Opayo payment integration for ecommerce

Opayo sits behind checkout as a payment processor. When a shopper submits card details or a saved token, checkout sends the payment intent to Opayo. Opayo validates the card against the card network and returns a result (authorised, declined, or challenge required). Checkout then creates an order based on the authorisation. Opayo does not create or manage the order itself.

Authorisation reserves funds on the shopper's card but does not transfer money to your bank account. Capture is the instruction to Opayo to actually take the money. You can auth at checkout and capture later (e.g. when the order ships), or you can auth and capture immediately. Your Opayo account configuration and API flow determine the timing.

Saved card tokens are stored in Opayo, not in your commerce platform. If you keep your Opayo merchant account, tokens are still valid on the new platform as long as you sync the token references to customers in the new platform. You do not need to re-tokenise all cards.

To refund a transaction, commerce sends a refund request to Opayo using the original transaction reference. Opayo credits the shopper's card immediately at the processor level, but the shopper's bank takes 3-5 working days to post the credit to their account. Opayo notifies you when the refund is processed.

If Opayo is unreachable, checkout cannot process the payment. You have two options: (1) fail the transaction and show the customer an error, or (2) queue the payment request and retry asynchronously once Opayo is back. Option 2 requires that you handle incomplete orders and retries carefully so you do not oversell or charge twice.

Opayo is PCI Level 1 certified. By using Opayo's hosted payment field or token API, you avoid storing raw card data on your servers. Your checkout form collects card details and sends them directly to Opayo, which returns a token. You store the token, not the card. This approach greatly reduces your PCI burden.

3D Secure adds an extra authentication step where the shopper verifies themselves with their bank. Opayo can be configured to require 3DS for all transactions, or only for high-risk or high-value ones. When 3DS is needed, Opayo returns a challenge URL or data. Checkout displays the challenge to the shopper. Once they authenticate, Opayo confirms the outcome.

Opayo generates a daily settlement file listing all captured transactions, refunds, chargebacks and fees. You import this file into your ERP and match transactions against invoices. Each transaction has an Opayo reference that links back to the original order. Finance reconciles the settled amount against your bank account.

A chargeback occurs when a shopper disputes a transaction with their bank. Opayo notifies you of the chargeback and removes the amount from your next settlement. You have time to gather evidence (order confirmation, delivery proof, customer communication) and submit a dispute response through Opayo. If your evidence is strong, the chargeback can be reversed.

Yes. Opayo supports payments in many currencies. You configure which currencies your merchant account accepts. At checkout, you specify the currency for each transaction. Opayo converts the amount if needed and processes the payment. Your ERP must track which currency each transaction was authorised and settled in.

You store a tokenised card when the shopper first pays. For future charges (e.g. monthly subscription renewal), you send the token to Opayo instead of asking the shopper to re-enter their card. Opayo charges the token. If the charge fails (e.g. card expired), Opayo returns a decline. You must handle the decline and notify the shopper to update their card.

Monitor payment authorisation success rate, capture success rate, refund success rate, and settlement reconciliation variance. Alert if success rates drop below your baseline (e.g. more than 2-3% payment failures), if settlement files arrive late, or if reconciliation discrepancies appear. Log all API calls and responses for debugging payment failures.

The authorisation stays pending in Opayo until it expires (usually 30 days). If it is not captured by then, the hold is released and no money is taken. However, the shopper may see a pending charge on their statement. To avoid this, you should either capture quickly after order creation, or have a job that reviews pending authorisations and captures them before expiry, or explicitly expires them.

No. Opayo stores the card token, expiry and cardholder name, but never the CVV. If you need to capture CVV for a later refund or dispute, you must ask the shopper to provide it again or ask them to authenticate with their bank (3DS). Do not store CVV yourself.