every Charge and PreAuth.

​

SagePay

• US / CA / GB only.

​

Shift4

​

Credentials

​

Obtaining the Access Token

​

Shift4Clone

• The myRef parameter must be numeric (10 digits).
• Credentials and Access Token setup are the same as Shift4 above, with additional 3DS passthrough fields.

​

SiamPay

• An Auth cannot be voided (charges only); Refund is only possible after settlement (~1 day).

​

SLIM CD (SlimCD)

• Void requires the amount, and it must match the original transaction amount. Void is only possible before the batch closes (usually end of day); after that, use Refund.
• Reusing the same merchant reference with the same amount is rejected as a duplicate. Send a unique reference for each transaction.

​

Straumur

• Virtual cards (VCC) should have 3DS skipped for the charge - Straumur’s own guidance is that 3DS is not expected/required on a VCC transaction.
• A RedirectShopper status means the operation requires the cardholder to complete an additional step (e.g. 3DS challenge) before it can complete.
• Tokens stored without a CVV are rejected by Straumur if it requires CVV for the operation - make sure the token has a CVV before charging.

​

Stripe

• Void is performed as a full Refund.
• On-platform 3DS via Orchestra is not the same as Stripe’s own direct 3DS - if you need Stripe’s native 3DS flow, that’s a separate integration path; check with Stripe which applies to your setup.
• Stripe requires you to explicitly enable “processing raw cardholder data from a PCI-DSS-compliant third party” on your Stripe account before charges will succeed - without this, requests can fail with confusing errors unrelated to your actual request (e.g. “Sequence contains more than one element”). Ask Stripe support to enable it, referencing Orchestra’s AoC if needed.
• Only APIKey is required. Other fields are optional: HotelID/SiteName/ReservationID (metadata only), ConnectedAccount/ConnectionType/ApplicationFeeAmount (Stripe Connect only), SetupFutureUsage, ExtendedAuth, PaymentIntentID, AutomaticRedirect.
• Leave IdempotencyKey blank - Orchestra auto-generates one. Omitting it (rather than reusing a stale value) is what avoids intermittent “account not eligible for requested card features”-style failures that clear on retry.

​

StripeConnect

• ConnectedAccount, ApplicationFeeAmount (platform fee), and HotelID/SiteName/ReservationID (metadata) may be supplied.
• Void is performed as a full Refund.

​

Stripe (PaymentIntent)

​

3D Secure Support

​

Subscriptions

{
  "paymentGatewayAccount": {
    "paymentGatewayName": "StripePaymentIntent",
    "credentials": [
      { "Key": "SecretKey", "Value": "sk_live_..." },
      { "Key": "SetupFutureUsage", "Value": "off_session" }
    ]
  }
}

• ApplicationFeeAmount lets your platform take an application fee on direct charges. Provide it in the credentials together with ConnectedAccount, and include a ConnectionType of standardconnect or connect.
• A captured charge cannot be voided.

​

StripeStandardConnect

• OrderDesc may be supplied.
• ConnectedAccount and ApplicationFeeAmount may be supplied.

​

SumUp

• APIKey must be a SumUp secret API key. A public key (starting sup_pk_) is rejected with 401 Unauthorized.
• Charge only. PreAuth and Capture are not supported.
• 3D Secure is performed by SumUp through its own redirect flow. 3DS data from an external MPI is not accepted, and a Charge with a 3DS-enrolled card outside the redirect flow is rejected with 3DS_REQUIRED.
• Void is only possible before card details have been submitted to the checkout. Once a payment has been attempted, use Refund.

​

TotalProcessing

• Authorization Code is only returned on live captures (not on PreAuth or test).

​

Trust

• Tokenize is performed as an ACCOUNTCHECK (zero-amount) request.
• TokenCurrency sets the tokenize currency (default GBP).

​

Tyro

• MerchantID and APIPassword credentials (Mastercard MPGS platform) are required.
• myRef is used as the order id, transaction id and reference. It must be unique and URL-safe per transaction.

​

USAePay

• Credentials: SourceKey, PIN, EndpointID.
• OrderDesc may be supplied.

​

Valitor

• ServiceType may be ONLINEPAYMENT, TELEPHONEPAYMENT or MAILORDER (MOTO modes suppress CVV).
• Refunds are not allowed on debit cards.

​

ValitorPay

• Tokenisation creates a virtual card.
• MCCCode (a travel/hotel MCC switches to PreAuthorization), TransactionType, and DefaultClearingDays/DefaultClearingAction may be supplied.

​

Verifone

• PayerDetails first and last name are required.
• TokenScope may be supplied (for tokenize).
• Missing cardholder name data (FirstName/LastName in PayerDetails) is a common cause of otherwise-unexplained declines on this gateway.

​

VersioPay

• The Crypto credential (account secret) is required.

​

Viva

• GroupId can be set on Tokenize.
• Separate token-client credentials (TokenClientId, TokenClientSecret) are used for tokenize / refund / void.

​

Windcave

• EnableAddBillCard may be supplied.

​

Wirecard

{
  "orderDesc": "Premium subscription - 12 months"
}

• The field is optional for Charge and PreAuth operations.

​

Worldline TravelHub

• OrderDesc may be supplied.
• When you charge an Apple Pay token, keep ThreeDS set to true (the default).

​

Worldpay

1. IsDigital parameter - Required, defaults to true
2. Integration certification required - Orchestra’s integration is certified

{
  "isDigital": true
}

​

WorldPayOnline

• The ServiceKey credential is used as the authorization header.
• isDigital overwrites the order description (the gateway has no free-text descriptor); amounts are in the smallest currency unit.

​

WorldPayVantiv

• Only the first 6 characters of myRef are used (ticket number).

​

WorldPayWPG

• OrderDesc may be supplied.
• Whitelist Orchestra’s outbound IPs in your Worldpay account - a missing whitelist entry commonly surfaces as a generic TemporaryFailure/“Object reference not set” error rather than an obvious auth failure. See Outbound IP Addresses.
• Worldpay’s older BG350 connection is being decommissioned by Worldpay - if your account still uses it, a migration to a current connection type is needed; contact support to check which rail your account uses.

​

WSPay

• One account does either Charge or PreAuth→Capture, not both.

​

Xendit

• The Country credential (2-letter, default PH) may be supplied.

​

Zeamster

{
  "orderDesc": "Premium subscription - 12 months"
}

​

Zoop

{
  "paymentGatewayAccount": {
    "paymentGatewayName": "Zoop",
    "credentials": [
      { "Key": "ZPK", "Value": "..." },
      { "Key": "MarketplaceID", "Value": "..." },
      { "Key": "SellerID", "Value": "..." },
      { "Key": "NoOfInstallments", "Value": "6" }
    ]
  }
}

​

ZoozPaymentsOS

• AppID, PublicKey, PrivateKey and APIVersion credentials are required.
• Amounts are in the smallest currency unit.

​

Related