SaaS · API-first · no installer
topropay's payment gateway software runs in the cloud — API and SDKs on the merchant side, PCI DSS Level 1 vault and multi-acquirer routing on the platform side. No installer to download, no self-hosting to maintain, no scheme-rule upgrades to ship.
Key benefits
Four properties that show up the moment a merchant compares shipping a bespoke gateway against integrating a SaaS one.
topropay ships as a hosted SaaS gateway. Merchants integrate against a stable REST API and pinned SDK versions; scheme-rule changes, 3DS updates and per-acquirer message-format tweaks land server-side without a code push on the merchant.
There is no gateway installer to download. The 'software' side is the platform SDKs (web, iOS, Android, server-side languages) and the REST API. Sandbox credentials are issued per-merchant; production credentials follow KYB.
The routing engine is part of the software — not a bolt-on. Per-BIN, per-currency and per-country scoring picks the best connected acquirer for each authorisation, and cascades soft declines inside the same authorisation.
PCI DSS Level 1 vault plus one reconciliation feed sit at the heart of the software. Settlements, refunds, chargebacks and interchange from every connected acquirer normalise into one ledger the merchant reads once.
How the payment gateway software provider role runs underneath
What actually happens between the merchant record being provisioned in the dashboard and the first row landing in the reconciliation feed.
The dashboard issues sandbox API keys the moment the merchant record is created; KYB unlocks production keys. No install step on the merchant side.
Pick hosted checkout, embedded hosted fields or the low-level SDK depending on the merchant's PCI and UI constraints. The back-end contract is identical.
Underwriting activates one or more connected acquirers per geography and vertical. The routing policy is set from the dashboard — no code change to swap providers.
Each authorisation runs through the ranked provider, cascades on soft decline, tokenises into the vault, and returns a stable receipt event to the merchant.
Settlement files from every connected acquirer normalise into one ledger; daily exports as CSV or via API; per-provider fee attribution surfaced for finance.
Main use cases
Six recurring shapes that reach for a SaaS gateway rather than build one — SaaS merchants, PSPs, enterprise migrations, marketplaces, vertical SaaS and B2B billing.
The gateway software drops into an existing SaaS product — one integration exposes card, wallet, bank rail and BNPL as a menu of methods the SaaS's own customers see.
Payment service providers use topropay as their gateway back-end; they resell it under their own brand to downstream merchants with per-merchant routing policies.
Merchants migrating away from a single-acquirer legacy gateway swap it out with the software here; parallel-running during the cutover measures approval and cost per acquirer before absorbing volume.
Different sellers on the same platform can land on different connected acquirers based on risk profile and volume; the software handles the routing while reconciliation rolls up per seller.
Vertical SaaS (fitness studios, salons, invoicing tools, event ticketing) embed the gateway software and inherit compliance posture instead of running their own PCI programme.
Accounting and ERP tools embed the gateway software to add card and ACH pay-now on invoices; the vault tokens survive re-issuance and drive recurring on renewal.
Platform features
Twelve capabilities grouped by build phase — integration surfaces, routing & compliance, operations & finance. Each applies whether the merchant integrates the hosted checkout, the embedded fields or the low-level SDK.
One JSON-over-HTTPS contract covers authorise, capture, refund, void, dispute lookup, settlement lookup and webhook management.
Idiomatic SDKs per stack, pinned versions and backwards-compatible upgrades on major bumps.
Three surface shapes share the same back-end; picked per merchant's PCI scope preference.
Replay-safe event IDs, HMAC signatures, retry-with-backoff and per-endpoint delivery logs.
Per-transaction scoring on BIN, scheme, currency, country pair and risk across the connected panel.
Soft declines cascade to the next ranked provider inside the same authorisation.
Card data never lands on the merchant's origin; vault tokens drive refunds, retries and recurring.
Selective challenges per PSD2 exemption logic; frictionless passes through; step-up where required.
One queue across every connected acquirer; evidence-pack templates per vertical.
Settlements, fees, refunds and chargebacks normalised across every connected provider into one ledger.
Live authorisation feed, per-BIN approval rates, operator refund controls with audit log.
Push receipts into popular accounting systems (Xero, QuickBooks, NetSuite, Sage) via signed events.
Industry relevance
The gateway software targets licensed merchants and PSPs operating across Europe, the UK, APAC and LATAM — SaaS embedding acceptance, PSPs reselling the platform, enterprise merchants migrating from legacy single-acquirer gateways, and marketplaces routing per seller. Verticals bound to specific operating licences (gaming, regulated financial services) are supported only where those licences exist.
