Decta

Supports in this guide: Payments

Provider website: decta.com

What you need to do for start processing transactions (brief summary)

1. Choose account type
2. Get your credentials (from Decta)
3. Connect in Dashboard
4. Send an API request

Choose account type

Decta can be connected in different ways (depending on your needs):

• If you do H2H card payments (card data sent directly) -> choose H2H Merchant account
• If you do redirect payments (MB WAY, customer redirected to a hosted payment page) -> choose Provider account

These are two separate credential sets — connecting one doesn't connect the other. If you're not sure which one to use, confirm with your Corefy account manager.

Prerequisites: get from Decta

Decta issues separate credentials for each account type below.

For H2H Merchant account:

• Secret Key -> Corefy field secret_key -> exactly 64 characters -> where to find: Decta backoffice ('e-Commerce & API' section) / issued by Decta manager -> generate a separate key set for Test and for Live
• Test Mode -> Corefy field test_mode -> matches the key set you generated
• Has Descriptor -> Corefy field has_descriptor -> enables a dynamic statement descriptor; set its actual content in your Commerce account settings
• Save Instant Token -> optional, Corefy field save_instant_token -> enable for recurring/merchant-initiated payments
• API URL -> optional, Corefy field api_url -> overrides Decta's default host, Live mode only — in Test Mode Corefy always uses Decta's standard host regardless of this field

For Provider account:

• Secret Key -> Corefy field secret_key -> up to 100 characters -> where to find: Decta backoffice / issued by Decta manager
• External ID -> Corefy field external_id -> a merchant-entered identifier for this connection; also used as the webhook's title if you enable Create Webhook (not updatable once set — choose it carefully)
• Create Webhook -> optional boolean, Corefy field create_webhook -> if enabled, automatically registers a webhook with Decta for this connection — see Additional info

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "service": "payment_card_eur_hpp",
      "currency": "EUR",
      "amount": 100,
      "reference_id": "86e68af6-6b95-4cc0-be16-e4df8044604c"
    }
  }
}

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "service": "payment_card_eur_hpp",
      "currency": "EUR",
      "amount": 100,
      "customer": {
        "reference_id": "bc75bc54-5023-4f98-8c0d-ec5ed7e8f380",
        "name": "John Smith",
        "email": "johnsmith@gmail.com",
        "phone": "+15551234567",
        "date_of_birth": "1990-05-14",
        "address": {
          "country": "DE",
          "region": "Berlin",
          "city": "Berlin",
          "post_code": "10115",
          "full_address": "1st Street 1"
        }
      },
      "reference_id": "08f5e97c-1170-4bda-9625-3bde3c6dcd20"
    }
  }
}

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "service": "mb_way_eur_hpp",
      "currency": "EUR",
      "amount": 100,
      "customer": {
        "reference_id": "55041b5b-adfd-4073-a92b-fd8b495a4cc1",
        "email": "johnsmith@gmail.com"
      },
      "reference_id": "86e68af6-6b95-4cc0-be16-e4df8044604c"
    }
  }
}

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "service": "mb_way_eur_hpp",
      "currency": "EUR",
      "amount": 100,
      "customer": {
        "reference_id": "55041b5b-adfd-4073-a92b-fd8b495a4cc1",
        "email": "johnsmith@gmail.com",
        "address": {
          "country": "PT"
        },
        "metadata": {
          "ip": "203.0.113.5"
        }
      },
      "reference_id": "08f5e97c-1170-4bda-9625-3bde3c6dcd20"
    }
  }
}

Additional info

H2H Merchant account:

1. Recurring / instant payments — if Save Instant Token is enabled and customer.email is present on the first Sale, Corefy creates a persistent client record with Decta so later recurring/merchant-initiated payments can reuse it. Without a customer.email, no client record is created and the token can't be saved, even with Save Instant Token enabled.

2. Refunds — Decta allows only one refund per transaction (partial or full), not multiple partial refunds against the same payment.

3. 3D Secure — after card data is submitted, if Decta requires 3D Secure it returns a challenge URL and the customer is redirected there; if the card requires 3DS but 3DS isn't enabled for your account, the payment fails outright rather than falling back to a non-3DS attempt.

4. Callbacks — this account type has no callback/webhook mechanism; Corefy relies on status reconciliation (polling) to pick up the final result.

Provider account:

1. Create Webhook — if enabled, Corefy automatically registers a webhook with Decta (events: payment success, payment failure, canceled, expired) using your External ID as the webhook title.

2. Callback security — Decta's webhook callback isn't signed. Corefy identifies the payment from the id field in the callback body and triggers reconciliation; Decta confirmed callbacks only originate from a fixed pair of IP addresses, which Corefy enforces automatically.

3. MB WAY availability — if MB WAY isn't enabled on your Decta terminal, Corefy fails the payment immediately with a clear error — enable it with Decta directly, there's nothing to configure on the Corefy side for this.

4. Per Decta, MB WAY transactions are limited to between €0.01 and €50,000.

FAQ / Troubleshooting

• Invalid credentials / auth error -> verify you're using the Secret Key that matches the selected Test/Live mode (H2H Merchant account)
• Refund rejected after a previous refund -> Decta only allows one refund per transaction; a second refund attempt on the same payment will fail (H2H Merchant account)
• Payment declined - invalid CVV -> Decta doesn't support CVV-less card payments; make sure CVV is captured and submitted (H2H Merchant account)
• Payment fails with invalid details -> Corefy's own MB WAY connector requires customer.email and customer.address.country (or the COUNTRY constant) before it will even call Decta — confirm at least one source for each is set (Provider account)
• MB WAY option not available -> contact Decta to have MB WAY enabled on your terminal (Provider account)
• Payment link expired -> the MB WAY redirect link is only valid for a limited time — the customer needs to complete the payment before it expires, then a new payment must be created (Provider account)
• Not sure which account type to use? -> ask your Corefy account manager