XMGate

Supports in this guide: Payments | Payouts

Provider website: n/a

What you need to do for start processing transactions (brief summary)

1. Choose account type
2. Get your credentials (from XMGate)
3. Connect in Dashboard
4. Send an API request

Choose account type

XMGate can be connected in different ways (depending on your needs):

• If you do H2H card payments (including Apple Pay / Google Pay) -> choose H2H Merchant account
• If you do payouts -> choose Provider account

If you're not sure which one to use, confirm with your Corefy account manager.

Prerequisites: get from XMGate

XMGate issues separate credentials for each account type below.

For H2H Merchant account:

• Login -> Corefy field login -> where to find: XMGate backoffice / issued by XMGate manager
• Password -> Corefy field password -> where to find: XMGate backoffice / issued by XMGate manager
• Test Mode -> Corefy field test_mode
• Apple Pay Merchant ID -> optional, Corefy field applepay_merchant_id -> your merchant ID registered with Apple
• Apple Pay Display Name -> optional, Corefy field applepay_display_name -> the name shown to customers during the Apple Pay merchant validation handshake
• Apple Pay Merchant ID Certificate -> optional, Corefy field applepay_merchant_id_certificate -> upload the Apple-issued Payment Processing Certificate (.p12) — used only to authenticate Corefy's Apple Pay merchant-session validation call to Apple, not for decrypting the payment token (see Additional info)
• Apple Pay Merchant ID Certificate Password -> optional, Corefy field applepay_merchant_id_certificate_password -> the password protecting the .p12 file above
• Google Pay Gateway Merchant ID -> optional, Corefy field google_pay_gateway_merchant_id
• Google Pay Merchant ID -> optional, Corefy field google_pay_mid -> required if you want Google Pay to actually work — Google Pay initialization fails outright if this is left blank, even though the field itself is marked optional

For Provider account:

• Login -> Corefy field login
• Password -> Corefy field password
• Test Mode -> Corefy field test_mode
• API URL -> optional, Corefy field api_url -> overrides the default host

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "service": "payment_card_eur_hpp",
      "currency": "EUR",
      "amount": 100,
      "reference_id": "86e68af6-6b95-4cc0-be16-e4df8044604c"
    }
  }
}

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "service": "payment_card_eur_hpp",
      "currency": "EUR",
      "amount": 100,
      "customer": {
        "reference_id": "bc75bc54-5023-4f98-8c0d-ec5ed7e8f380",
        "name": "John Smith",
        "email": "johnsmith@gmail.com",
        "phone": "+15551234567",
        "address": {
          "country": "DE",
          "region": "Berlin",
          "city": "Berlin",
          "post_code": "10115",
          "full_address": "1st Street 1"
        }
      },
      "reference_id": "08f5e97c-1170-4bda-9625-3bde3c6dcd20"
    }
  }
}

{
  "data": {
    "type": "payout-invoice",
    "attributes": {
      "service": "payment_card_eur",
      "currency": "EUR",
      "amount": 100,
      "customer": {
        "reference_id": "55041b5b-adfd-4073-a92b-fd8b495a4cc1",
        "name": "John Smith"
      },
      "fields": {
        "card_number": "4111111111111111"
      },
      "reference_id": "86e68af6-6b95-4cc0-be16-e4df8044604c"
    }
  }
}

{
  "data": {
    "type": "payout-invoice",
    "attributes": {
      "service": "payment_card_eur",
      "currency": "EUR",
      "amount": 100,
      "customer": {
        "reference_id": "55041b5b-adfd-4073-a92b-fd8b495a4cc1",
        "name": "John Smith",
        "email": "johnsmith@gmail.com",
        "phone": "+15551234567",
        "address": {
          "country": "DE",
          "city": "Berlin",
          "full_address": "1st Street 1"
        }
      },
      "fields": {
        "card_number": "4111111111111111"
      },
      "reference_id": "08f5e97c-1170-4bda-9625-3bde3c6dcd20"
    }
  }
}

Additional info

1. Apple Pay setup — beyond the Dashboard fields above, Apple Pay requires real setup with Apple directly: an Apple Developer account, registering a Merchant ID with Apple, generating a Payment Processing Certificate (uploaded to Corefy as Apple Pay Merchant ID Certificate) and a separate Merchant ID Certificate (kept private, never shared with Corefy or XMGate), and verifying your domain with Apple. Talk to your Corefy account manager if you need help with this.

2. Apple Pay / Google Pay token handling — Corefy does not decrypt the wallet payment token itself; the encrypted token is forwarded as-is to XMGate's underlying Neolink infrastructure, which performs the decryption. Your uploaded Apple Pay certificate is used only for the separate Apple merchant-session validation handshake (proving to Apple that your domain/merchant ID is legitimate), not for token decryption.

   For more information, visit:

   • How to Integrate Apple Pay with Corefy: Full Technical Walkthrough
   • How to Integrate Google Pay with Corefy: Full Technical Walkthrough

3. Refunds are supported for H2H card payments — partial refunds are allowed, but only one refund per transaction (not multiple partial refunds against the same payment).

4. Tokenized recurring payments are supported via Corefy's standard tokenize-on-first-payment mechanism — no separate "Save Instant Token" toggle exists for this connector.

5. Callbacks are validated by source IP only — XMGate doesn't sign its callbacks, so Corefy checks that they originate from XMGate's known IP addresses instead.

FAQ / Troubleshooting

• Invalid credentials / auth error -> verify your Login/Password match the selected environment (test vs live) and account type
• Google Pay fails to initialize -> make sure Google Pay Merchant ID is set — Google Pay won't work with it left blank, even though the Dashboard field itself is optional
• Refund rejected after a previous refund -> XMGate only allows one refund per transaction; a second refund attempt on the same payment will fail
• Payment declined - invalid CVV -> Corefy's checkout requires CVV for this connector by default
• Payout rejected - invalid customer name -> customer.name must be exactly two Latin-alphabet words (first + last name) for payouts
• Not sure which account type to use? -> ask your Corefy account manager