Help Center

Found 100 out of 200

Hosted Fields: how to embed payment form on a website

Hosted Fields allow you to embed card input fields on your website or app, fully adapting them to the system's design. They create a seamless interface experience and eliminate the need to redirect the customer to an external payment page. This improves usability and conversion rates.

The input fields for the card number, expiration date, and CVC are represented as an iFrame. We provide the ability to fully customize their CSS and embed them on your site as a single frame.

Tutorial

Setup

1 In the Settings → Integrations → My sites enable Hosted Fields for the required integration.

2 Click Hosted Fields settings and specify the domains where Hosted Fields will be used. Enter each domain or subdomain on a separate line without “https://”, for example: mysite.com. To allow all subdomains, use the * wildcard, for example: *.mysite.com.

If needed, adjust the CSS styles for the input fields.

3 On your website’s payment page, place an iFrame, assign any custom value to its id parameter, and in the src parameter specify the payment URL (payment_url) returned by Allpay in response to a payment creation request (see Payment request section in the API Reference). Payment URLs can also be generated using the Allpay API Tester.‍

4 Add the following script to the payment page:

1<script src="https://allpay.to/js/allpay-hf.js"></script>
2    <script>
3    let Allpay = new AllpayPayment(
4        {
5            iframeId: 'iframe_id',
6            onSuccess: function() { alert('Payment success'); },
7            onError: function(error_n, error_msg) { alert('Payment error: ' + error_n + ' (' + error_msg + ')'); }
8        }
9    );
10    </script>

‍

In the script, replace the following parameters with your own:

iframeId — the id value of your iFrame.
onSuccess — the handler for successful payment completion (what should happen after successful payment).
onError — the handler for payment errors. For example, you can display the payment error message on the page.

5 To initiate the process, execute the function Allpay.pay(), for example, by assigning it to the "Pay" button:

<button onclick="Allpay.pay();">Pay</button>

Installments

If you enabled the installment option for the customer when creating the payment by passing a value in the inst parameter, a field for selecting the number of payments will automatically appear in the frame.

Quick Pay Buttons

Apple Pay and Bit buttons will not be displayed in preview mode or within the iFrame if they are not activated in the Settings → Modules.

Additionally, these buttons are not displayed in test mode. As well as in live mode for installment or subscription payments.

Apple Pay button

At the moment, the Apple Pay button does not work inside Hosted Fields. We are working on a solution.

To ensure Apple Pay button works correctly, set the attribute allow="payment *" in the iframe tag. Example:

<iframe id="myPaymentIframe" allow="payment *" src="..." >

Keep reading

API

3-D Secure

3DS is a technology that adds a layer of security to online payments by requiring the cardholder to confirm the payment in the bank's app or by entering a one-time SMS code.

It is used to protect against fraudulent transactions, helping businesses reduce risks of chargeback requests.

Connecting and configuring

You can activate 3DS and set the minimum payment amount from which it will be applied in the Settings ➙ Payment modules ➙ 3DS

Frictionless 3DS

Sometimes 3DS authentication takes place in the background and does not require the customer to enter an SMS code or approve the payment in their banking app. During the authentication, the payment page collects technical information about the customer’s device and browser, including the IP address, browser type, language, time zone, screen settings, and other details.

This information is sent to the issuing bank as part of the 3DS process and evaluated together with the card details, payment amount, location, and transaction history. If the bank is confident that the payment is being made by the legitimate cardholder, it authenticates the transaction without requiring any additional action.

To the customer, it looks like a regular payment, but it is still protected by 3DS. If the bank requires further verification, the customer will be asked to confirm the payment using a code or their banking app.

Commission

An additional fee is charged for each payment processed with 3DS, according to the pricing.

The fee is applied even if the payment is unsuccessful — for example, when the cardholder confirms the payment via 3DS, but the bank declines the transaction.

Keep reading

Security

Users and permissions

In the Settings → Team section, you can add users who will have access to your Allpay account.

