PPRO

Supports in this guide: Payments

Provider website: ppro.com

What you need to do for start processing transactions (brief summary)

1. Choose account type
2. Get your credentials (from PPRO)
3. Connect in Dashboard
4. Send an API request

Choose account type

PPRO can be connected in different ways (depending on your needs):

• If you do card payments (H2H, card data sent directly) -> choose H2H Merchant account
• If you do local/alternative payment methods (iDEAL, Giropay, Sofort, Przelewy24, EPS, Multibanco, Blik) — customer redirected to a hosted payment page -> choose Provider account

These are two separate PPRO products with independent credentials — connecting one doesn't connect the other. If you are not sure which one to use, confirm with your Corefy account manager.

Prerequisites: get from PPRO

PPRO issues separate credentials for each account type below.

For H2H Merchant account:

• API Key -> Corefy field api_key -> example: sk_live_7d3f8b2a9c1e4560 -> where to find: PPRO backoffice / issued by PPRO manager
• Merchant ID -> Corefy field merchant_id -> example: EMEAMMTESTCONTRACT001 -> where to find: PPRO backoffice / issued by PPRO manager
• Webhook Secret -> Corefy field webhook_secret -> example: whsec_4a6e2d9f1b3c8720 -> where to find: PPRO backoffice / issued by PPRO manager, needed for callback signature validation to work (see Additional info)
• Save Instant Token -> Corefy field save_instant_token -> enable to tokenize the card on the first Sale, for later recurring/merchant-initiated payments
• API URL -> Corefy field api_url -> only needed to override the default sandbox/live host

For Provider account:

• Login -> Corefy field login -> where to find: PPRO backoffice / issued by PPRO manager
• Password -> Corefy field password -> where to find: PPRO backoffice / issued by PPRO manager
• Notification Password -> Corefy field notification_password -> where to find: PPRO backoffice / issued by PPRO manager
• Contract ID -> Corefy field contract_id -> where to find: PPRO backoffice / issued by PPRO manager
• Certificate -> Corefy field certificate -> a PEM-format CA/extra certificate file issued by PPRO for mutual TLS
• Private Key -> Corefy field private_key -> the PEM-format private key file matching your client certificate, issued by PPRO
• PEM -> Corefy field pem -> the PEM-format client certificate file issued by PPRO for mutual TLS

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "service": "payment_card_eur_hpp",
      "currency": "EUR",
      "amount": 100,
      "customer": {
        "reference_id": "55041b5b-adfd-4073-a92b-fd8b495a4cc1",
        "address": {
          "country": "DE"
        }
      },
      "reference_id": "86e68af6-6b95-4cc0-be16-e4df8044604c"
    }
  }
}

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "service": "payment_card_eur_hpp",
      "currency": "EUR",
      "amount": 100,
      "customer": {
        "reference_id": "bc75bc54-5023-4f98-8c0d-ec5ed7e8f380",
        "name": "John Smith",
        "email": "johnsmith@gmail.com",
        "phone": "+15551234567",
        "address": {
          "country": "DE"
        }
      },
      "reference_id": "08f5e97c-1170-4bda-9625-3bde3c6dcd20"
    }
  }
}

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "service": "ideal_eur_hpp",
      "currency": "EUR",
      "amount": 100,
      "customer": {
        "reference_id": "55041b5b-adfd-4073-a92b-fd8b495a4cc1",
        "name": "John Smith",
        "address": {
          "country": "NL"
        }
      },
      "reference_id": "86e68af6-6b95-4cc0-be16-e4df8044604c"
    }
  }
}

Additional info

1. Callback routing is handled automatically (Corefy generates the callback URL per transaction).
2. Callback signature validation is always enforced — PPRO's PPRO-Signature header is checked on every callback regardless of whether Webhook Secret is set. Leaving it empty doesn't skip validation; it will just fail every real callback's signature check. Set it if you want callbacks to be processed.
3. Provider account callbacks work differently: PPRO's notification only carries its own transaction ID, which Corefy uses to trigger a status check back to PPRO (authenticated with your Login/Password/Contract ID) rather than validating a signature on the notification itself. The Notification Password field is collected but not currently used by this flow.
4. Enable Save Instant Token on connection to support recurring/merchant-initiated payments — the first Sale tokenizes the card, and later charges reuse that token without collecting card data again.

FAQ / Troubleshooting

• Invalid credentials / auth error -> verify credentials for the selected environment and account type
• Currency or service is not supported -> confirm allowed currencies/features in your PPRO account and in Corefy
• Payment rejected for missing country -> customer.address.country is required by PPRO for every payment, on both account types; the Provider account flow also requires customer.name
• H2H Merchant account callbacks not being processed -> confirm Webhook Secret is set on the connection; without it, every callback fails signature validation
• Not sure which account type to use? -> ask your Corefy account manager