Setting up payments

Overview

Provider	Methods for customers	What you enter in Provomatic	Webhook
Stripe	Card, Apple Pay, Google Pay, SEPA direct debit, Klarna and more, depending on what is enabled in your Stripe account	Restricted key (rk_…), webhook secret (whsec_…)	Create it in the Stripe dashboard
PayPal	PayPal account, depending on the country also card and direct debit via PayPal	Client ID, secret, webhook ID	Create it in the PayPal developer dashboard
Mollie	SEPA direct debit, card, Klarna, PayPal, iDEAL, Bancontact and more	API key (test_… or live_…)	Not needed – Provomatic passes the address with every payment
Bank transfer	Bank transfer, with GiroCode in the banking app	Bank account in the company details	–

All settings are in the admin area under Settings → Payments. Keys and secrets are stored encrypted and never shown in plain text again – leaving a field empty when saving keeps the stored value.

The webhook addresses are always (with your domain):

https://shop.yourhosting.com/webhooks/payments/stripe
https://shop.yourhosting.com/webhooks/payments/paypal
https://shop.yourhosting.com/webhooks/payments/mollie

Stripe

Stripe is the best choice when your customers mainly pay by card, Apple Pay or Google Pay. Provomatic uses Stripe Checkout: the customer pays on a Stripe page, card details never touch your server.

1. Account and sandbox

   Sign in at dashboard.stripe.com. For testing, switch to the sandbox (test mode) at the top – no real money moves there.

2. Create a restricted key

   Under Developers → API keys → Create secret key choose “Restricted key” and name it, for example “Provomatic”. Set only these permissions:

   • Checkout Sessions: Write
   • PaymentIntents: Read
   • Refunds: Write

   Leave everything else at “None”. A restricted key can do far less harm than the full secret key sk_… if it ever leaks.

3. Create an event destination (webhook)

   Under Developers → Webhooks → Add destination: events from “Your account”, payload style “Snapshot”. Select exactly these four events:

   • checkout.session.completed – checkout completed (for cards the money is there)
   • checkout.session.async_payment_succeeded – delayed payment received (for example SEPA)
   • checkout.session.async_payment_failed – delayed payment failed
   • checkout.session.expired – checkout expired

   Destination type “Webhook endpoint”, endpoint URL https://shop.yourhosting.com/webhooks/payments/stripe.

4. Enter it in Provomatic

   On the destination’s detail page Stripe shows the signing secret (whsec_…). Enter it together with the restricted key under Settings → Payments → Stripe and enable Stripe. You do not need the publishable key pk_….

5. Go live

   For real payments repeat steps 2 to 4 outside the sandbox with a live key. Which payment methods appear is controlled in Stripe under Settings → Payment methods.

PayPal

Many gamers prefer PayPal. Provomatic uses the Orders API v2: the customer approves at PayPal, then Provomatic captures the amount immediately.

1. App in the developer dashboard

   Sign in at developer.paypal.com with your PayPal business account. At the top left you switch between Sandbox and Live. Under Apps & Credentials open the “Default Application” or create your own app.

2. Client ID and secret

   The app shows the Client ID and the Secret. You enter both in Provomatic.

3. Create a webhook

   Further down in the same app under Sandbox Webhooks or Live Webhooks → Add Webhook. URL https://shop.yourhosting.com/webhooks/payments/paypal, events:

   • CHECKOUT.ORDER.APPROVED – “Checkout order approved”: the customer approved at PayPal
   • PAYMENT.CAPTURE.COMPLETED – “Payment capture completed”: the money has arrived
   • PAYMENT.CAPTURE.DENIED – “Payment capture denied”: the capture was declined

   Do not choose “All Events” – Provomatic only needs these three.

4. Enter it in Provomatic

   After saving, PayPal shows the Webhook ID in the webhook table. Under Settings → Payments → PayPal enter client ID, secret and webhook ID, tick “Sandbox” for testing and enable PayPal. With the webhook ID Provomatic verifies the signature of every webhook with PayPal.

5. Test buyer account

   Under Testing Tools → Sandbox Accounts you find a test buyer account (“Personal”). Use it to sign in for test purchases – never your real PayPal account.

Mollie

Mollie is popular in Germany, the Netherlands and Belgium and offers many local payment methods with a single key.

1. Account and profile

   Sign up at my.mollie.com. Mollie creates a payment profile for your website. For live payments Mollie needs your company details and your shop’s address – test payments work right away.

2. Create an API key

   Under Developers → API keys → Create API key: description such as “Provomatic”, token type “Standard API key”, your profile and API mode “Test” (later “Live”). The default permissions are enough. Mollie shows the key only once.

3. Enter it in Provomatic

   Under Settings → Payments → Mollie enter the key and enable Mollie. A key starting with test_ switches test mode on automatically.

4. No webhook needed

   Provomatic passes the webhook address to Mollie with every payment. Mollie only reports the payment ID, and Provomatic asks Mollie for the status directly – which is also why there is no webhook secret.

Bank transfer

Under Settings → Payments switch on “Bank transfer”. It needs an IBAN in the company details. On the payment page and on the invoice the customer sees recipient, IBAN, BIC, amount and reference (the invoice number) plus a GiroCode: banking apps read all details with the camera.

When the money arrives, your team records the payment under Billing → Invoices with “Record payment” – partial payments too. Once the invoice is paid in full, the order is released automatically.

Test payment

1. Set up all providers in test or sandbox mode. The payment page then shows “Test mode: no real money is moved”.
2. Place an order in the shop (or sign in as a test customer from Customers with “Login” in the admin area).
3. Stripe: card 4242 4242 4242 4242, any future expiry date, any security code.
4. PayPal: sign in with the sandbox buyer account and approve.
5. Mollie: pick a method and choose the status “Paid” on the test page.
6. Check in the admin area: Billing → Payments shows the payment as paid, the Webhook log shows the incoming webhook as “processed”, the order is paid and the service is active.

Refunds

Under Billing → Payments you refund a payment in full or in part. Provomatic triggers the refund directly at Stripe, PayPal or Mollie and automatically issues a credit note referring to the invoice. A full refund cancels the invoice. You pay back bank transfers yourself; Provomatic still issues the credit note.

How payments stay safe

• Status always from the provider: Provomatic never trusts webhook content but asks the provider for the payment status itself.
• Amount check: if amount or currency do not match exactly, the payment is rejected and recorded in the audit log.
• Signatures: Stripe webhooks are checked with the signing secret, PayPal webhooks via PayPal’s verification API.
• Exactly once: every event is processed once, even if the provider sends it several times. All webhooks are listed in the webhook log.
• No card data on your server: customers pay on the providers’ pages.