Unlimit (CardPay)

The world's largest in-house payment infrastructure

Supports in this guide: Payments, Payouts

Provider website: unlimit.com

What you need to do for start processing transactions (brief summary)

Choose account type
Get your credentials (from Unlimit)
Connect in Dashboard
Send an API request

Choose account type

Unlimit can be connected in different ways (depending on your needs):

If you do H2H card payments (card data sent directly, Apple Pay/Google Pay) -> choose H2H Merchant account
If you do redirect payments (local methods: Neteller, PayPal, SEPA, Open Banking, BLIK, Bancontact, iDEAL, Przelewy24) or payouts -> choose Provider account

If you're not sure which one to use, confirm with your Corefy account manager.

Prerequisites: get from Unlimit

Contact your Unlimit account manager to get access to your Merchant Account back-office, then go to Settings -> Wallet settings -> Show credentials to copy:

For H2H Merchant account:

Terminal Code -> Corefy field terminal_code -> labeled "Wallet ID" in Unlimit's back-office.
Terminal Password -> Corefy field terminal_password.
Callback Secret -> Corefy field callback_secret.
Apple Merchant ID (optional, Apple Pay only) -> Corefy field apple_merchant_id.
Apple Certificate / Key / Password (optional, Apple Pay only) -> Corefy fields apple_cert/apple_cert_key/apple_cert_password -> see Additional info for how to generate these.
Google Pay Merchant ID (optional, Google Pay only) -> Corefy field google_pay_merchant_id.
Gateway Merchant ID (optional, Google Pay only) -> Corefy field gateway_merchant_id.
Acquirer BIN / Acquirer Merchant ID (optional) -> Corefy fields acquirer_bin/acquirer_merchant_id -> your own acquirer/3DS identifiers, only relevant when Use MPI is enabled (see Additional info) - ask your account manager whether your account needs this.

For Provider account:

Terminal Code -> Corefy field terminal_code.
Terminal Password -> Corefy field terminal_password.
Callback Secret -> Corefy field callback_secret.

Important

Be sure to check with the manager if you require to provide a white list of IPs, and if so, specify IP addresses from the Corefy list.

Payments processing (connect H2H Merchant account, create payment-invoice)

Connect H2H Merchant account in Corefy Dashboard

Step 1 - Open connection form

Open Unlimit in the provider directory and press Connect at Unlimit Provider Overview page in the New connection section. Choose H2H Merchant account.

Step 2 - Fill in fields and select settings

Terminal Code
Terminal Password
Callback Secret
Test Mode -> (enable if you are using sandbox credentials)
Save Instant Token -> (enable if you plan to use instant/recurring payments)
Apple Merchant ID, Apple Certificate, Apple Certificate Key, Apple Certificate Password (optional, Apple Pay only)
Google Pay Merchant ID, Gateway Merchant ID (optional, Google Pay only)
Acquirer BIN, Acquirer Merchant ID, Use MPI, Acquirer Country Code, Acquirer Country Code Source (optional, see Additional info)

Choose Currency and Features. This is one of the broadest connectors on the platform - 40+ currencies are confirmed (including USD, EUR, GBP, UAH, RUB, PLN, and many regional currencies); check with your Corefy account manager which are enabled for your account. If you connect Apple Pay, be sure to also select the apple_pay feature from the dropdown.

Success

You have connected Unlimit H2H Merchant account!

First request to Corefy API (MIN)

What it does: creates a payment-invoice; card data itself is collected and submitted separately by Corefy's checkout/SDK layer, not as part of this request.

Payment - MIN

POST /api/payment-invoices

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "reference_id": "8e3dbbb0-17af-4c9a-bedb-93bdac6900a2",
      "service": "payment_card_eur_hpp",
      "currency": "EUR",
      "amount": 10
    }
  }
}

Payment - MAX

POST /api/payment-invoices

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "reference_id": "6795502c-e27d-4d07-85e0-93245aab9a3f",
      "service": "payment_card_eur_hpp",
      "currency": "EUR",
      "amount": 10,
      "customer": {
        "reference_id": "cus_123",
        "name": "John Smith",
        "email": "johnsmith@gmail.com",
        "phone": "+15551234567"
      }
    }
  }
}

customer is entirely optional for H2H - there's no code-level requirement for it on this flow (unlike the Provider account flow below, where customer.email is mandatory). This connector supports Apple Pay and Google Pay on this same account (no separate service code needed) - see Additional info.

Extended request (MAX)

Why add extra fields (typical reasons): - Provide additional customer details for compliance/reconciliation - Positively influence conversion rate - Include optional fields required by your specific flow

Options

Options are configured on the Corefy side and affect how Corefy builds provider requests or processes responses.

