Skip links
Online Payment


Merchant-Hosted offers an easy and convenient payment user experience without being redirected from the merchant’s page while ensuring a high level of security with prior card enrollment and cardholder identity verification before first use. After the card is enrolled, subsequent payment experiences will be a “one-click” experience, without the need to enter any card information or SMS code.


Acquirer: UPay E-Commerce License

Merchant: PCI-DSS certification


Merchants with an account architecture

Card-on-file scenarios of UPI token service

Payment Flow

Payment Flow


Enrollment Process:



  1. The cardholder adds a UPay card in their account on the merchant’s site. The acquirer sends an SMS-sending request to UPay.
  2. UPay forwards the request to the issuer.
  3. The issuer checks whether the card number and phone number match with the information stored in its system.
  4. The issuer forwards the result to UPay. If the information matches, UPay sends an SMS code to the cardholder’s phone number.
  5. The cardholder enters the SMS code.
  6. The acquirer sends the enrollment request to UPay.
  7. UPay verifies the SMS code.
  8. If the SMS code is correct, UPay forwards the enrollment request to the issuer.
  9. The issuer verifies the card information and forwards the result to UPay, then UPay forwards the transaction result to the acquirer.



  1.  The acquirer sends a purchase or preauthorization request to UPay.
  2. UPay forwards the request to the issuer.
  3. The issuer processes the request.
  4. The issuer sends the transaction result to UPay.
  5. UPay forwards the transaction result to the acquirer.

Use Case :

  1. Wallet merchant
  2. Large merchants
    Large merchants with an account architecture that can manage card information or token information properly.


  1. Frictionless model, one-click payment
  2. Good user experience and high success rate
  3. Risk controlled via initial authentication

Steps & Work Content

Apply for membership and e-commerce acquiring license

Contact the local UPay office, and fill in and submit the application form.

Download SDK and documents

Download the SDK, implementation guide and interface specifications from the Institution Service Platform.

Submit the application form

Submit the e-commerce acquiring application form with signature. TR Registration Form is additionally required for token service.

Modify the system

Follow the implementation guide and interface specifications to modify the system.


Apply for testing on the UTSS platform, and conduct testing in UTSS.Apply for testing on the UTSS platform, and conduct testing in UTSS.

Go live

Go live after passing the testing.

The ExpressPay product provides a fast and easy UPay online payment solution to acquirers and merchants.

API Introduction

Key Features

  • A frictionless model
  • Enrollment and payment steps are finished on the merchant/acquirer page without redirection;
  • One-click payment for enrolled card;
  • Debit/Credit card do not need PIN to finish payment;
  • No SMS verification during the payment;
  • First time authentication is required to help merchant reduce risk;
  • UPOP server sends SMS to cardholder mobile devices to identify the cardholder identification;
  • UPOP server verifies SMS code and forward the mobile number to issuer.

Who Use it?
Merchant, Acquirer and Developer

Where to Use it?
This API is available globally.

Flow Chart

MH SP流程图.png

  1. Cardholder chooses product on a merchant website.
  2. The merchant initiates a request message to the acquirer system;
  3. The acquirer transfers the transaction to UPay Omnichannel Platform (UPOP);
  4. Cardholder checks individual’s identity on UPOP;
  5. UPOP transfers the transaction to UPay core processing system;
  6. UPay core processing system converts FX rate and transfers the transaction to the issuer;
  7. The issuer authorizes transaction and the response message goes back to the merchant website over the same route.