Platform developers that need a payment solution can integrate with Allpay.
This model is suitable for platforms that want to add Allpay as a payment method and be listed in the Allpay integrations catalog. It does not include partner payouts and is based on mutual promotion (other partnership models).
This integration will become available to Allpay customers as a ready-made way to connect your platform.
Requirements
To have your platform added to the Allpay integrations catalog, the following conditions must be met:
- You do not participate in the Allpay partner or referral program.
This integration is based on mutual promotion. - The integration must be approved by Allpay in advance.
Your platform must be in demand in Israel and already used by real customers. - You are ready to support the integration on an ongoing basis.
You are responsible for maintaining the integration and providing customer support on your side.
How to start
To approve the integration of your platform, contact Allpay support and briefly describe:
- your platform;
- who your customers are;
- how exactly you want to use Allpay payments;
- which integration method you plan to use: manual or automated;
- whether there are already customers who need this integration.
Integration methods
Integration with Allpay can be implemented in two ways:
- manual integration;
- automated integration.
Manual integration
With manual integration, you implement the connection on your side and publish instructions for customers on your website.
The customer will need to:
- Open the integrations section in the Allpay dashboard.
- Create API keys.
- Copy the keys and paste them into the settings of your platform.
Technical involvement from Allpay is usually not required for this type of integration. After implementation, send us information about your platform and a link to the Allpay connection instructions on your website.
After review and approval, your platform will be added to the Allpay integrations catalog.
Automated integration
Automated integration allows the platform to be connected without manually copying API keys. The user clicks the connection button in the Allpay dashboard, confirms the connection on your platform side, and the API keys are transferred automatically.
Before implementation, Allpay provides your platform with:
<span class="u-richtext-element">partner_id</span> — the individual integration ID;
<span class="u-richtext-element">secret_key</span> — the secret key for signing and verifying server requests.
<span class="u-richtext-counter">1</span>Redirect from Allpay to your platform page
The user opens the <span class="u-richtext-element">Settings</span> → <span class="u-richtext-element">Integrations</span> → <span class="u-richtext-element">Your platform</span> section in the Allpay dashboard and clicks the connection button.
Allpay generates a one-time token for linking the accounts and redirects the user to the confirmation page on your platform side, for example:
https://your-platform.com/connect?token=TOKEN
Where <span class="u-richtext-element">TOKEN</span> is the one-time token created by Allpay.
The standard token lifetime is 1 hour.
<span class="u-richtext-counter">2</span>Confirmation on your platform side
On your side, the user confirms the connection under their account.
After confirmation, your platform redirects the user back to the universal Allpay endpoint:
https://allpay.to/services/endpoints/exchange.php?act=connect&partner_id=PARTNER_ID&token=TOKEN&external_uid=USER_ID&display_name=DISPLAY_NAME
Where:
<span class="u-richtext-element">act=connect</span> — the integration connection action;
<span class="u-richtext-element">partner_id</span> — the individual integration ID;
<span class="u-richtext-element">token</span> — the one-time token created by Allpay;
<span class="u-richtext-element">external_uid</span> — the internal user ID on your platform.
<span class="u-richtext-element">display_name</span> — a human-readable name of the account being connected (e.g. login, name or subdomain on your platform). This is the value shown in the Allpay dashboard's integrations list — pass something the user will recognize themselves, not an internal technical identifier. The value must be URL-encoded, max 255 characters.
<span class="u-richtext-counter">3</span>Creating and sending API keys to your platform
After verifying the token, Allpay links the Allpay user with the user on your platform, creates or finds the API keys <span class="u-richtext-element">api_login</span> and <span class="u-richtext-element">api_key</span>, and then sends them to your endpoint.