This feature is currently in development. We will announce its release in our Telegram channel.

Every user in the Allpay system has a unique phone number, email address, and Telegram username. It is not possible to link the same Telegram, email, or phone number to multiple users.

System access is only possible via a verified contact method.

Adding users

Click the "+" button on the "Team" screen and enter the name, job title, and at least one contact method (email, phone, or Telegram) — this will be used to log in to Allpay.

You can update user details at any time by clicking the "Edit" button on their profile card.

Access permissions

Every user has access to all sections except for the "Team" section. Access to the "Team" section must be granted separately. Only the account owner can manage permissions.

More granular permission settings will be introduced later.

Deactivating a user

The "Account active" toggle on a user's profile card immediately revokes their access to your account. You cannot deactivate yourself or the account owner.

Owner details

The owner's name, job title, and contact information can only be updated by contacting Allpay support.

Keep reading

Profile

Subscriptions (recurring billing)

Subscriptions are recurring charges from the customer’s card without the need to re-enter card details. In Hebrew, this is called "Oraat Keva", which literally means "standing instruction".

Activate the subscriptions module in the Settings → Modules section.

Creating a subscription

1 When creating a payment link, clock "More" button to expand settings section and change payment type to “Subscription”.

2 Specify when the subscription should start and end, then click the “Create Link” button.

3 Once the customer subscribes using this link, the subscription will appear on the main screen under the “Subs” (Subscriptions) menu.

Subscription start options

Immediately — the first charge will occur at the moment the subscription is created, and then recur on the same day each month.

‍In N days — the first charge will occur after the specified number of days from the subscription start date, and then continue monthly on that same day.“Date” — the first charge will occur on the selected date. If the selected date is in the past, the subscription cannot be created.

‍Day of month — the first charge will occur on the specified day of the month and repeat monthly on that same day. If the selected day matches the subscription start date, the charge will happen immediately. If the 30th or 31st is selected but the month doesn’t have that date, the charge will occur on the last day of the month (e.g., February 28th).

Date — the first charge will occur on the selected date. If the selected date is in the past, the subscription cannot be created.

Subscription end options

No end date — charges will continue until the subscription is manually canceled in the dashboard.

Date — charges will continue until the selected date. For example, if the end date is set to August 15, 2030, and charges occur on the 16th of each month, the last charge will take place on July 15, 2030, and there will be no charge in August.

After N charges — the subscription will end after the specified number of charges. For example, to create a one-year subscription, set it to 12.

Subscription statuses

Active — charges are being processed successfully.

Completed — all scheduled charges have been successfully processed.

Cancelled — you manually cancelled the subscription charges.

Failed — a charge attempt failed; the system will make up to 6 more retry attempts.

Tracking subscriptions

Charges from subscriptions appear in two sections:

On the main payments screen, alongside other payments;
In the “Subs” section, where you can view the full charge schedule for each subscription.

Notifications about subscription charges are sent by email and Telegram — just like regular payments — if the notification option is enabled in Settings ➙ Notifications.

Cancelling a subscription

In the settings of the desired subscription, select “Cancel subscription”. The customer will receive an email notification that their subscription has been cancelled.

It is not possible to resume charges on a cancelled subscription. The customer will need to re-subscribe.

Failed charge

A scheduled subscription charge may fail if the card has insufficient funds, the credit limit is exceeded, the card has expired, or it has been cancelled.

If a charge fails, the system will automatically make up to 6 more attempts — one per day. If all attempts fail, the subscription will remain in “Failed” status, and the charge history will include a note: “Subscription stopped”.

In the subscription management menu, a “Retry charge” option will appear, allowing you to manually initiate a new charge. Before retrying, we recommend checking with the customer to make sure their card is working properly.

If, when setting up a subscription with the first charge set to “Immediately”, the first charge attempt fails, for example because the card has insufficient funds, the subscription will still be created with the “Failed” status. The system will then automatically schedule a retry attempt.

