Table of contents

Switching to live

Once you have finished testing with your sandbox account, here are the steps you will need to take to switch over from testing to live.

Unless stated otherwise, this section applies both to services that have integrated with the GOV.UK Pay API, and to services that use the self service payment link functionality.

Set up GOV.UK Pay account

Request a live account

Request a live account by emailing GOV.UK Pay at govuk-pay-support@digital.cabinet-office.gov.uk. Once you have a live account, it will appear in the “My Services” section and be clearly labelled as a “Live” account.

Complete organisation details

Payment card schemes require the details of the organisation taking payment to be shown on payment pages where the user enters card details. This information is displayed in the payment page footer. Note that:

  • the organisation must be the entity that has a contract with the PSP
  • organisation details are not specific to test or live accounts, meaning that if you complete the details for your test account then they will be transferred to your live account automatically

To complete your organisation details:

  1. Go to the GOV.UK Pay admin site.
  2. Sign in to your GOV.UK Pay account.
  3. Go to Switch service > Organisation details.
  4. Complete the Organisation name and Organisation address fields on this page.
  5. Click Save to see the following message: “Organisation details updated”.

Set up live account credentials

To set up your live account credentials:

  1. Go to the GOV.UK Pay admin site.
  2. Sign in to your GOV.UK Pay account.
  3. Go to My Services and click on the live service you want to set up.
  4. Go to Settings > Account Credentials > Edit credentials.
  5. Complete the fields on this page; these will vary depending on which live service you use.

ePDQ

Complete the fields on the Account credentials page:

  • PSP ID - enter your PSP ID for ePDQ
  • Username - enter the API user’s username
  • Password - enter the API user’s password
  • SHA-IN passphrase - this passphrase is created on the Data and origin verification page
  • SHA-OUT passphrase - this passphrase is created on the All transaction submission modes page
  • click Save credentials to go back to the Account Credentials page

Worldpay

Complete the fields on the Account credentials page:

  • Merchant ID - enter your merchant ID for Worldpay
  • Username - enter the XML username
  • Password - enter the XML password
  • click Save credentials to go back to the Account Credentials page

Smartpay

Complete the fields on the Account credentials page:

  • Merchant ID - enter your merchant ID for Smartpay
  • Username - enter the Smartpay username
  • Password - enter the SmartPay password
  • click Save credentials to go back to the Account Credentials page

Generate API Key

Refer to the documentation for instructions on how to generate an API key for use with your live code.

GOV.UK currently supports Worldpay, Barclays ePDQ and Smartpay live gateways. Setup instructions are explained in the Worldpay, ePDQ and Smartpay sections.

The API endpoint for live is now the same as for testing: https://publicapi.payments.service.gov.uk/

This only applies if your service is integrating with the GOV.UK Pay API. It does not apply to self service payments.

Worldpay setup

You must change some settings in your Worldpay account to get it ready for live use.

  1. Sign in to Worldpay and in your Worldpay profile, set Capture delay to “Off”.

    Pay worldpay autocaptureoff
  2. Still in Worldpay, go to Profile > Merchant Channel and set the endpoint for HTTP notifications from Worldpay to GOV.UK Pay to https://notifications.payments.service.gov.uk/v1/api/notifications/worldpay

    Use the same URL for Test and Live channels within Worldpay. The completed settings should look like this:

    Worldpay settings1

Worldpay setup for 3D Secure

If you want to use 3D Secure authentication for your payments, ask your Worldpay account manager to configure your merchant code (you cannot do this yourself by logging in to Worldpay). Ask them to enable 3D Secure for all payments. Once this is done, you can sign in to the GOV.UK Pay self-service admin site and turn on 3D Secure.

ePDQ setup

To set up ePDQ to work with GOV.UK Pay, you must sign in to the ePDQ admin site and:

  1. Add payment methods to your account.
  2. Set up account security parameters.
  3. Set up notification settings.
  4. Set up an API user.

Add payment methods to your account

Epq 2

  1. Sign in to the ePDQ admin site. On the homepage, go to Configuration > Payment methods and select Choose new payment methods

  2. Click Add next to the relevant payment method.

  3. On the Contract data tab:

    • Specify whether you have signed a contract for distance selling with an acquiring bank
    • Complete the Affiliation number (UID/Merch ID/VP number) field
    • Click Submit
  4. Go to the PM Activation tab:

    • Select Yes for Activation
    • Click Submit
  5. Add all relevant payment methods to your account.

Set up account security parameters

Set up hashing method

Epq 3

Go to Configuration > Technical information

If you cannot access this page, ask an admin user to grant you access to it; they can do this at Configuration > Users

  1. On the Technical Information page, click the Global security parameters tab.
  2. For the Hash algorithm, choose SHA-512.
  3. For the Character encoding, choose UTF-8 and click Save.

Set up checks for e-Commerce & Alias Gateway

Epq 4

  1. On the Technical information page, click the Data and origin verification tab.
  2. Scroll to the Checks for e-Commerce & Alias Gateway section.
  3. Leave the URL of the merchant page containing the payment form that will call the page: orderstandard.asp field blank.
  4. Enter a strong SHA-IN passphrase (plain text, not a hash); this will be used when setting up the GOV.UK Pay account credentials.
  5. Scroll down to the Checks for Barclaycard Direct Link section.
  6. Leave the IP address blank.
  7. Enter the same SHA-IN passphrase as the Checks for e-Commerce & Alias Gateway section and click Save.