Example endpoint on your platform side:
POST https://your-platform.com/allpay/partner/exchange
Request body:
{
"external_uid": "USER_ID",
"api_login": "API_LOGIN",
"api_key": "API_KEY",
"sign": "SIGNATURE"
}
Where:
<span class="u-richtext-element">external_uid</span> — the user ID on your platform;
<span class="u-richtext-element">api_login</span> — the Allpay user's API login;
<span class="u-richtext-element">api_key</span> — the Allpay user's API key;
<span class="u-richtext-element">sign</span> — the request signature.
<span class="u-richtext-counter">4</span>Request signature
The server request with the API keys is signed using HMAC SHA-256.
Signature format:
hash_hmac('sha256', $payload_json, $secret_key);
Where:
<span class="u-richtext-element">payload_json</span> — the JSON request body;
<span class="u-richtext-element">secret_key</span> — the individual secret key.
<span class="u-richtext-counter">5</span>Response from your platform
After successfully receiving and saving the keys, your platform must return a successful response, for example:
{
"ok": true
}
After this, Allpay marks the integration as active.
Disconnecting the integration
If the user disconnects the integration on your platform side, you must delete the saved API keys on your side.
In addition, your platform must send a POST request to Allpay to disconnect the integration:
POST https://allpay.to/services/endpoints/exchange.php?act=disconnect&partner_id=PARTNER_ID
Request body:
{
"external_uid": "USER_ID",
"sign": "SIGNATURE"
}
Where:
<span class="u-richtext-element">external_uid</span> — the user ID on your platform;
<span class="u-richtext-element">sign</span> — the request signature.
The disconnect request is also signed using <span class="u-richtext-element">secret_key</span>.
If the user disconnects the integration from the Allpay dashboard, Allpay can send a disconnect notification to your platform endpoint. To receive this notification, provide an endpoint on your side.
Connecting via a link from your dashboard
You can start the connection on your side instead of from the Allpay dashboard. You generate a signed link and show it to the user (a button in your dashboard):
https://allpay.to/services/endpoints/exchange.php?partner_id=<your id>&show=start&external_uid=<…>&state=<…>&display_name=<…>&expires=<unix>&return_url=<…>&sign=<…>
The user confirms the connection in Allpay, Allpay sends the keys to your <span class="u-richtext-element">keys_url</span>, and then the user is returned to your <span class="u-richtext-element">return_url</span>.
Link parameters
<span class="u-richtext-element">partner_id</span> — your partner ID;
<span class="u-richtext-element">show</span> — always <span class="u-richtext-element">start</span>, not included in the signature;
<span class="u-richtext-element">external_uid</span> — the ID of what is being connected on your platform (for example, the branch ID), up to 255 characters. A link with a longer value is rejected;
<span class="u-richtext-element">state</span> — any value you generate for this link, up to 500 characters (a longer value is truncated). Store it on your side together with the user who requested the link and the <span class="u-richtext-element">external_uid</span>. We return it in the request to <span class="u-richtext-element">keys_url</span> and in the redirect to <span class="u-richtext-element">return_url</span>;
<span class="u-richtext-element">display_name</span> — what is being connected (for example, the branch name), up to 255 characters. Optional, but we recommend passing it: it is shown to the user on the Allpay confirmation screen and in the Allpay dashboard;
<span class="u-richtext-element">expires</span> — Unix time until which the link is valid. No later than 30 days from now; a link with a later date is rejected;
<span class="u-richtext-element">return_url</span> — required; the address to send the user back to after a successful connection. <span class="u-richtext-element">https</span> only, and the host must match the host of your <span class="u-richtext-element">connect_url</span> exactly (subdomains do not match). A link without a valid <span class="u-richtext-element">return_url</span> is rejected;
<span class="u-richtext-element">sign</span> — the link signature. Calculated with the same rules as for API requests. All parameters except <span class="u-richtext-element">show</span> and <span class="u-richtext-element">sign</span> are signed.
What happens next
1. The user opens the link and signs in to Allpay, if not signed in yet.
2. On the Allpay screen, the user sees which Allpay company is being connected and what exactly (<span class="u-richtext-element">display_name</span>), and clicks "Connect".