Subscriptions vs installments

Since installment payments work only with Israeli credit cards, some businesses use subscriptions to collect payments from international customers in multiple parts.

It’s important to understand the difference: With installments you are guaranteed to receive the full amount — even if the customer’s card has insufficient balance on future dates. With subscriptions, each charge is a separate transaction, and if the card has no funds at the time of billing, the charge will fail.

Life hack: a one-time charge on a future date

A subscription can be used not only for recurring payments but also for a one-time charge scheduled for a future date.

When creating the subscription, select “Date” or “In N days” and specify when the first charge should occur. In the subscription end settings, select “After N charges” and set the value to 1.

The customer enters their card details immediately, but the actual charge is made on the selected date or after the specified number of days. Once this single payment has been completed, the subscription ends automatically, so there is no need to cancel it manually.

This is useful for pre-orders, reservations, or deferred payment for services: you secure the customer and their payment method now and process the payment when needed.

All standard subscription mechanisms still apply: the customer receives a notification when the subscription is created, and if the charge fails on the scheduled date, the system makes six additional attempts—one per day.

Keep reading

Payment links

Redirect after payment and success page customization

After a successful payment, you can redirect the customer to an external URL or customize the Allpay success page shown to the customer.

Setup

In the payment link settings, expand More section and enable the “Custom success page” block. There you can select one of the following options:

‍Redirect to URL
‍Immediately after payment, the customer will be redirected to the specified URL.
‍Custom message and button
‍You can set your own heading and text to be displayed to the customer after payment. You can also add a button and specify the URL the customer will be redirected to after clicking it.

API payments

This setting does not apply to payments received via API (from external websites). For those, please refer to the API documentation.

‍

Keep reading

Payment links

Changing business type from esek patur to esek murshe and back

You can change your business type under Settings → Company.

VAT

When changing your status from Osek Patur to Osek Murshe” VAT is added to payments.

For all previously created payment links, 18% VAT will be automatically applied in the “VAT included” mode. The final payment amount will remain unchanged.

This also applies to payments under active subscriptions.

When changing from Osek murshe to Osek patur, VAT will be removed from payment links:

if the link used the “VAT included” mode, the final payment amount will remain unchanged;
if the “VAT added” mode was selected, meaning VAT was added on top of the specified amount, the final payment amount will be reduced by the VAT amount.

Documents

For an “esek murshe,” a tax invoice receipt — heshbonit mas/kabala (חשבונית מס/קבלה) — will be issued instead of a standard receipt (קבלה).

If you use an integration with an external accounting service, such as Morning or EasyCount, remember to update the business type in that service as well. Otherwise, the document for the payment may not be created.

Keep reading

Profile

Payment links

Webhooks

This article explains how to set up webhook notifications for payments.

For payments initiated via the API, Allpay sends a webhook by default in response to the API request. No additional configuration is required.

The setup described below is needed in two cases: if you want to receive webhook notifications for payments created not via the API, but through payment links, or if you need to specify an additional URL for sending webhook notifications as part of your API integration.

What is webhook

Webhook is an automatic event notification sent by the Allpay system to an external URL.

When a payment is successfully completed, Allpay sends a POST request to the specified address. The request contains full payment details, including the buyer's name, the payment description, and the amount.

Developers and integrators use webhooks to:

automatically trigger actions (e.g. activating an order or sending an email to the customer),
synchronize data between systems,
eliminate the need for manual payment status checks.

Even types

Allpay supports webhooks for two events — successful payment and refund.

For subscriptions, the webhook is automatically sent to the specified URL each month after a successful recurring charge.

Where to configure a webhook

A webhook is configured separately for each payment link or API integration:

Payment link — in the settings of that specific link. In this case, the webhook will be sent for every payment made via that link.
API integration — in the settings of a specific integration under the API Integrations section. This allows you to receive webhooks for all payments processed through that integration — for example, from your site on WordPress, or another platform.

Allpay does not have a centralized webhook setting for all payments. This approach gives you flexible control over notifications across different channels.

