--- title: Connecting a payment gateway description: Connect Stripe, choose test or live keys, set the payment experience, and verify everything with test cards before real money moves. domain: payment status: shipped visibility: public last_verified: 2026-08-14 order: 10 --- A payment gateway is what actually charges your customers' cards. yRecurring never sees or stores card numbers; the gateway does. So before anything can be collected online, you connect your own gateway account under Settings, on the Payment gateways page. Stripe, Paystack, PayPal, GoCardless, Authorize.Net, Adyen, Flutterwave and Braintree are connectable today. Each gateway has its own page in the [payment gateways chapter](/guide/payment-gateways) covering its currencies, credentials, webhooks, test cards and limits; this page covers what every connection shares. Stripe collects cards and wallets globally, with a choice of embedded or hosted payment experience. Paystack collects cards in Nigerian Naira, Ghanaian Cedi, South African Rand, Kenyan Shilling and US Dollars, embedded (in-page popup) or hosted. PayPal collects from the customer's PayPal wallet, embedded (PayPal buttons) or hosted. GoCardless collects bank debits (Bacs, SEPA and ACH), embedded (in-page overlay) or hosted; bank debits settle over a few banking days, so the invoice shows the payment in flight until the bank confirms it. Authorize.Net collects US card payments (hosted only). Adyen collects cards globally, with a choice of embedded or hosted payment experience. Flutterwave collects cards and mobile money across Africa and beyond (hosted only). With every gateway, the instrument used is saved for renewals when it can be: card-update pages fall back to a setup-capable gateway automatically, and non-tokenizable instruments (mobile money) renew by invoice link instead. ## Test and live are separate connections Each gateway has two independent configurations, side by side on its page: - **Test mode** holds your test keys. Charges go to the gateway's sandbox; no real card is ever charged. - **Live mode** holds your live keys and charges real cards. Which one is actually used is your organization's **payment mode**: the Test/Live switch at the top of the gateways page. Connect test first, walk the whole flow with test cards, then connect live and flip the switch when you're ready. While your organization is still in its trial sandbox, Live is locked until you go live. The built-in yRecurring test gateway is part of that trial sandbox, and it stays there: once your organization goes live it disappears as a payment option everywhere, cannot be saved as a gateway, and will never touch a real order, even if it was connected while you were trialing. Real collection always goes through a payment provider you connected. ## The connect wizard Click **Connect test mode** (or live) on a gateway's page and a short wizard walks you through it, one thing at a time. It starts by listing exactly what you'll need, then asks for each API key on its own screen with directions to where it lives in your gateway's dashboard. For Stripe that's the secret key and the publishable key. For Adyen, live mode additionally asks for your account's live URL prefix, because Adyen gives every account its own live endpoint. Along the way you pick how customers pay (on your pages, or on the gateway's own page), and the final screen offers a **Test connection** check that verifies your keys against the gateway before anything is saved. You cannot finish the wizard with a required key missing, and nothing is stored until the last step succeeds. Keys are encrypted at rest and never shown again. Running the wizard again later updates them: any step you leave blank keeps its stored value, so rotating one key never means re-typing the others. **Webhooks come after connecting.** Once connected, the gateway page turns into a setup checklist. Anything still missing shows as the next step, and for most gateways that is webhooks: a guided page explains why they matter, gives you the endpoint URL to add in the gateway's dashboard, and takes the credential the endpoint issues (Stripe's signing secret, Adyen's HMAC key, PayPal's webhook ID). The checklist marks webhooks done once that credential is saved. For gateways that can only confirm payments through webhooks (GoCardless, Adyen, PayPal, Authorize.Net, Flutterwave), charging stays off until then, because collecting money whose confirmation could never arrive helps nobody. ## Disconnecting Each mode can be disconnected from its card's Settings section. Disconnecting deletes the stored keys, stops that mode from charging, and its webhook URL stops accepting events. Your account with the gateway itself is untouched, and you can reconnect anytime by running the wizard again. Two things to know: cards saved through that gateway pause until you reconnect it, and if any currency routes still point at the gateway you will be asked to delete those routes first. ## The webhook endpoint Once a configuration is saved, its page shows a **webhook endpoint URL** to add in your gateway's dashboard. The gateway posts payment outcomes there. That's how a charge that finishes away from your page (a 3D Secure check, a bank rail that settles later, a refund, a dispute) lands on the right invoice. Every event is verified against the webhook credential before anything is trusted. For Adyen the webhook is not optional: payments made on Adyen's page reach yRecurring only through it, so set it up (with its HMAC key) as part of connecting. ## Payment experience Per configuration, choose how customers pay on your checkout and invoice pages: - **Hosted**: customers are redirected to the gateway's own payment page and return when done. - **Embedded**: the card form appears directly on your page, served by the gateway. Card data still never touches yRecurring. ## Routing currencies between gateways With two or more gateways connected, a routing card appears on the gateways page. Each rule sends one currency's payments to a specific gateway (say, NGN to Paystack and USD to Stripe); currencies without a rule use your default gateway. Rules are checked when you save them, so you can't route a currency to a gateway that can't collect it. Cards already on file keep charging through the gateway that saved them. ## Test cards In test mode, the gateway page lists sandbox cards for every outcome: success, decline, insufficient funds, 3D Secure. Use them to run a real end-to-end rehearsal. Sign up through your checkout, watch the invoice get paid, fail a payment on purpose and watch [dunning](/guide/dunning/how-dunning-works) pick it up. ## What gets charged Online payments are card payments (Stripe, Paystack, Authorize.Net, Adyen, Flutterwave), the customer's PayPal wallet (PayPal), bank debits (GoCardless), or mobile money (Flutterwave: M-Pesa, MTN Mobile Money and more). Apple Pay and Google Pay work on Stripe once you register your checkout domain with your Stripe account, which is one press on the Stripe gateway page (see [Stripe](/guide/payment-gateways/stripe)); Stripe's Link shows up in that setup status because Stripe reports it, but yRecurring does not show a Link button yet. Mobile money is its own payment method on the ledger, so refunds and reporting show what was actually used; mobile wallets can't be saved for automatic renewals, so those customers pay each invoice from its payment link. ## Saving a card without charging it Two places capture a payment method with no charge: the customer's "update my card" page, and signup for a trial or future-dated subscription. Most gateways offer a secure zero-charge page for this (Stripe, PayPal, GoCardless, Authorize.Net, Adyen). Paystack doesn't, so when Paystack is your default gateway and another connected gateway supports it, the card is saved through that gateway instead; future renewals charge whichever gateway holds the card. If no connected gateway supports it, the update page explains that paying the next invoice saves the card automatically. One note on disputes: chargebacks raised at Stripe, PayPal, GoCardless, Paystack, Adyen and Flutterwave appear on the payment's activity trail automatically. Authorize.Net doesn't send chargeback notifications to any system, so disputes there are managed in the Authorize.Net portal. A few per-gateway operational notes. Authorize.Net needs the Transaction Details API enabled on the account (Account → Settings → Security Settings, and the connection test tells you if it isn't), and its webhook Signature Key is required. Adyen accounts must use immediate capture (the default), and for dispute closure events enable "Include the originalReference for CHARGEBACK_REVERSED events" on the webhook; embedded payments also need your checkout domain registered under the client key's allowed origins. Flutterwave refund webhooks are off by default, so ask Flutterwave support to enable them and refunds will finalize automatically. ## Seeing what happened The gateway page shows recent activity: every charge step, its outcome, latency, and the gateway's reference. Settings, under Incoming webhooks, shows every event the gateway delivered and what it did. Secrets never appear in either.