Overview
Platforms that serve other businesses - CRMs, booking systems, marketplaces, agency tools, and vertical SaaS products - often need to offer payment acceptance to their customers without holding a payment institution licence themselves. HitPay’s Platforms model is designed for this, commonly referred to as a master–sub-merchant or aggregator model:- You (the platform) integrate HitPay once and create payments on behalf of your business customers.
- Your sub-merchants (your business customers) each hold their own HitPay account, complete their own verification, and receive payouts directly to their own bank account.
- HitPay holds the relevant payment institution licences (e.g. MAS in Singapore, BNM in Malaysia, BSP in the Philippines), performs KYB/KYC review, and processes the underlying payments.
Ways to integrate
There are two ways for your platform to get access to a sub-merchant’s account, plus an add-on that works with either.Option 1: Direct API key integration
The simplest approach: the sub-merchant generates their Merchant API key in their dashboard under Developers → API Keys and enters it into your platform’s UI. You store the key and call the HitPay API on their behalf using theX-BUSINESS-API-KEY header, exactly as documented in the API Reference.
This requires no platform setup at all - but it comes with real risk:
- The API key grants full access to the sub-merchant’s account, far more than most platform integrations need.
- You are storing a live, non-expiring secret for someone else’s business.
- If the sub-merchant also uses that key for their own integration, rotating it on either side silently breaks the other.
Option 2: OAuth - “Connect your HitPay account”
The structured alternative to collecting API keys. You build an OAuth app once, add a Connect your HitPay account button to your platform, and sub-merchants authorize it in a couple of clicks. Your platform receives its own access tokens, scoped to just the permissions you requested, and sub-merchants can revoke access from their dashboard at any time - no secrets change hands. See Connect Merchant Accounts (OAuth) for the full integration guide.OAuth apps are currently in beta. Tokens currently cover payments (payment requests, charges, refunds, subscription plans, and recurring billing), commerce (products, product categories, orders, and invoices), and customers. Other APIs — for example webhooks, virtual accounts, static QR, and terminals — still require a merchant API key. See OAuth scopes.
Add-on: Platform enablement
Independent of how you access sub-merchant accounts, you can have your own HitPay account enabled as a Platform account (contact [email protected]). This gives you a Platform Key (dashboard: Settings → Platform) which you pass as anX-PLATFORM-KEY header alongside either a merchant API key or an OAuth token. It unlocks two things:
- Commissions - earn a share of every payment you create for your sub-merchants, either as a platform-wide percentage Commission Rate or a fixed
platform_commission_amountper transaction. - Unified webhooks - charge events for all your sub-merchants’ payments are delivered to webhook endpoints registered on your platform account, so you monitor one webhook instead of one per sub-merchant.
Choosing a path
This page reflects the model as it exists today. HitPay’s Platforms program continues to evolve, and partner needs vary by market and merchant profile - where a use case goes beyond what’s described here, our Sales & Partnerships Team at [email protected] can advise on the best path forward.
FAQ
Do sub-merchants need their own payment institution licence?
Do sub-merchants need their own payment institution licence?
No. This is a core benefit of onboarding as a HitPay sub-merchant - HitPay is the licensed, regulated entity, and sub-merchants operate under HitPay’s compliance umbrella once verified.
Where do payouts go - to the platform or to the sub-merchant?
Where do payouts go - to the platform or to the sub-merchant?
Directly to each sub-merchant’s own bank account, following HitPay’s standard payout schedule. Funds are not pooled through the platform.
Can our platform create the HitPay account and complete verification for our sub-merchants, since we already collect their documents?
Can our platform create the HitPay account and complete verification for our sub-merchants, since we already collect their documents?
Today, each sub-merchant signs up and completes Business Verification directly with HitPay - this keeps KYB ownership clearly with HitPay and gives the sub-merchant direct visibility into their own account from day one. Many platforms streamline this by referring merchants straight into HitPay’s sign-up flow so the handoff feels seamless. If your program has specific onboarding requirements - including using documents you’ve already collected - our Sales & Partnerships Team at [email protected] can work with you to find the best approach for your markets and merchant profile.
Is there an API for submitting a sub-merchant's KYC/KYB documents to HitPay?
Is there an API for submitting a sub-merchant's KYC/KYB documents to HitPay?
Not yet as a standalone API - Business Verification is currently a dashboard flow completed by the sub-merchant. This is an area we’re happy to discuss further with platform partners who have high onboarding volume, so reach out to our Sales & Partnerships Team at [email protected] to explore what’s possible for your program.
Can commissions be set per sub-merchant or per transaction?
Can commissions be set per sub-merchant or per transaction?
Yes. A platform-wide percentage Commission Rate can be set, or overridden per transaction with
platform_commission_amount. See Platform Key.What if sub-merchants are outside Singapore, Malaysia, the Philippines, or Indonesia?
What if sub-merchants are outside Singapore, Malaysia, the Philippines, or Indonesia?
Card payments for merchants outside these markets are processed through Stripe Standard Connect, which the sub-merchant sets up directly with their own Stripe account. See Standard Connect Integration.