Webhook request contents

Allpay sends a POST request to the specified URL. The request body is a JSON object containing parameters related to the event.

Example request

POST /c96zv6ri852dvppncccdg6fxkjnpwojg HTTP/2
Host: hook.eu2.make.com
accept: */*
content-type:application/json
content-length: 453

{
    "name": "Consultation",
    "items": [
        {
            "name": "Consultation",
            "price": 150,
            "qty": 2,
            "vat": "1"
        },
        {
            "name": "Clock",
            "price": 50,
            "qty": 1,
            "vat": "1"
        }
    ],
    "amount": "350",
    "status": 1,
    "client_name": "Tanur Mikrogalov",
    "client_email": "test@email.com",
    "client_tehudat": "123456789",
    "client_phone": "+972 58 569 8877",
    "foreign_card": "0",
    "card_mask": "455743******3431",
    "card_brand": "visa",
    "receipt": "",
    "inst": 1,
    "sign": "83f6fab69f7b237ee2db5d9993b84b5fe89ef722af6206a0ffe64480501f3784"
}

‍

Each payment for which a webhook was sent is marked with a corresponding label. By clicking on this label, you can view the full contents of the request.

add_field parameter

If you add ?add_field=any-string to the payment link URL, this parameter will be included in the Webhook request body. Learn more.

Webhook security

Allpay supports two methods for verifying the authenticity of webhook requests:

Verification using the Webhook secret key

This method relies on an HMAC signature based on the SHA256 algorithm.

Signature generation algorithm:

Remove the sign parameter from the request.
Exclude all parameters with empty values.
Sort the remaining keys in alphabetical order.
From the sorted list, take the parameter values and join them into a single string using a colon (:) as a separator.
Append your Webhook secret key to the end of the string, preceded by a colon.
Apply the SHA256 algorithm to the resulting string.
Compare the result with the sign parameter received in the request.

Platforms like Zapier support this type of verification using built-in tools, such as a custom script in Code by Zapier.

Example JavaScript for Zapier

const webhookKey = "YOUR WEBHOOK SECRET KEY";

// Parse the input params from JSON string to an object
const params = JSON.parse(inputData.params || '{}');

// Store the original signature from the request
const requestSignature = params.sign || null;

// Remove the 'sign' parameter before calculating the signature
delete params.sign;

function getApiSignature(params, webhookKey) {
    // Filter out empty values and sort keys alphabetically
    const sortedKeys = Object.keys(params)
        .filter((key) => {
            const value = params[key];
            return value !== null && value !== undefined && String(value).trim() !== '';
        })
        .sort();

    // Collect the values in sorted key order, process nested arrays (like "items")
    const chunks = [];
    sortedKeys.forEach(key => {
        const value = params[key];
        if (Array.isArray(value)) {
            value.forEach(item => {
                if (typeof item === 'object' && item !== null) {
                    Object.keys(item).sort().forEach(subKey => {
                        const val = item[subKey];
                        if (val !== null && val !== undefined && String(val).trim() !== '') {
                            chunks.push(String(val).trim());
                        }
                    });
                }
            });
        } else {
            chunks.push(String(value).trim());
        }
    });

    // Build the string to hash
    const baseString = chunks.join(':') + ':' + webhookKey;

    // Generate SHA256 hash
    const crypto = require('crypto');
    const hash = crypto.createHash('sha256').update(baseString).digest('hex');

    return { baseString, verifiedSignature: hash };
}

// Generate the signature
const result = getApiSignature(params, webhookKey);

// Return the original and calculated values
output = {
    requestSignature: requestSignature,
    baseString: result.baseString,
    verifiedSignature: result.verifiedSignature
};

‍

Demo of webhook verification on Zapier

‍

IP address verification‍

A simpler but less secure method is to check that the request comes from Allpay’s server IP address. You can request the current IP address by contacting our support team.

Webhook delivery and retries

Your server must return an 200 OK response to confirm successful receipt of a webhook. If any other status is returned, or the request fails due to a timeout or network error, Allpay will automatically retry delivery.