Currently available options (4)

enable_aft_refund_rules - restricts refunds to within 72 hours of the original transaction (Visa AFT compliance).
set_pending_for_recurrent - keeps a successful recurring (saved-token) payment as Pending instead of immediately Success.
check_refund_callback - processes refund status data embedded in a payment callback.
google_pay_redirect_method - HTTP method used when redirecting to the 3DS ACS during Google Pay transactions (Google Pay only).

enable_aft_refund_rules

What it does: when enabled, refunds are only allowed within 72 hours of the original transaction's creation (Visa's Account Funding Transaction rules); when disabled, refunds can be made at any time Corefy's own system allows (Unlimit's own rules may still differ).

When to use: this is mandatory for new accounts and enabled by default for existing ones - only disable it if you're certain your account isn't subject to Visa's AFT requirements. See Visa's own guidance for background.

Default: true

Allowed values: true / false

set_pending_for_recurrent

What it does: when a recurring (saved-token) payment succeeds and Save Instant Token is enabled, keeps the transaction status as Pending instead of marking it Success immediately.

When to use: enable it if you want to wait for additional confirmation before treating a recurring payment as final.

Default: false

Allowed values: true / false

check_refund_callback

What it does: when a callback from Unlimit contains refund data, processes it as a refund status update; without this option, that refund data in the callback is ignored.

When to use: enable it if you issue refunds and want their status reflected via callback rather than only via reconciliation.

Default: false

Allowed values: true / false

google_pay_redirect_method

What it does: sets the HTTP method used when redirecting the customer to the 3DS ACS page during a Google Pay transaction.

When to use: change it only if instructed by Unlimit or your Corefy account manager.

Default: POST

Allowed values: GET / POST

Payments processing (connect Provider account, create payment-invoice)

Connect Provider account in Corefy Dashboard

Step 1 - Open connection form

Open Unlimit in the provider directory and press Connect at Unlimit Provider Overview page in the New connection section. Choose Provider account.

Step 2 - Fill in fields and select settings

Terminal Code
Terminal Password
Callback Secret
Currencies -> select from EUR, USD, PLN
Test Mode -> (enable if you are using sandbox credentials)

Success

You have connected Unlimit Provider account!

First request to Corefy API (MIN)

What it does: creates a payment-invoice and returns a redirect link to Unlimit's hosted payment page.

Payment - MIN

POST /api/payment-invoices

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "reference_id": "0dde9e79-2c64-4703-adaf-93d710633401",
      "service": "payment_card_usd_hpp",
      "currency": "USD",
      "amount": 10,
      "customer": {
        "reference_id": "cus_123",
        "email": "johnsmith@gmail.com"
      }
    }
  }
}

Payment - MAX

POST /api/payment-invoices

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "reference_id": "7976b4ce-fadd-4585-baa0-6b02c65351dc",
      "service": "payment_card_usd_hpp",
      "currency": "USD",
      "amount": 10,
      "customer": {
        "reference_id": "cus_123",
        "name": "John Smith",
        "email": "johnsmith@gmail.com",
        "phone": "+15551234567"
      }
    }
  }
}

customer.email is mandatory on this flow - Unlimit rejects the request with INVALID_DETAILS if it's missing. For PLN, the plain card service is payment_card_pln_hpp; for EUR, card payments route through payment_card_email_eur_hpp instead (same mandatory email requirement). This connector also supports Neteller, PayPal, SEPA transfer, Open Banking, BLIK, Bancontact, iDEAL, and Przelewy24 as redirect methods, each with its own service code - see Additional info for the full list. Przelewy24 additionally needs fields.bank_code to select the customer's bank.

Extended request (MAX)

Why add extra fields (typical reasons): - Provide additional customer details for compliance/reconciliation - Positively influence conversion rate - Include optional fields required by your specific flow

Options

Options are configured on the Corefy side and affect how Corefy builds provider requests or processes responses.

Currently available options (1)

custom_finalization_logic - changes how Corefy decides a payment's final status for this connection.

custom_finalization_logic

What it does: switches this connection to a non-default rule for deciding when a payment is treated as finally successful or failed.

When to use: enable only if instructed by Unlimit or your Corefy account manager - most connections don't need this.

Default: false

Allowed values: true / false

Payouts processing (connect Provider account, create payout-invoice)

Connect Provider account in Corefy Dashboard

Uses the same Provider account connection as Payments above.

First request to Corefy API (MIN)

What it does: creates a payout-invoice and sends funds to a card.

Payout - MIN

POST /api/payout-invoices

{
  "data": {
    "type": "payout-invoice",
    "attributes": {
      "reference_id": "0dde9e79-2c64-4703-adaf-93d710633401",
      "service": "payment_card_eur",
      "currency": "EUR",
      "amount": 10,
      "customer": {
        "reference_id": "cus_123"
      },
      "fields": {
        "card_number": "4111111111111111"
      }
    }
  }
}

Payout - MAX

POST /api/payout-invoices

{
  "data": {
    "type": "payout-invoice",
    "attributes": {
      "reference_id": "7976b4ce-fadd-4585-baa0-6b02c65351dc",
      "service": "payment_card_eur",
      "currency": "EUR",
      "amount": 10,
      "customer": {
        "reference_id": "cus_123",
        "name": "John Smith"
      },
      "fields": {
        "card_number": "4111111111111111"
      }
    }
  }
}

fields.card_number is required. customer.name is optional but recommended - it can be used as a fallback via the CUSTOMER_NAME constant below if your own request doesn't include it. This connector also supports card payouts in USD, KZT, INR, MXN, KES, VND, and UZS, plus a dedicated M-Pesa payout method for KES (Kenyan mobile money) - see Additional info.

