GCash
Collection1.8%
Per transaction: 100 - 50,000 PHP
Example: 1,000 PHP → 18 PHP fee.
GCash payment API
GCash payment API integration for reliable payment confirmation
Connect checkout, payment confirmation and reconciliation in your merchant system. Bifu Payments (bifu.us) explains fees and limits, with integration support for order creation, verified callbacks and status queries under the specification issued for your route.
Payment capabilities
Merchant order and checkout flow
Verified, idempotent callbacks
Queries, reconciliation and launch tests
Collection and payout fees
Published channel fees are shown separately for collections and payouts. Ask support about settlement and any additional charges.
QRPH
Collection1.8%
Per transaction: 100 - 50,000 PHP
Example: 1,000 PHP → 18 PHP fee.
InstaPay
Payout8 PHP
Per transaction: 100 - 50,000 PHP
Example: 1,000 PHP → 8 PHP fee.
Discuss fees and settlement
Talk directly to our 24-hour team about collections, payouts and API integration.
24-hour support
Discuss integration and pricing on Telegram
Human support for exceptions
Contact the team about problem orders
Settlement options
Real-time settlement may be available, depending on the channel and business
Integration details
Payment flow, callbacks, order queries and reconciliation.
Pricing and integration support
Talk to support about costs, available routes and the API specification for your integration.
Pricing and payment flow
Discuss fees, limits and settlement alongside your checkout, callbacks and reconciliation. Support can explain the available integration options on Telegram.
Applicable specification
The technical specification for the agreed route defines its endpoints, request fields, signatures, credentials and status values. The examples below explain common patterns; your issued specification takes precedence.
Independent role
Bifu is not GCash, does not present itself as an official GCash partner, and is not a bank, e-money issuer, acquirer or licensed funds custodian. It provides integration consultation and implementation support; the contracted provider governs payment access and funds movement.
Merchant-to-GCash payment flow
Keep checkout presentation separate from the server-side decision that a payment is final.
1. Create one merchant order
Generate a unique merchant reference in your own system, fix the PHP amount and currency, and record the customer-facing purchase before requesting the payment instruction defined by the current route.
2. Present the returned checkout
Show or redirect to the checkout artifact returned by the contracted integration, such as a hosted payment page, app handoff or QR instruction when supported. Respect its expiry and never construct an undocumented GCash URL.
3. Confirm on the server
Treat the browser return as user experience only. Credit the order after your server verifies an authoritative callback or confirms the same order through the agreed status-query method.
Callbacks and idempotency
Design notification processing so retries, delays and duplicate delivery cannot create duplicate value.
Verify before updating
Validate the callback using the exact signature method, raw-body rules, timestamp window and headers in the applicable documentation. Then match the merchant reference, provider reference, amount and currency to the stored order.
Make processing idempotent
Atomically record the documented event identifier or a unique order-and-status version. Repeated delivery should return the agreed acknowledgement while leaving the order and ledger unchanged after the first valid update.
Expect asynchronous delivery
Queue callback work durably, acknowledge within the documented timeout and process retries safely. Keep an audit record of verification, previous state, new state and processing result without logging secrets.
Order states, queries and recovery
Model uncertainty explicitly instead of converting every timeout into a failed or duplicate order.
Use the documented states
Map the route's actual status values into merchant states such as awaiting payment, processing and terminal outcomes. Do not assume that accepted, redirected or processing means paid.
Protect terminal outcomes
Allow only valid state transitions. A late or out-of-order notification must not downgrade a confirmed success or revive an expired order unless the current specification expressly permits that transition.
Query the original order
When a callback is missing, invalid or delayed, query the same reference with capped exponential backoff. Confirm its final result before offering a new payment attempt or making a manual balance adjustment.
Reconciliation and exception handling
Use three-way matching between merchant records, route results and settlement records.
