API & Integrations

One set of credentials connects Scan & Pay to your store, plugin or custom checkout. Generate them once in the Business Portal, then choose the integration path that suits your stack.

Overview

Scan & Pay accepts PayTo PayID — Australia’s instant account-to-account payment standard — at a flat $0.90 per transaction. The checkout displays a QR Pass and reports its payment status.

Buy now with PayTo PayID. QR code-based instant PayTo PayID verification at checkout.

How it works

  1. 1

    Generate credentials

    Open Settings → Integrations in the Business Portal. You’ll receive a Merchant ID, an API Secret and a Webhook Secret — one set that works for every integration path.

  2. 2

    Create a payment session

    Your server calls https://api.scanandpay.com.au with the order amount and receives a payment session with a QR Pass to display at checkout.

  3. 3

    Verify the webhook

    When the customer pays, Scan & Pay sends a signed event to your endpoint. Verify the X-Scanpay-Signature header with your Webhook Secret, then mark the order as paid.

Integration paths

Available

WooCommerce plugin

A WordPress plugin for WooCommerce stores. Install it, paste your credentials and start taking payments. Use the plugin to add Scan & Pay to WooCommerce.

Download from WordPress.orgSetup walkthrough →
Available

Official SDKs

Libraries for Node.js and PHP that handle session creation, webhook signature checks and retries for you. The Node.js package also includes a ready-made React checkout component.

Node.js SDK →PHP SDK →
Available

REST API

Build directly on https://api.scanandpay.com.au. Use the API to add QR Pass to your checkout. Create a session, check its status and receive a signed webhook.

API reference →Create a payment →OpenAPI spec

Get your credentials

  1. 1Sign in to the Business Portal.
  2. 2Open Settings → Integrations to view your credentials.
  3. 3Copy Merchant ID, API Base URL, API Secret, and Webhook Secret.
  4. 4Paste them into the WooCommerce plugin, the drop-in package, or your custom backend.

Treat your secrets like passwords. Regenerate them only if they may have been exposed — every connected integration stops working until it has the new pair.