Strong is defined as a passphrase with at least 16 characters, containing at least 4 different characters, at least one letter (a-z) and at least one number (0-9) or symbol (&, @, #, !, etc.). The following symbols cannot be used: ^, {, }, [, ], “, ‘, |, <, >

Set up notification settings

Set up Direct HTTP server to server requests

Epq 5

  1. On the Technical information page, click Transaction feedback.
  2. Scroll to the e-Commerce → Direct HTTP server-to-server request section.
  3. Leave Timing of the request on the default No request setting.
  4. Leave the following two fields blank:
    • If the payment’s status is “accepted”, “on hold” or “uncertain”
    • If the payment’s status is “cancelled by the client” or “too many rejections by the acquirer”
  5. Set the Request method to POST.
  6. Scroll to the e-Commerce → Dynamic e-Commerce parameters section.
  7. Check if PAYIDSUB is included in the Selected box:
    • If it is not included, find it in the Available box and click “>” to add it to the Selected box.

Set up security for request parameters

Epq 6

  1. Scroll to the All transaction submission modes > Security for request parameters section.
  2. Enter a strong SHA-OUT passphrase (plain text, not a hash); this will be used when setting up the GOV.UK Pay account credentials.
  3. Leave the Basic Authentication Credentials blank.
  4. Set Timing of the request to For each offline status change (payment, cancellation, etc.)
  5. Enter https://notifications.payments.service.gov.uk/v1/api/notifications/epdq into the URL on which the merchant wishes to receive a deferred HTTP request, should the status of a transaction change offline field.
  6. Click Save.

Set up an API user

To set up an API user:

  1. Activate your account
  2. Add a user manager
  3. Create an API user

Activate your account

Account activation is completed during ePDQ account creation.

Add a user manager

Epq 7

  1. Go to Configuration → Account.
  2. On the Your options tab, under the Available options sub-tab, you will see a list of IDs with Activate buttons. Activate one of the User Manager options.

  3. Click accept on the General Conditions screen.

  4. Log out by clicking the Logout option in the top right hand corner of the screen, and then log back in again.

  5. You can now go to Configuration => Users to create an API user.

Create an API user

Epq 8

  1. On the Users page, click New User.
  2. Complete the UserID and User’s name fields.
  3. Complete the email address field with the email of the person who should receive notifications about this account.
  4. Select Admin in the Profile field.
  5. Check the Special user for API (no access to admin.) option.
  6. Enter your own password.
  7. Click Create.
  8. You will then create a password for the API user:
    • Enter your own password.
    • Enter a password for the API user.
    • Confirm the password for the API user.
    • Click Submit.
  9. You will see a message that your password has been successfully updated. Click Back to List.

You have now successfully set up your ePDQ account to work with GOV.UK Pay.

Set up 3D Secure for ePDQ

To enable 3D Secure payment authentication, sign in to the GOV.UK Pay self-service admin site, click 3D Secure and turn 3D Secure on.

3D Secure should be enabled by default on the ePDQ admin site. To check this, on the homepage, go to Configuration > Payment methods and select 3D Secure column.

Smartpay setup

To set up Smartpay to work with GOV.UK Pay, you must:

  • set up your notification credentials
  • configure your user profile
  • configure server communication

Set up notification credentials

  1. Go to the GOV.UK Pay admin site.
  2. Sign in to your GOV.UK Pay account.
  3. Go to Settings > Account Credentials > Edit notification credentials.
  4. Enter a unique username and password (the password must contain more than 10 characters).
  5. Click Save credentials.

Configure your user profile

Smartpay set up usr

Sign in to Smartpay

  1. Sign in to Smartpay and your Smartpay organisation.
  2. Select the correct merchant account (you can view all merchant accounts by clicking on the organisation name at the top of the page).

Add new user

  1. Click on Settings and select Users.
  2. Click the Add new user button.
  3. Select Web Service as the user type.
  4. Complete both the Password fields (the username is assigned by SmartPay).
  5. Leave the Client Certificate field blank.

Generate client encryption key

  1. Under Easy Encryption, click Generate client encryption key.
  2. Leave the other options in this section as default.

Edit Allowed User IP Range

  1. Set the IP address to 0.0.0.1.
  2. Leave the other options in this section as default.

Enable roles and accounts

  1. Under Roles and Associated Accounts, click on Roles and enable the following roles:

    • API PCI Payments role
    • API tokenise payment details
    • Merchant PAL Webservice role
    • Merchant Recurring role

    Contact Smartpay if any of these roles are not available to enable.

  2. Click on Accounts and enable your account.

  3. Click Save.

Configure server communication

  1. Click on Settings and select Server Communication.
  2. On the Server Communication settings for page, click the Add button in the Standard notification row.

Smartpay stndrd add

Complete the fields on the Standard Notification settings page.

Smartpay servr comms

Transport

Authentication

Enter the same unique username and password you set in the Set up notification credentials section.

Leave all other settings as default and click the Test Configuration button. If you have correctly set up your account, you will see a success message like this example:

HTTP test:

Test 1:test_AUTHORISATION_1
ResponseCode:200
Output:[accepted]
ResponseTime_ms:353

Test 2:test_AUTHORISATION_2
ResponseCode:200
Output:[accepted]
ResponseTime_ms:261

Test 3:test_AUTHORISATION_3
ResponseCode:200
Output:[accepted]
ResponseTime_ms:262

Test 4:test_AUTHORISATION_4
ResponseCode:200
Output:[accepted]
ResponseTime_ms:294

Click Save configuration.

Contact us at govuk-pay-support@digital.cabinet-office.gov.uk if you have any questions.

Emergency contact details

Your service manager should have been given details of emergency contact methods to reach our support team in case of an urgent problem (for example, if you suspect that fraudulent transactions are being made on your account).

Before you enter live, you should make sure that the right people on your team know how to report an emergency.

Integrating with existing reporting systems

If you’re a beta partner, the GOV.UK Pay team will hold technical workshops with you to discuss how to integrate the reporting from GOV.UK Pay with your own financial systems.