Allpay performs up to 10 delivery attempts in total. The first retry is made 1 minute after the initial failure. Subsequent retries are sent with progressively increasing intervals, with the final attempt occurring within 24 hours of the original request.

If all delivery attempts fail, the webhook will be marked as failed and no further retries will be made.

Keep reading

API

Integrations

How to integrate your platform with Allpay

Platform developers that need a payment solution can integrate with Allpay.

This model is suitable for platforms that want to add Allpay as a payment method and be listed in the Allpay integrations catalog. It does not include partner payouts and is based on mutual promotion (other partnership models).

This integration will become available to Allpay customers as a ready-made way to connect your platform.

Requirements

To have your platform added to the Allpay integrations catalog, the following conditions must be met:

You do not participate in the Allpay partner or referral program.
This integration is based on mutual promotion.
The integration must be approved by Allpay in advance.
Your platform must be in demand in Israel and already used by real customers.
You are ready to support the integration on an ongoing basis.
You are responsible for maintaining the integration and providing customer support on your side.

How to start

To approve the integration of your platform, contact Allpay support and briefly describe:

your platform;
who your customers are;
how exactly you want to use Allpay payments;
which integration method you plan to use: manual or automated;
whether there are already customers who need this integration.

Integration methods

Integration with Allpay can be implemented in two ways:

manual integration;
automated integration.

Manual integration

With manual integration, you implement the connection on your side and publish instructions for customers on your website.

The customer will need to:

Open the integrations section in the Allpay dashboard.
Create API keys.
Copy the keys and paste them into the settings of your platform.

Technical involvement from Allpay is usually not required for this type of integration. After implementation, send us information about your platform and a link to the Allpay connection instructions on your website.

After review and approval, your platform will be added to the Allpay integrations catalog.

Automated integration

Automated integration allows the platform to be connected without manually copying API keys. The user clicks the connection button in the Allpay dashboard, confirms the connection on your platform side, and the API keys are transferred automatically.

Before implementation, Allpay provides your platform with:

partner_id — the individual integration ID;

secret_key — the secret key for signing and verifying server requests.

1Redirect from Allpay to your platform page

The user opens the Settings → Integrations → Your platform section in the Allpay dashboard and clicks the connection button.

Allpay generates a one-time token for linking the accounts and redirects the user to the confirmation page on your platform side, for example:

https://your-platform.com/connect?token=TOKEN

Where TOKEN is the one-time token created by Allpay.

The standard token lifetime is 1 hour.

2Confirmation on your platform side

On your side, the user confirms the connection under their account.

After confirmation, your platform redirects the user back to the universal Allpay endpoint:

https://allpay.to/services/endpoints/exchange.php?act=connect&partner_id=PARTNER_ID&token=TOKEN&external_uid=USER_ID

Where:

act=connect — the integration connection action;

partner_id — the individual integration ID;

token — the one-time token created by Allpay;

external_uid — the internal user ID on your platform.

3Creating and sending API keys to your platform

After verifying the token, Allpay links the Allpay user with the user on your platform, creates or finds the API keys api_login and api_key, and then sends them to your endpoint.

Example endpoint on your platform side:

POST https://your-platform.com/allpay/partner/exchange

Request body:

{
  "external_uid": "USER_ID",
  "api_login": "API_LOGIN",
  "api_key": "API_KEY",
  "sign": "SIGNATURE"
}

Where:

external_uid — the user ID on your platform;

api_login — the Allpay user's API login;

api_key — the Allpay user's API key;

sign — the request signature.

4Request signature

The server request with the API keys is signed using HMAC SHA-256.

Signature format:

hash_hmac('sha256', $payload_json, $secret_key);

Where:

payload_json — the JSON request body;

secret_key — the individual secret key.

5Response from your platform

After successfully receiving and saving the keys, your platform must return a successful response, for example:

{
  "ok": true
}

After this, Allpay marks the integration as active.