Trust & compliance
One audited environment underpins the software. Sub-merchants inherit the posture across every connected acquirer without carrying separate certifications themselves.
Ready to integrate
A 30-minute technical review covers your stack, the connected acquirers relevant to your geographies, the SDK path that fits your PCI posture, and a sandbox to build against before any commercial commitment.
Frequently asked
Definitions, the software-download disambiguation, SDKs, self-hosting, white-labelling and the practicalities of running SaaS gateway software instead of a bespoke build.
Payment gateway software on topropay means the platform's SaaS-delivered gateway — REST API, SDKs (web, iOS, Android, server-side), operator dashboard and routing engine. It's software the merchant integrates against, not software the merchant installs on their own servers. Updates ship server-side; the merchant tracks stable API versions and pinned SDK versions.
There is no payment gateway software download for on-premise deployment. The gateway is a cloud-hosted SaaS product. Merchants integrate against SDK packages (available via npm, pip, RubyGems, Composer, Maven, CocoaPods and Gradle) plus the REST API — those install into the merchant's app, but the gateway logic itself runs in the platform's PCI DSS Level 1 environment.
Payment gateway software development on topropay is delivered as a managed SaaS platform, not as bespoke development for third parties. Merchants and PSPs integrate against topropay's API; if the customer needs bespoke code around it (custom checkout, connector to an unusual back-office system) that development is either the customer's own engineering work or handled by an implementation-partner consultancy — not something topropay ships as a service.
A payment gateway software development company in the classical sense builds bespoke gateways for individual clients on a project basis. topropay operates a different model — a productised, cloud-hosted gateway software platform that many merchants and PSPs share, with per-merchant routing policies and per-merchant branding. Merchants get the benefits of a full gateway build without a bespoke development project.
topropay is the payment gateway software provider. The connected acquirers hold the acquiring licences and clear the underlying card transactions; topropay is the gateway software that sits in front of them, exposing one API to the merchant, tokenising in the vault, routing across the panel and reconciling the settlements.
The best payment gateway software for any given merchant depends on the merchant's method mix, geographies, dispute posture and existing tech stack. Rather than picking a single gateway, topropay's approach exposes many connected acquirers behind one gateway software integration, so the merchant doesn't have to gamble on which single provider will perform best — the routing engine picks per authorisation.
Online payment gateway software historically meant a single-acquirer connection with basic tokenisation. Modern online payment gateway software — like topropay's — adds multi-acquirer routing, cascading, network tokens (VTS, MDES), a unified dispute queue and one reconciliation feed. The merchant integrates once and gets the whole panel, not a single point connection.
The gateway software ships SDKs for JavaScript (browser and Node), TypeScript, PHP, Python, Ruby, Go, Java, .NET, iOS (Swift) and Android (Kotlin). All SDKs speak the same REST API underneath. Sandbox parity is full — every capability exposed in production is also available in sandbox.
Yes. PSPs and resellers can white-label the operator dashboard and hosted checkout with their own brand — colours, logo, favicon, domain (via CNAME). The API endpoints stay on topropay's infrastructure; the buyer never sees topropay's brand unless the PSP chooses to surface it.
Payment gateway software pricing on topropay is per-transaction (interchange-plus for card, fixed-plus for bank rail and wallet), with no per-seat or per-SDK licence fee. Volume tiers and per-vertical adjustments are quoted after underwriting. There's no upfront licence fee because there's no on-prem software to license.
Most merchants integrate the software in 1–4 weeks. The variables are the merchant's PCI scope choice (hosted checkout is fastest at SAQ A, low-level SDK gives more control but takes longer), the languages in the merchant's stack and any scheme-programme registrations the connected acquirers need to file.
The software supports licensed high-risk verticals (subscription, travel, ticketing, licensed gaming, nutraceuticals) through the same routing engine and connected acquiring panel. Grey and black-market verticals — adult content, unlicensed gambling, illegal goods — are out of scope regardless of software configuration.
Scheme-rule changes land server-side inside the gateway software. Merchants don't ship code to keep up with EMV 3DS2 spec bumps, new Visa or Mastercard scheme rules, or per-acquirer message-format tweaks — topropay's platform absorbs those and the merchant's API contract stays stable.
Self-hosting or running the software in the merchant's own cloud account isn't a supported deployment shape. The gateway software's PCI L1 posture depends on the platform's audited environment; putting it in another account would fork the PCI scope and break the inheritance model. Merchants who need very tight data residency can request per-region-hosted variants where the platform supports them.
Sandbox access is free — merchants can build against the full API from day one with test credentials. Production pricing kicks in on the first live authorisation, per the merchant's contract.
Related