Connect a payment provider

Connecting a payment provider puts a pay link in every invoice email and lets clients pay in the client portal. This page shows how to connect each processor, check that it works, and send one client to a different provider.

Before you begin

• You need psa:payments.
• You need a merchant account with the processor, and access to its dashboard to copy keys and add a webhook. To try the flow first, use the processor’s sandbox or test account and choose Sandbox below.
• Read Client payments for what each processor supports and what it means for your PCI self-assessment.

Add the provider

1. At the practice level, select Client billing > Payments.

2. Select Add a provider.

3. In Processor, choose the processor.

4. In Name, enter what the console calls it, such as Main account. Clients never see it.

5. Under Environment, choose Production: real money or Sandbox: test cards and accounts only. You cannot change this later. Add another provider to switch.

6. Under Keys, paste the keys from the processor’s dashboard. They are stored encrypted and never shown again.

   Processor	Keys
   Stripe	Secret key (sk_live_ or sk_test_; a restricted key works), Publishable key, Webhook signing secret (whsec_)
   Square	Application ID, Access token, Location ID (the location payments are taken at), Webhook signature key, and optionally Public address of this Depot
   Braintree	Merchant ID, Public key, Private key, and optionally Merchant account ID for an account other than the default
   Authorize.net	API login ID, Transaction key, Signature key
   QuickBooks Payments	App client ID and App client secret from your app on the Intuit developer portal, and optionally Webhook verifier token

7. Under What clients can pay with, tick Cards, Bank payments (ACH), or both.

8. Select Add provider.

The first provider you add becomes the primary provider, so new payments go to it.

Square’s public address

Square signs the exact web address it sends updates to. If clients reach your Depot at an address other than the one the server knows itself by, enter that address, such as https://depot.example.com, in Public address of this Depot. Leave it blank otherwise.

Stripe’s payment methods and restricted keys

Stripe decides which payment methods it accepts from its own settings, not from Outpost. In the Stripe dashboard, select Settings > Payment methods and turn on Cards, ACH Direct Debit, or both, to match what you tick under What clients can pay with. Stripe refuses a payment by a method that is turned off there.

If you use a restricted key, give it these permissions:

Resource	Permission
Customers	Write
PaymentIntents	Write
SetupIntents	Write
PaymentMethods	Write
Refunds	Write
Confirmation tokens	Read
Mandates	Read
Disputes	Read

Test checks only that Stripe accepts the key, so a key that is missing one of these permissions still passes Test, and the first payment that needs the permission fails.

Connect QuickBooks Payments

QuickBooks Payments connects by signing in to Intuit rather than by keys alone.

1. In your app on the Intuit developer portal, add this redirect URI: https://<your-address>/api/v1/psa/payment-providers/oauth/callback, where <your-address> is the address you sign in to the console at.
2. Add the provider as above.
3. On the provider’s row, select Connect, sign in to QuickBooks, and allow access. You return to Payments, which says the processor accepted the sign-in, and the row shows Signed in.

Outpost renews the sign-in on its own. If it lapses, select Reconnect.

Cards stay off for a QuickBooks provider until you acknowledge SAQ A-EP. When you tick Cards, the dialog shows QuickBooks card entry is SAQ A-EP. Tick I understand, and my practice will complete SAQ A-EP to save it. Bank payments are not affected.

Send payment updates to Outpost

Each provider’s row shows a Webhook address. The processor calls it when a payment succeeds, fails, is refunded, or is disputed, and when a saved method changes.

1. On the provider’s row, select Copy beside Webhook address.
2. In the processor’s dashboard, add a webhook endpoint (Square calls it a webhook subscription) that sends to that address, with its payment, refund, and dispute events.
3. Copy the signing secret the processor shows for that endpoint into the provider’s webhook field: select Change, paste it, and select Save. Braintree signs with your keys and needs no separate secret.

Until the secret is stored, the row says No webhook secret is stored, so this processor’s payment updates are refused. Outpost checks every update’s signature before it records anything, and treats an update only as a reason to ask the processor for the payment’s current state. Outpost also asks the processor on its own about any payment still unconfirmed after 15 minutes, so a missed update delays a payment’s status rather than losing it. QuickBooks Payments sends no payment updates, so Outpost asks Intuit for each payment’s status on that schedule instead.

Test the provider

1. On the provider’s row, select Test.
2. Payments shows that the processor accepted the keys, or the reason it refused them.

To test a full payment, use a Sandbox provider, finalize an invoice for a test client whose billing contact is your own address, and pay it from the pay link with one of the processor’s test cards.

Send a client to another provider

New payments go to the primary provider unless a client’s billing profile names another.

1. In the client’s workspace, select Client billing > Billing profile.
2. In the Online payments card, under Where this client pays, choose the provider, or Use the primary.
3. Select Save provider.

Methods the client has already saved keep charging through the provider they were saved on.

Change keys

Select Change on the provider’s row. Stored keys are never shown. Leave a box blank to keep that key, or type a new one to replace it. For a signed-in QuickBooks provider, Disconnect from QuickBooks drops the sign-in. Type the app keys again to keep them, then select Connect before it can take payments again.

Verify

• The provider shows Primary, or Active for a second provider, and no webhook warning.
• The next invoice email for a client carries a pay link, and the client’s Online payments card under Billing profile names the provider.

Next steps

• Send pay links and charge saved methods
• Set up autopay for a client
• Switch payment providers