3. Allpay sends the keys to your <span class="u-richtext-element">keys_url</span> as a JSON POST request. The <span class="u-richtext-element">X-Allpay-Signature</span> header contains the HMAC-SHA256 of the raw request body, signed with your <span class="u-richtext-element">partner_secret</span>. Request body fields:
<span class="u-richtext-element">external_uid</span> — from the link;
<span class="u-richtext-element">state</span> — from the link (if you passed it);
<span class="u-richtext-element">api_login</span>, <span class="u-richtext-element">api_key</span> — the API keys;
<span class="u-richtext-element">token</span> — an internal value, you can ignore it.
Your server must respond with exactly HTTP 200.
4. The user is returned to <span class="u-richtext-element">return_url</span> with <span class="u-richtext-element">state</span> added (if you passed it): <span class="u-richtext-element">return_url?state=<state></span>, or <span class="u-richtext-element">&state=<state></span> if <span class="u-richtext-element">return_url</span> already has a query string.
If your <span class="u-richtext-element">keys_url</span> does not respond with HTTP 200, the connection is not made, the user sees an error in Allpay, and the same link can be opened again.
Verify the user on your side
The link is not tied to a specific Allpay company: whoever opens it and signs in to Allpay can confirm it. The keys arrive at your <span class="u-richtext-element">keys_url</span> before the user returns to you, so do not activate them right away:
- when the keys arrive, find the link by <span class="u-richtext-element">state</span> and check that <span class="u-richtext-element">external_uid</span> matches;
- on <span class="u-richtext-element">return_url</span>, require the user to be signed in to your dashboard. If they are not, send them to sign in and then back;
- check that this <span class="u-richtext-element">state</span> was issued to the user who is now signed in, that it has not expired, and that this user has rights to that <span class="u-richtext-element">external_uid</span>. If all checks pass, activate the keys and mark the <span class="u-richtext-element">state</span> as used.
This check does not protect against your own user connecting the wrong Allpay company, for example by signing in under a different company. If this matters to you, show your user which connection was made before activating the keys.
Important
The link is single-use. After a successful connection through it, opening it again is rejected, even after a disconnect. Generate a new link, with a new <span class="u-richtext-element">state</span>, for each connection attempt: links with completely identical parameters (including <span class="u-richtext-element">expires</span>) are treated by Allpay as the same link.
An existing connection is never replaced. The connection is rejected if:
- the Allpay company already has a connection to your platform, including a paused one;
- this <span class="u-richtext-element">external_uid</span> is already connected to any Allpay company.
To connect something else, first disconnect the current connection: in the Allpay dashboard, or with <span class="u-richtext-element">act=disconnect</span> from your side. A paused connection cannot be disconnected with <span class="u-richtext-element">act=disconnect</span>, only in the Allpay dashboard.
Open and confirm the link in the same browser. A new link from your platform opened in the same session replaces the previous one.
Security requirements
For automated integration, the following requirements must be met:
- HTTPS only
All requests between Allpay and your platform must be sent only over HTTPS. - Secure key storage
The received <span class="u-richtext-element">api_login</span> and <span class="u-richtext-element">api_key</span> must be stored securely on your side. - Server request signatures
Server requests must be signed using <span class="u-richtext-element">secret_key</span>.
<span id="info">Information for the integrations catalog</span>
After the technical part is completed and the integration is working, send us the following information to add your platform to the Allpay integrations catalog:
- platform logo in SVG format;
- short platform description of up to 200 characters;
- extended platform description of up to 360 characters;
- technical support contacts for the integration: email and WhatsApp or Telegram;
- information on whether your integration supports installments, recurring payments, and refunds;
- link to the Allpay connection instructions on your website.
Allpay branding guidelines
Use the correct brand spelling:
correct: Allpay;
incorrect: AllPay, All Pay, allpay.
Use the official Allpay logo.