Disconnecting the integration

If the user disconnects the integration on your platform side, you must delete the saved API keys on your side.

In addition, your platform must send a POST request to Allpay to disconnect the integration:

POST https://allpay.to/services/endpoints/exchange.php?act=disconnect&partner_id=PARTNER_ID

Request body:

{
  "external_uid": "USER_ID",
  "sign": "SIGNATURE"
}

Where:

external_uid — the user ID on your platform;

sign — the request signature.

The disconnect request is also signed using secret_key.

If the user disconnects the integration from the Allpay dashboard, Allpay can send a disconnect notification to your platform endpoint. To receive this notification, provide an endpoint on your side.

Security requirements

For automated integration, the following requirements must be met:

HTTPS only
All requests between Allpay and your platform must be sent only over HTTPS.
Secure key storage
The received api_login and api_key must be stored securely on your side.
Server request signatures
Server requests must be signed using secret_key.

Information for the integrations catalog

After the technical part is completed and the integration is working, send us the following information to add your platform to the Allpay integrations catalog:

platform logo in SVG format;
short platform description of up to 200 characters;
extended platform description of up to 360 characters;
technical support contacts for the integration: email and WhatsApp or Telegram;
information on whether your integration supports installments, recurring payments, and refunds;
link to the Allpay connection instructions on your website.

Allpay branding guidelines

Use the correct brand spelling:

correct: Allpay;

incorrect: AllPay, All Pay, allpay.

Use the official Allpay logo.

Keep reading

Integrations

API

No results found.

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Start accepting payments

Connect a sales channel for your business today

Free sign up

7-day trial

Cancel anytime

Installments

Split the amount into monthly payments that will be deducted from the customer's card automatically (tashlumim).

Major card brands

Accepting payments with Visa, MasterCard, American Express, Diners, Discover, JCB and Isracard.

Digital receipts

Automatic generation of digital receipts (kabalot and hashbonit mas) through integration with a licensed service.

Weekly payouts

Option to receive payouts to a bank account weekly instead of monthly.

Contact

info@allpay.co.il

Updates

News releases Telegram channel

Solutions

Payment links Integrations API reference

Resources

Help Center Allpay logo

Docs

App

Install
on iPhone

Allpay LTD. PCI DSS Level 1 compliant.

By clicking "Accept", you allow us to store cookies to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for details.

Accept Reject Preferences

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Help Center

Hosted Fields: how to embed payment form on a website

Tutorial

Setup

Installments

Quick Pay Buttons

Apple Pay button

3-D Secure

Connecting and configuring

Frictionless 3DS

Commission

Users and permissions

Adding users

Access permissions

Deactivating a user

Owner details

Subscriptions (recurring billing)

Creating a subscription

Subscription start options

Subscription end options

Subscription statuses

Tracking subscriptions

Cancelling a subscription

Failed charge

Subscriptions vs installments

Life hack: a one-time charge on a future date

Redirect after payment and success page customization

Setup

API payments

Changing business type from esek patur to esek murshe and back

VAT

Documents

Webhooks

What is webhook

Even types

Where to configure a webhook

Webhook request contents

Example request

add_field parameter

Webhook security

Verification using the Webhook secret key

Signature generation algorithm:

Example JavaScript for Zapier

Demo of webhook verification on Zapier

IP address verification‍

Webhook delivery and retries

How to integrate your platform with Allpay

Requirements

How to start

Integration methods

Manual integration

Automated integration

<span class="u-richtext-counter">1</span>Redirect from Allpay to your platform page

<span class="u-richtext-counter">2</span>Confirmation on your platform side

<span class="u-richtext-counter">3</span>Creating and sending API keys to your platform

<span class="u-richtext-counter">4</span>Request signature

<span class="u-richtext-counter">5</span>Response from your platform

Disconnecting the integration

Security requirements

<span id="info">Information for the integrations catalog</span>

Allpay branding guidelines

FAQ

Start accepting payments

Installments

Major card brands

Digital receipts

Weekly payouts