Skip to main content

Server-to-Server

Looking for a simpler integration?

With Checkout Page, we handle everything for you — Google Pay configuration, gateway identifiers, tokenization settings, and frontend button rendering — all through the hosted checkout. No Google Pay API integration required on your side. See Checkout Page (Google Pay) in Optional Services.

PCI DSS compliance required

With the Server-to-Server integration, your systems decrypt the Google Pay payment token and handle cardholder data before sending it to OneAPI. You must be fully PCI DSS compliant.

The merchant handles all Google Pay configuration independently and sends the decrypted card data to OneAPI for payment processing.

Merchant Responsibilities​

The following are managed entirely by the merchant and are out of scope of OneAPI:

  • Google Pay Business account registration and configuration
  • Google Pay API frontend integration (rendering the Google Pay button, handling the payment sheet)
  • Receiving and decrypting the Google Pay payment token
  • Completing the Google Pay integration checklist for production

For details on these steps, refer to the official Google Pay developer documentation.

What OneAPI Handles​

Once the merchant has decrypted the Google Pay token and extracted the card data, OneAPI is responsible for:

  • Processing the payment request with the decrypted card data
  • Handling 3DS authentication when required (PAN_ONLY authorization method)
  • Returning the transaction result
  • Sending postback notifications with the final payment status

Prerequisites​

Before integrating Google Pay using the Server-to-Server integration, the merchant must complete the following steps:

  1. Sign up with Google — Create a Google Pay account and agree to Google Pay's Terms of Service.
  2. Configure the Google Pay Business Console — In the Google Pay Business Console, provide the required configuration for your payment gateway and register the domains from which you intend to call the Google Pay API. This is where you obtain your Google Pay merchantId.
  3. Complete onboarding with our platform — Contact us to complete the onboarding process. You will receive your gatewayMerchantId, which is the merchant-specific identifier issued by our platform for Google Pay processing.
  4. Fulfill the Google Pay integration checklist — Before going to production, complete the relevant integration checklist:

For detailed step-by-step instructions on completing the prerequisites above, see the Merchant Onboarding Guide.

info

The gateway value in the tokenizationSpecification is a fixed identifier assigned to our platform by Google Pay — it is not something the merchant needs to obtain or configure. It will be provided to you during onboarding.

These values are used in the tokenizationSpecification when configuring Google Pay on your frontend:

{
  "type": "PAYMENT_GATEWAY",
  "parameters": {
    "gateway": "provided_by_platform",
    "gatewayMerchantId": "your_gateway_merchant_id"
  }
}
Payment workflow

For the full sequence diagram, see Payment workflow on the Google Pay overview.

PCI DSS compliance

This flow requires full PCI DSS compliance on your side, because decrypted card data passes through your systems before reaching OneAPI.

The merchant sends the decrypted card data to OneAPI via the Payment API. There are three possible flows depending on whether a wallet cryptogram or merchant-side 3DS results are available.

Payment flows​

Choose the payment flow that matches your decrypted Google Pay token:

Create a payment with wallet cryptogram (no 3DS required)

Pass the cryptogram from the decrypted Google Pay token (CRYPTOGRAM_3DS). No additional 3DS authentication is required.
View guide

Create a payment without wallet cryptogram — with MPI (direct)

Pass your own MPI 3DS results for PAN_ONLY tokens. The gateway skips its 3DS flow and returns a direct response.
View guide

Create a payment without wallet cryptogram — without MPI (3DS required)

Omit cryptogram and MPI fields for PAN_ONLY. The gateway performs 3DS and returns a pending client_action.
View guide

Compliance and Branding​

Merchants using Google Pay must comply with:

Last updated on