Opayo (formerly Sage Pay)

Setting up Opayo

Please visit opayo.co.uk for more information and to register.

Here's what you need to do to start testing your integration and to go live with Opayo:

1. 1

   Get your admin password for Opayo - You will be given a link to click on to get your password

2. 2

   Login to Opayo (Test) using the admin password supplied: https://test.sagepay.com/MySagePay/

3. 3

   Create a new user in your Opayo account (within Settings > Users) - this will enable you to perform tests and will be valid only for testing purposes (you'll need to do this again when you go Live). For the “Account Privileges” select “View All Transactions”, and for “My Sage Pay Access” select “Search”.

4. 4

   Add the following IP addresses to your “Valid IPs” section (or a comparably named section):
   * IP: 54.243.60.3
   * IP: 54.152.220.165
   Subnet Mask: 255.255.255.255

5. 5

   Complete your integration with Opayo in the Foxy administration, on the “payment” section. Make sure the payment servers are set to “Test Servers” at this stage.

6. 6

   Enable the “Let customers pay with a Credit or Debit Card” option and select “Opayo” in the dropdown and enter your vendor name in the “vendor” field, and the username and password for the new user you created in Opayo (and not your “root” user) in the matching fields in the Foxy payment settings.

7. 7

   Your 3D Secure setting should match what's set in your Opayo account settings

8. 8

   Process a test transaction through your website using the Opayo test card numbers https://www.opayo.co.uk/support/12/36/test-card-details-for-your-test-transactions

9. 9

   Perform a refund - before you can go Live you must refund one of your successful test transactions https://www.opayo.co.uk/support/test-your-integration/refund-your-test-transaction

Going Live

As soon as your testing is complete and your acquiring bank has confirmed your Merchant ID, your account will automatically be set to Live. Opayo will let you know when this has happened. You can then complete the final steps of integration:

1. 1

   Login to Opayo (Live) using your original admin password. You'll only be able to access the Live portal once your Merchant ID is confirmed. https://live.sagepay.com/MySagePay

2. 2

   If you haven't already, add the following IP addresses to your “Valid IP Address” section (or a comparably named section):
   * IP: 54.243.60.3
   * IP: 54.152.220.165
   Subnet Mask: 255.255.255.255

3. 3

   As when testing, create a user in the Opayo administration in the “Settings” > “Users” section. For the “Account Privileges” select “View All Transactions”, and for “My Sage Pay Access” select “Search”.

4. 4

   In the Foxy administration, on the “payments” section, switch the payment servers to “Live Servers” and re-enter your details again, including your vendor and the username and password for the new user you created in your account (again, not your root user).

5. 5

   Test your Live account - perform a transaction via your website using a real card.

6. 6

   Perform a refund as you did in your test… you are now ready to start accepting payments from your customers - congratulations!

Additional Configuration For Subscriptions & Customer-Not-Present Transactions

If you plan to process transactions where the customer will not be present, such as with subscriptions or with a store administrator using the Unified Order Entry password to checkout as the customer, then there is an additional configuration step that you need to complete.

Specifically, to allow for these customer-not-present transactions to complete without requiring 3D Secure, Foxy needs to process the purchase as what's called an MIT (Merchant Initiated Transaction). Opayo requires that we complete that using a Continuous Authority account type - which signifies that the transaction is being processed with an existing authority from the customer.

Continuous Authority isn't always automatically enabled for your merchant account and your Opayo account though, so you will need to confirm with both your merchant account provider (usually your bank) and with Opayo support if your account has “Continuous Authority” enabled. If not, they will be able to assist you with getting it enabled with your merchant account provider and Opayo.

Failing to ensure your merchant and gateway accounts have Continuous Authority enabled will result in any transactions not initiated by the customer to error.

Special Consideration: Prepayment Webhook

For Opayo, the prepayment webhook will be sent to your endpoint twice; once before the 3D Secure challenge, and once before the payment is attempted. You can identify the different triggers using the Foxy-Webhook-Event header values of validation/3ds and validation/payment.

You can decline the transaction from either trigger, but there are optional additional values you can return with a true response to alter how the 3D Secure challenge occurs with Opayo. Specifically you can pass an additional top level object in the response that looks like this:

"overrides": {
    "opayo": {
        "apply_3dsecure": 2,
        "threeds_exemption_indicator": "05"
    }
}

The values for apply_3dsecure and threeds_exemption_indicator match up to the Apply3DSecure and ThreeDSExemptionIndicator attributes as described within Opayo's documentation here. Consult with Opayo support for the best values to use for your specific requirements.

Troubleshooting & Interpreting Response Codes

Contact Opayo for info.

Important Notes and Caveats