Extended request (MAX)

Why add extra fields (typical reasons): - Provide additional customer details for compliance/reconciliation - Positively influence conversion rate - Include optional fields required by your specific flow

Constants (fallback fields)

Constants are static values that Corefy can send to the provider instead of dynamic data from your API request, when those fields are missing in the request.

Priority (predictable rule): 1. If a value is present in the request -> Corefy uses the request value 2. Else if the constant is set -> Corefy uses the constant 3. Else -> provider may reject the request or apply its defaults (depends on provider)

Currently available constants (constant -> Corefy API field)

CUSTOMER_NAME -> customer.name

Note

This note applies to every payout service on this connection, including M-Pesa.

M-Pesa payouts (KES)

M-Pesa payouts use different fields - fields.id (the recipient's M-Pesa identifier, e.g. phone number) and fields.customer_name, with service mpesa_wallet_kes, instead of card_number:

{
  "data": {
    "type": "payout-invoice",
    "attributes": {
      "reference_id": "08f5e97c-1170-4bda-9625-3bde3c6dcd20",
      "service": "mpesa_wallet_kes",
      "currency": "KES",
      "amount": 1000,
      "customer": {
        "reference_id": "cus_123",
        "name": "John Smith"
      },
      "fields": {
        "id": "254712345678",
        "customer_name": "John Smith"
      }
    }
  }
}

Additional info

H2H Merchant account:

Apple Pay is supported with decryption on Unlimit's side - requires Apple Merchant ID and a certificate/key/password generated for your domain. Google Pay is likewise supported with decryption on Unlimit's side - requires Google Pay Merchant ID and Gateway Merchant ID. Both ride on the same H2H Merchant account connection, no separate service code needed.

To generate the Apple Pay certificate:
1. Generate a key pair and CSR:
```
openssl req -new -newkey rsa:2048 -nodes -out rsacertreq.csr -keyout rsakey.key -subj /CN=www.mydomain.com
```
2. Use the CSR to request a Merchant Identity Certificate at developer.apple.com; download merchant_id.cer.
3. Convert it and validate your merchant domain per Apple's own requirements, sharing the resulting domain association file with your Corefy account manager.
For more information, visit:
- How to Integrate Apple Pay with Corefy: Full Technical Walkthrough
- How to Integrate Google Pay with Corefy: Full Technical Walkthrough
3D Secure runs through a third-party MPI service, not something Corefy operates itself - it's tied to your own Acquirer BIN/Acquirer Merchant ID (your own acquirer/3DS setup), set via the Use MPI toggle. These two fields are schema-optional and the connector tolerates them being unset, but check with Unlimit/your account manager whether your specific setup actually needs them filled in for MPI to work correctly. Acquirer Country Code and Acquirer Country Code Source are additional, rarely-needed fields for this same MPI setup - leave them unset unless instructed otherwise. Contact your Corefy account manager for details on getting MPI configured for your account.

Provider account:

Local payment methods available on the Payments flow (actual availability depends on what's enabled for your account):

Method	Currencies
Card (`payment_card`/`payment_card_email`)	EUR*, USD, PLN
Neteller	EUR, USD, PLN
PayPal	EUR, USD, PLN
SEPA transfer	EUR, PLN
Open Banking	EUR, PLN
BLIK	EUR, PLN
Bancontact	EUR, PLN
iDEAL	EUR, PLN
Przelewy24	EUR, PLN

* EUR card payments use the payment_card_email_*_hpp service specifically - there's no plain payment_card_eur_hpp on this flow.

Payout destinations available on the Payouts flow (actual availability depends on what's enabled for your account): card payouts in EUR, USD, KZT, INR, MXN, KES, VND, UZS, plus M-Pesa mobile-money payouts in KES.

FAQ / Troubleshooting

Invalid credentials / auth error -> verify credentials for the selected environment and account type
Provider account: INVALID_DETAILS / payment rejected -> customer.email is missing; it's mandatory for every Provider account payment
Refund rejected after 72 hours -> enable_aft_refund_rules is on for this connection (the default) - refunds are only allowed within 72 hours of the original transaction unless you disable it
Currency or service is not supported -> confirm allowed currencies/features in your Unlimit account and in Corefy
Not sure which account type to use? -> ask your Corefy account manager

Question

Still looking for help connecting your Unlimit account? Please contact our support team!