CityPay

CityPay: An Overview For Merchants

CityPay is a payment provider that offers a secure payment gateway, hosted checkout, and related services for card-present, online, and MOTO transactions. The platform supports internet and telephone payments, recurring billing through continuous authority, and several alternative payment methods.

What CityPay Provides

CityPay delivers cloud-based services for multiple transaction channels, including internet, MOTO, and subscription payments using continuous authority. Its gateway routes transactions to major UK and European acquiring banks through API or hosted checkout integrations. The company also offers merchant accounts as a recognised ISO, plus optional solutions such as standalone terminals, EPOS, IVR payments, and cloud payments for non-POS contexts.

Payment Methods And Channels

Card Payments

CityPay’s gateway is designed for e-commerce, MOTO, and customer-present keyed transactions. It manages authorisation and supports preauthorisation, capture, refund, void, and verification operations. The API also provides 3-D Secure flows and risk checks, with support for 3DS version 2.2.

Digital Wallets And Alternatives

Merchants can enable Apple Pay and Google Pay through CityPay. The provider states it is an accredited Apple Pay and accredited Google Pay provider. CityPay also supports Visa Click to Pay and can integrate PayPal on request. These options are available through Paylink, CityPay’s hosted payment form, with additional setup steps as required for each method.

Recurring And Credential On File

CityPay supports subscriptions via recurring and continuous authority. Cardholder account tokens allow one or more cards to be stored against a shopper profile so that merchants can process cardholder-initiated and merchant-initiated transactions, including scheduled or unscheduled charges.

Integration Options

Hosted Form: Paylink

Paylink is CityPay’s hosted payment form. It handles the card payment process directly between the cardholder’s browser and CityPay’s servers and includes native 3-D Secure. The form is responsive, supports multiple data formats for token requests and notifications, provides webhook postbacks, allows custom fields, and supports credential-on-file and surcharging options. Paylink tokens can be delivered via URL, QR code, SMS, email, PDF, or HTTP redirect.

Direct Post

For merchants that need full control of their checkout presentation and can manage PCI controls, CityPay supports a Direct Post method. In this model, the merchant’s form posts card data directly to CityPay’s API, while the merchant is responsible for PCI DSS requirements associated with hosting the form. Direct Post can return authorisation results via HTTP 303 redirects and also supports tokenisation flows where a token is generated first and authorisation is completed subsequently.

Pay Button And Browser Extension

CityPay provides a JavaScript Pay Button that adds a ready-to-use payment trigger to a merchant’s page, using an asynchronous script. CityPay also offers a Browser Extension Service that fingerprints the browser to simplify 3DSv2 data collection and can optionally enrich risk checks by triggering 3DS Method Data when supported.

SDKs And Connectors

Developers can use official SDKs for Java, .NET, PHP, and Node. CityPay also documents a Zapier integration that can trigger workflows when Paylink tokens are created or transactions succeed or fail, and can perform actions like creating or cancelling Paylink tokens.

Shopping Cart And Back-Office Integrations

CityPay’s site references integrations built for WooCommerce, Magento, and OpenCart, as well as Xero for billing and reconciliation. These references indicate available connection patterns and prior work rather than prescribing a single integration approach.

Security And Compliance

PCI DSS

CityPay states it is a PCI Level 1 accredited service provider. Using Paylink, Virtual Terminal, cardholder accounts, and batch or scheduled services helps keep sensitive card data on CityPay infrastructure rather than on merchant systems. For merchants that store, process, or transmit card data, CityPay partners with Trustwave for PCI scans and related services. CityPay also publishes PCI guidance and FAQs to help merchants assess scope based on volume and channel.

3-D Secure And SCA

CityPay implements 3-D Secure v2.2 for browser-based flows, supporting frictionless and challenge scenarios, and aligns with SCA requirements for EU transactions. The documentation explains how ECI and CAVV values are returned and how liability shift is handled in frictionless or challenged outcomes. Test ranges and simulated 3DSv2 scenarios are available to validate implementations.

Technical Safeguards In Paylink

Paylink’s documentation describes secure deployment, including adherence to OWASP top-10 controls, HTTPS with strong encryption, CSP rules, form cache prevention, optional CSRF protections for postbacks, and auditing of user interactions on the payment form.

Reporting, Reconciliation, And Webhooks

CityPay exposes reporting APIs covering transaction, batch, and remittance data. Batches are typically generated daily, and remittance endpoints summarise disbursements with counts and amounts for sales and refunds. Webhooks can be configured to push real-time notifications for payment events to merchant endpoints, enabling automation and faster back-office updates.

Alternative Payment Experiences In The Cloud

Beyond the traditional gateway flows, CityPay’s Cloud Payments materials describe flexible customer journeys that still use the same core processing stack. Examples include PayByLink for email links to Paylink checkouts, QR codes that deep link to hosted payment forms, pay buttons embedded on web pages, and SMS Pay that sends a URL via text message. The Bill Payment Service allows merchants to raise invoices in their systems and associate them with a Paylink token so customers can pay by card, Apple Pay, or Google Pay.

Acquirer Connectivity And Coverage

CityPay lists several acquiring partners, including AIB Merchant Services, American Express, Barclaycard, Fiserv, Global Payments, Worldpay, emerchantpay, and Nuvei. Merchants should verify which acquirer relationships are available for their legal entity and business model. CityPay notes that its gateway securely routes payments with major UK and European banks.

Merchant Accounts And In-Person Options

As an ISO, CityPay offers merchant accounts alongside its gateway. The company references flexible pricing and support for multi-currency and multi-channel accounts. For in-person acceptance, CityPay provides standalone terminals that support contactless and chip and PIN, an EPOS system for in-store operations, and an IVR payments option for telephony-based flows.

Typical Use Cases

• Subscriptions and memberships using recurring or continuous authority.

• One-time e-commerce checkouts where a hosted form with 3DSv2 reduces build effort.

• Back-office or call center payments through a virtual terminal without shared physical terminals.

• Invoice journeys that send customers a PayByLink or QR code to a secure Paylink checkout.

• Retail and service businesses that combine the gateway with terminals or EPOS.

Conclusion

CityPay offers a payment gateway and adjacent services that cover online, phone, and in-person acceptance, with multiple ways to integrate. The Hosted Form reduces certification work by keeping sensitive data with CityPay and includes 3DSv2. Merchants that require complete control can use Direct Post, SDKs, and APIs for authorisation, capture, refunds, and tokenisation. Reporting and webhook endpoints support reconciliation and automation, while alternative methods like Apple Pay, Google Pay, Click to Pay, and PayPal extend customer choice. For acquiring and settlement, CityPay connects to several UK and European acquirers and can also provide merchant accounts. The breadth of documented features makes it possible to tailor an implementation around security posture, compliance requirements, and the mix of customer journeys you need to support.