Gateways
Peach Payments
Cards, Apple Pay/Google Pay, Capitec Pay, instant EFT, BNPL and more via Peach Payments Hosted Checkout.
On this page
Cards, Apple Pay/Google Pay, Capitec Pay, instant EFT, BNPL and more via Peach Payments Hosted Checkout.
At a glance#
| Type | peach |
| Countries | South Africa, Kenya, Mauritius |
| Currencies | ZAR, USD, KES, MUR, GBP, EUR |
| Capabilities | Hosted checkoutOn-demand status verification |
| Gateway docs | developer.peachpayments.com/docs/v2-checkout-hosted |
Checkout experience#
Redirect to Peach Payments Hosted Checkout V2 (redirectUrl from POST /v2/checkout). Your allowlisted origin must be registered in the Peach dashboard.
Configuration fields#
Enter these in the dashboard under Settings → Payment providers → Peach Payments. Secret fields are encrypted at rest and masked after saving; leave a secret blank when editing to keep the stored value.
| Field | Type | Notes |
|---|---|---|
| Entity IDrequired entityId | Text | Dashboard > Checkout > Credentials (use the sandbox entity when Sandbox is on). |
| Secret tokenrequired secretToken | Secret | Dashboard > Checkout > Credentials. Verifies the `signature` on webhooks. |
| Client IDrequired clientId | Text | Dashboard > Checkout > Credentials (OAuth client for the Checkout API). |
| Client secretrequired clientSecret | Secret | – |
| Merchant IDrequired merchantId | Text | Dashboard > Checkout > Credentials. |
| Allowlisted domain allowlistedOrigin | Text | Sent as Origin/Referer; must be allowlisted under Dashboard > Checkout > Allowlisted domains. Defaults to this app's URL. |
| Webhook signing secret (optional) webhookSigningSecret | Secret | Only if you enabled Dashboard > Webhook security > Enable webhook signing. Adds x-webhook-signature verification. |
| Webhook URL as configured in Peach webhookUrl | Text | Required with the signing secret: Peach signs the exact dashboard-configured URL. |
| Send cancel URL sendCancelUrl | Checkbox | Peach must enable cancelUrl on your account first (contact support). Default: |
Every provider also has Enabled, Sandbox / test mode and Default checkout method switches.
Notification URL#
https://app.centrapoint.co.za/api/webhooks/peach?provider={providerId}Copy the exact URL, with your provider ID filled in, from Settings → Payment providers.
- CentraPoint sends notificationUrl with each checkout.
- If you enable dashboard webhook signing, also configure this provider's notification URL in the Peach dashboard and enter the identical URL in the "webhookUrl" field, because Peach signs the exact configured URL.
How notifications are verified#
- Webhooks are form-urlencoded and carry a signature: HMAC-SHA256 over the sorted name/value pairs, keyed with your secret token.
- Optional dashboard webhook signing adds x-webhook-* headers, verified with the webhook signing secret.
- Every webhook is re-confirmed with GET /v2/checkout/{checkoutId}/status before it is reported as complete.
- The amount and currency must match the transaction before it can be marked complete.
Going live#
- Test with sandbox credentials and Sandbox / test mode on, and confirm the notification appears as processed in the Webhook log.
- Replace the credentials with live ones and switch off Sandbox / test mode.
- Update any URL or secret configured in the gateway's portal for the live environment.
- Make a small live payment and confirm it with the Transactions API.