CentraPoint

Gateways

PayFast

South African cards, Instant EFT, SnapScan, Zapper and recurring subscriptions.

On this page

South African cards, Instant EFT, SnapScan, Zapper and recurring subscriptions.

At a glance#

PayFast summary
Typepayfast
CountriesSouth Africa
CurrenciesZAR
CapabilitiesHosted checkoutRecurring (gateway subscriptions)
Gateway docsdevelopers.payfast.co.za/docs

Checkout experience#

Auto-submitted HTML form POST to PayFast's hosted payment page (sandbox.payfast.co.za when Sandbox is on, www.payfast.co.za when live).

This gateway does not support on-demand status queries, so the final status arrives only through the gateway's notification.

Configuration fields#

Enter these in the dashboard under Settings → Payment providers → PayFast. Secret fields are encrypted at rest and masked after saving; leave a secret blank when editing to keep the stored value.

PayFast configuration fields
FieldTypeNotes
Merchant IDrequired
merchantId
Text–
Merchant keyrequired
merchantKey
Secret–
Passphrase
passphrase
Secret

Must match Settings > Integration in PayFast

Confirm ITNs with PayFast server
validateWithServer
Checkbox

Default: true

Only accept ITNs from PayFast IPs
verifySourceIp
Checkbox

Default: false

Every provider also has Enabled, Sandbox / test mode and Default checkout method switches.

Notification URL#

Notification URL
https://app.centrapoint.co.za/api/webhooks/payfast?provider={providerId}

Copy the exact URL, with your provider ID filled in, from Settings → Payment providers.

  • No portal setup is required: CentraPoint sends notify_url with every checkout.
  • Set the same passphrase in PayFast (Settings → Integration) and in the CentraPoint provider settings. A mismatch makes every ITN fail signature validation.

How notifications are verified#

  • ITN body is received as raw application/x-www-form-urlencoded and the MD5 signature (including your passphrase) is checked over the exact bytes.
  • Optional: the source IP is checked against PayFast's published hosts ("Only accept ITNs from PayFast IPs").
  • Server confirmation: the ITN is posted back to PayFast, which must reply VALID ("Confirm ITNs with PayFast server", on by default).
  • The merchant_id in the ITN must match the configured Merchant ID, and amount_gross must match the transaction amount.
  • The amount and currency must match the transaction before it can be marked complete.

Going live#

  1. Test with sandbox credentials and Sandbox / test mode on, and confirm the notification appears as processed in the Webhook log.
  2. Replace the credentials with live ones and switch off Sandbox / test mode.
  3. Update any URL or secret configured in the gateway's portal for the live environment.
  4. Make a small live payment and confirm it with the Transactions API.