Match stable identifiers
Retain the merchant order reference and every returned provider reference. Reconcile the gross amount, currency, final payment state, fee definition and relevant timestamps for the agreed business date.
Separate payment from settlement
A successful payment state and a settlement entry answer different questions. Link each paid order to the relevant settlement batch or report instead of treating the callback as the accounting statement.
Build an exception queue
Route missing callbacks, amount mismatches, unknown states, duplicate references and long-pending orders to review. Store the latest query result, owner, evidence and next action for each exception.
Security and operational readiness
Treat the callback endpoint, credentials and payment state machine as production financial controls.
Protect credentials
Keep test and production credentials separate in a managed secret store, apply least privilege, support rotation and revoke exposed keys. Never place a secret in frontend code, a public repository or a support screenshot.
Harden the callback endpoint
Require TLS, enforce documented signatures and timestamp checks, limit request size and rate, and retain sufficient audit logs. An IP allowlist can be an extra control but cannot replace message verification.
Observe the complete flow
Monitor order-creation errors, checkout expiry, callback delay, signature failures, status-query backlog and reconciliation differences. Alert on business outcomes, not only HTTP availability.
GCash API go-live checklist
Launch only after the merchant system and the contracted route agree on normal and exceptional outcomes.
Confirm the contract surface
Record the documentation version, production domains, credential-delivery method, supported payment flow, expiry, amount rules, fees, settlement definition and operational contacts that actually apply.
Test failure paths
Exercise success, cancellation, expiry, invalid amount, duplicate request, missing callback, duplicate callback, invalid signature, delayed result and status-query recovery with traceable evidence.
Approve reconciliation
Run an end-to-end test through order creation, checkout, callback, ledger posting, route query and settlement matching. Assign owners and response times for unresolved payment exceptions before release.
Common questions
Is this the official GCash API documentation?
No. Bifu is independent from GCash; its examples are not official GCash API documentation. Production endpoints, fields, signatures and credentials must come from the documentation for the agreed payment route.
How can I start a GCash API consultation?
Use Contact support to open a direct conversation with Bifu. The confirmed route and technical path from checkout through verified payment confirmation can be discussed there.
Can I mark an order paid after the user returns to my website?
No. A browser return can be interrupted or imitated and should not be the source of truth. Confirm the order through a verified server callback or the documented status-query method.
How should duplicate GCash callbacks be handled?
Verify each notification, then process it idempotently against the existing order. A duplicate event can receive the documented acknowledgement but must not create another credit or ledger posting.
What if a GCash payment remains pending?
Keep the original reference open, query it with controlled backoff and follow the documented expiry rules. Do not create a replacement order or manual credit until the original outcome is understood.
Which fields should be reconciled?
At minimum, match the merchant and provider references, amount, currency, final state, timestamps and the fee and settlement fields defined in the issued route specification. Keep payment confirmation separate from settlement confirmation.
Does a GCash collection API also send payouts?
Not automatically. Collection and payout are separate money movements with different endpoints, order states, risk controls and reconciliation. Review the GCash collection and payout page when both directions are required.
Where can developers see a safe API structure example?
Use Bifu's payment API structure example for non-production patterns covering signatures, callbacks, queries and reconciliation. The actual integration specification always takes precedence.
Related payment resources
Continue with the technical and channel details
API structure example
Use the non-production examples for signatures, callbacks, idempotency and order queries.
Read resourceGCash collection and payout
Connect payment-order controls with collection and payout operations.
Read resourceQR Ph payments
Compare GCash checkout with an interoperable QR Ph merchant-presented flow.
Read resourceOfficial references
Product access and final technical specifications come from the relevant provider. These primary sources help verify the public background used on this page.
- GCash API Portal FAQ
GCash's own access, subscription and environment guidance for selected partner organizations.
- GCash for Business
GCash's official overview of its business products and payment solutions.
Discuss GCash API pricing and integration
Ask Bifu support about fees, limits, settlement and the technical details for your GCash payment integration.
Contact support