Overview

How SaaS platforms, marketplaces, and aggregators can offer HitPay payments to the businesses they serve

Overview

Platforms that serve other businesses - CRMs, booking systems, marketplaces, agency tools, and vertical SaaS products - often need to offer payment acceptance to their customers without holding a payment institution licence themselves. HitPay’s Platforms model is designed for this, commonly referred to as a master–sub-merchant or aggregator model:

• You (the platform) integrate HitPay once and create payments on behalf of your business customers.
• Your sub-merchants (your business customers) each hold their own HitPay account, complete their own verification, and receive payouts directly to their own bank account.
• HitPay holds the relevant payment institution licences (e.g. MAS in Singapore, BNM in Malaysia, BSP in the Philippines), performs KYB/KYC review, and processes the underlying payments.

Whichever integration path you choose below, every sub-merchant needs their own verified HitPay account: they sign up, complete Business Verification, and remain subject to HitPay’s standard business restrictions. Payouts follow HitPay’s standard payout schedule and go directly to each sub-merchant’s own bank account - funds are not pooled through the platform.

Ways to integrate

There are two ways for your platform to get access to a sub-merchant’s account, plus an add-on that works with either.

Option 1: Direct API key integration

The simplest approach: the sub-merchant generates their Merchant API key in their dashboard under Developers → API Keys and enters it into your platform’s UI. You store the key and call the HitPay API on their behalf using the X-BUSINESS-API-KEY header, exactly as documented in the API Reference.

This requires no platform setup at all - but it comes with real risk:

• The API key grants full access to the sub-merchant’s account, far more than most platform integrations need.
• You are storing a live, non-expiring secret for someone else’s business.
• If the sub-merchant also uses that key for their own integration, rotating it on either side silently breaks the other.

Not recommended when the sub-merchant has (or may build) their own HitPay API integration. Use OAuth instead.

Option 2: OAuth - “Connect your HitPay account”

The structured alternative to collecting API keys. You build an OAuth app once, add a Connect your HitPay account button to your platform, and sub-merchants authorize it in a couple of clicks. Your platform receives its own access tokens, scoped to just the permissions you requested, and sub-merchants can revoke access from their dashboard at any time - no secrets change hands.

See Connect Merchant Accounts (OAuth) for the full integration guide.

OAuth apps are currently in beta. Tokens cover payment requests, charges, and refunds today — if your integration needs other APIs (e.g. recurring billing or invoicing), use the direct API key approach for those calls.

Add-on: Platform enablement

Independent of how you access sub-merchant accounts, you can have your own HitPay account enabled as a Platform account (contact [e-mail]). This gives you a Platform Key (dashboard: Settings → Platform) which you pass as an X-PLATFORM-KEY header alongside either a merchant API key or an OAuth token. It unlocks two things:

1. Commissions - earn a share of every payment you create for your sub-merchants, either as a platform-wide percentage Commission Rate or a fixed platform_commission_amount per transaction.
2. Unified webhooks - charge events for all your sub-merchants’ payments are delivered to webhook endpoints registered on your platform account, so you monitor one webhook instead of one per sub-merchant.

See Platform Key for setup and API details.

Choosing a path

	Direct API key	OAuth
Sub-merchant onboarding	Copies API key from their dashboard into your UI	Clicks Connect your HitPay account and approves
Access granted	Full account access	Only the scopes you request
Secret handling	You store their live API key	You store tokens issued to your app
Revocation	Sub-merchant rotates their key (breaks their own integrations too)	Sub-merchant revokes your app from their dashboard
API coverage	Entire HitPay API	Payment requests, charges, refunds
Commissions & unified webhooks	✓ with X-PLATFORM-KEY	✓ with X-PLATFORM-KEY

This page reflects the model as it exists today. HitPay’s Platforms program continues to evolve, and partner needs vary by market and merchant profile - where a use case goes beyond what’s described here, our Sales & Partnerships Team at [e-mail] can advise on the best path forward.

FAQ

Do sub-merchants need their own payment institution licence?

No. This is a core benefit of onboarding as a HitPay sub-merchant - HitPay is the licensed, regulated entity, and sub-merchants operate under HitPay’s compliance umbrella once verified.

Where do payouts go - to the platform or to the sub-merchant?

Directly to each sub-merchant’s own bank account, following HitPay’s standard payout schedule. Funds are not pooled through the platform.

Can our platform create the HitPay account and complete verification for our sub-merchants, since we already collect their documents?

Today, each sub-merchant signs up and completes Business Verification directly with HitPay - this keeps KYB ownership clearly with HitPay and gives the sub-merchant direct visibility into their own account from day one. Many platforms streamline this by referring merchants straight into HitPay’s sign-up flow so the handoff feels seamless. If your program has specific onboarding requirements - including using documents you’ve already collected - our Sales & Partnerships Team at [e-mail] can work with you to find the best approach for your markets and merchant profile.

Is there an API for submitting a sub-merchant's KYC/KYB documents to HitPay?

Not yet as a standalone API - Business Verification is currently a dashboard flow completed by the sub-merchant. This is an area we’re happy to discuss further with platform partners who have high onboarding volume, so reach out to our Sales & Partnerships Team at [e-mail] to explore what’s possible for your program.

Can commissions be set per sub-merchant or per transaction?

Yes. A platform-wide percentage Commission Rate can be set, or overridden per transaction with platform_commission_amount. See Platform Key.

What if sub-merchants are outside Singapore, Malaysia, the Philippines, or Indonesia?

Card payments for merchants outside these markets are processed through Stripe Standard Connect, which the sub-merchant sets up directly with their own Stripe account. See Standard Connect Integration.

Get started

Contact [e-mail] to enable Platform access for your account.