---
title: "Connect a payment provider"
description: "Connect Stripe, Square, Braintree, Authorize.net, or QuickBooks Payments so clients can pay your invoices online, and choose a provider per client."
url: "https://support.outpostplatform.com/client-payments/connect-a-provider/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "MSP plan. Client billing > Payments > Add a provider: processor, sandbox or production, keys, webhook secret, card and bank payments. QuickBooks connects by Intuit sign-in; cards need an SAQ A-EP acknowledgment. Stripe: turn the methods on in Stripe and use a restricted key with the listed permissions. Copy the webhook address into the processor, then Test. The first provider is primary."
availability:
  plans: ["msp"]
  permission: "psa:payments"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/client-payments/connect-a-provider.md"
license: "CC BY 4.0"
---

# Connect a payment provider

Connecting a payment provider puts a pay link in every invoice email and lets
clients pay in the client portal. This page shows how to connect each
processor, check that it works, and send one client to a different provider.

## Before you begin

- You need `psa:payments`.
- You need a merchant account with the processor, and access to its dashboard
  to copy keys and add a webhook. To try the flow first, use the processor's
  sandbox or test account and choose **Sandbox** below.
- Read [Client payments](/client-payments/) for what each processor supports
  and what it means for your PCI self-assessment.

## Add the provider

1. At the practice level, select **Client billing** > **Payments**.
2. Select **Add a provider**.
3. In **Processor**, choose the processor.
4. In **Name**, enter what the console calls it, such as `Main account`.
   Clients never see it.
5. Under **Environment**, choose **Production: real money** or **Sandbox: test
   cards and accounts only**. You cannot change this later. Add another
   provider to switch.
6. Under **Keys**, paste the keys from the processor's dashboard. They are
   stored encrypted and never shown again.

   | Processor | Keys |
   | --- | --- |
   | Stripe | **Secret key** (`sk_live_` or `sk_test_`; a restricted key works), **Publishable key**, **Webhook signing secret (whsec_)** |
   | Square | **Application ID**, **Access token**, **Location ID** (the location payments are taken at), **Webhook signature key**, and optionally **Public address of this Depot** |
   | Braintree | **Merchant ID**, **Public key**, **Private key**, and optionally **Merchant account ID** for an account other than the default |
   | Authorize.net | **API login ID**, **Transaction key**, **Signature key** |
   | QuickBooks Payments | **App client ID** and **App client secret** from your app on the Intuit developer portal, and optionally **Webhook verifier token** |

7. Under **What clients can pay with**, tick **Cards**, **Bank payments
   (ACH)**, or both.
8. Select **Add provider**.

The first provider you add becomes the primary provider, so new payments go
to it.

### Square's public address

Square signs the exact web address it sends updates to. If clients reach your
Depot at an address other than the one the server knows itself by, enter that
address, such as `https://depot.example.com`, in **Public address of this
Depot**. Leave it blank otherwise.

### Stripe's payment methods and restricted keys

Stripe decides which payment methods it accepts from its own settings, not
from Outpost. In the Stripe dashboard, select **Settings** > **Payment
methods** and turn on **Cards**, **ACH Direct Debit**, or both, to match what
you tick under **What clients can pay with**. Stripe refuses a payment by a
method that is turned off there.

If you use a restricted key, give it these permissions:

| Resource | Permission |
| --- | --- |
| Customers | Write |
| PaymentIntents | Write |
| SetupIntents | Write |
| PaymentMethods | Write |
| Refunds | Write |
| Confirmation tokens | Read |
| Mandates | Read |
| Disputes | Read |

**Test** checks only that Stripe accepts the key, so a key that is missing
one of these permissions still passes **Test**, and the first payment that
needs the permission fails.

### Connect QuickBooks Payments

QuickBooks Payments connects by signing in to Intuit rather than by keys
alone.

1. In your app on the Intuit developer portal, add this redirect URI:
   `https://<your-address>/api/v1/psa/payment-providers/oauth/callback`,
   where `<your-address>` is the address you sign in to the console at.
2. Add the provider as above.
3. On the provider's row, select **Connect**, sign in to QuickBooks, and allow
   access. You return to **Payments**, which says the processor accepted the
   sign-in, and the row shows **Signed in**.

Outpost renews the sign-in on its own. If it lapses, select **Reconnect**.

Cards stay off for a QuickBooks provider until you acknowledge SAQ A-EP. When
you tick **Cards**, the dialog shows **QuickBooks card entry is SAQ A-EP**.
Tick **I understand, and my practice will complete SAQ A-EP** to save it.
Bank payments are not affected.

## Send payment updates to Outpost

Each provider's row shows a **Webhook address**. The processor calls it when a
payment succeeds, fails, is refunded, or is disputed, and when a saved method
changes.

1. On the provider's row, select **Copy** beside **Webhook address**.
2. In the processor's dashboard, add a webhook endpoint (Square calls it a
   webhook subscription) that sends to that address, with its payment, refund,
   and dispute events.
3. Copy the signing secret the processor shows for that endpoint into the
   provider's webhook field: select **Change**, paste it, and select **Save**.
   Braintree signs with your keys and needs no separate secret.

Until the secret is stored, the row says **No webhook secret is stored, so
this processor's payment updates are refused.** Outpost checks every update's
signature before it records anything, and treats an update only as a reason
to ask the processor for the payment's current state. Outpost also asks the
processor on its own about any payment still unconfirmed after 15 minutes, so
a missed update delays a payment's status rather than losing it. QuickBooks
Payments sends no payment updates, so Outpost asks Intuit for each payment's
status on that schedule instead.

## Test the provider

1. On the provider's row, select **Test**.
2. **Payments** shows that the processor accepted the keys, or the reason it
   refused them.

To test a full payment, use a **Sandbox** provider, finalize an invoice for a
test client whose billing contact is your own address, and pay it from the
pay link with one of the processor's test cards.

## Send a client to another provider

New payments go to the primary provider unless a client's billing profile
names another.

1. In the client's workspace, select **Client billing** > **Billing profile**.
2. In the **Online payments** card, under **Where this client pays**, choose
   the provider, or **Use the primary**.
3. Select **Save provider**.

Methods the client has already saved keep charging through the provider they
were saved on.

## Change keys

Select **Change** on the provider's row. Stored keys are never shown. Leave a
box blank to keep that key, or type a new one to replace it. For a signed-in
QuickBooks provider, **Disconnect from QuickBooks** drops the sign-in. Type
the app keys again to keep them, then select **Connect** before it can take
payments again.

## Verify

- The provider shows **Primary**, or **Active** for a second provider, and no
  webhook warning.
- The next invoice email for a client carries a pay link, and the client's
  **Online payments** card under **Billing profile** names the provider.

## Next steps

- [Send pay links and charge saved methods](/client-payments/pay-links/)
- [Set up autopay for a client](/client-payments/autopay/)
- [Switch payment providers](/client-payments/switch-providers/)