Satispay API integration services (OpenFinance / OpenBanking)

Account login & consent

Authorization flow handling consistent with Satispay Business API key/RSA exchange and consumer-app token capture. Includes 5-digit PIN, FaceID/fingerprint awareness and session refresh — required because, since May 2023, Satispay enforces TLS 1.2+ on all endpoints.

Statement & transaction export

Paginated history with date ranges, channel filters (P2P, in-store, online, pagoPA, road tax, mobile top-up) and counterparty enrichment. Output formats: JSON, CSV, Excel and PDF, suitable for ERP imports or reconciliation against bank IBAN statements.

Pay in 3 BNPL plans

Dedicated endpoints for the November 2025 BNPL service: list active installment plans, fetch repayment schedules, surface upcoming due dates and capture wallet-debit confirmations. Works for purchases above €30 in stores and online.

Investment fund snapshots

Read access to Satispay Invest balances across the three available funds, with risk profile, recurring deposit cadence (daily / weekly / monthly), and an event log for buys, sells and withdrawals.

Loyalty & Satispay Points

Tracking of points earned per payment, multipliers, level progress and redemptions across the 400,000+ partner network. Common use: marketing attribution and churn analytics for partner merchants.

Merchant operations

For shops integrating with Satispay Business: payment creation, refund, capture, and webhook delivery for in-store QR or online checkout — built on the official PHP / Node SDK pattern but adapted to your runtime.

1) Authentication & key exchange

// Activate API session using activation token + RSA pair
POST /api/v1/satispay/auth/activate
Content-Type: application/json

{
  "activation_token": "ACT-XXXX-XXXX",
  "public_key": "-----BEGIN PUBLIC KEY-----..."
}

// Response
{
  "key_id": "key_8f3...",
  "expires_at": "2026-04-28T23:59:59Z",
  "scope": ["payments","statements","invest:read","bnpl:read"]
}

2) Statement query (paged, filtered)

POST /api/v1/satispay/statement
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "account_id": "user_8a1b...",
  "from_date": "2026-03-01",
  "to_date":   "2026-03-31",
  "channels":  ["INSTORE","ONLINE","P2P","PAGOPA"],
  "page":      1,
  "page_size": 100
}

// Response (excerpt)
{
  "items": [
    {"id":"tx_01","ts":"2026-03-04T09:14:22Z","amount":-12.50,
     "currency":"EUR","channel":"INSTORE","merchant":"Bar Roma"},
    {"id":"tx_02","ts":"2026-03-04T18:22:09Z","amount":-180.00,
     "currency":"EUR","channel":"ONLINE","plan":"PAY_IN_3"}
  ],
  "next_page": 2,
  "total": 184
}

3) Pay in 3 + Invest webhooks

// Webhook payload — installment due
POST https://your-app.example.com/hooks/satispay
X-Satispay-Signature: t=1714305600,v1=...

{
  "event": "bnpl.installment.due",
  "plan_id": "plan_77e...",
  "installment": 2,
  "amount": 60.00,
  "due_at": "2026-05-04T00:00:00Z"
}

// Webhook payload — investment contribution
{
  "event": "invest.contribution",
  "fund_code": "SAT_FUND_BALANCED",
  "amount": 25.00,
  "schedule": "WEEKLY",
  "executed_at": "2026-04-22T07:00:00Z"
}

// Errors
// 401 invalid_signature, 409 duplicate_event, 429 rate_limited

Compliance & privacy

All deliveries follow EU regulatory baselines that are directly relevant to Satispay: PSD2 (Directive 2015/2366) for payment initiation and account information, GDPR for personal data minimisation and lawful basis, and the supervisory framework of the Luxembourg CSSF under which Satispay Europe S.A. and Satispay Invest S.A. operate. For the investment side we layer in MiFID II suitability rules and anti-money-laundering obligations.

We never use sensitive credentials beyond the user-authorised scope. Audit logs, consent records and key rotation policies are part of every delivery, and all transport runs on TLS 1.2+ in line with Satispay's May 2023 baseline.

Data flow / architecture

A typical pipeline looks like this:

1. Client app — Satispay mobile app or merchant SDK on iOS / Android.
2. Ingestion gateway — Our authorised connector calls Satispay endpoints (or receives webhooks) and applies signature checks.
3. Storage & normalisation — Transactions are stored in a partitioned data store; codes are mapped to a canonical schema (movement type, counterparty, channel).
4. Analytics or API output — Your stack pulls a clean REST or GraphQL surface, or subscribes to Kafka / webhook streams for real-time pipelines.

Market positioning & user profile

Satispay's user base is heavily Italian and skews toward digitally active retail consumers aged 18–45, with a growing Gen-Alpha segment thanks to the parental "digital pocket money" feature for teenagers aged 14–17. Roughly 400,000 merchants accept Satispay across Italy, ranging from independent cafés to national retail chains. Beyond Italy, Satispay has progressively expanded across Luxembourg, France and Germany since its CSSF authorisation. The platform is exclusively mobile (Android and iPadOS / iOS) and channels payments through IBAN-funded balances rather than card rails — making it a high-value, atypical OpenBanking source for any team building data products that already cover traditional Italian banks.

What we deliver

• OpenAPI / Swagger specification with examples
• Protocol analysis report covering authentication, payload signing and webhook verification
• Runnable source code in Python / Node.js / Go for login, statement and BNPL endpoints
• Automated test suites and Postman / Insomnia collections
• Compliance notes covering PSD2, CSSF, GDPR and TLS 1.2+ baselines
• Optional hosted endpoint with pay-per-call billing — no upfront cost

About us

We are an independent technical studio focused on fintech protocol analysis and OpenData / OpenFinance API integration. Our team includes engineers who have shipped consumer wallets, PSD2-regulated AIS / PIS connectors, and merchant SDKs across Europe. We know the practical edges of CSSF supervision, PSD2 SCA, and Italian-specific rails such as pagoPA and CBILL, and we deliver end-to-end financial APIs under tight security and compliance constraints.

• Payments, digital banking, BNPL and investing data integration
• Enterprise API gateways, signature schemes and security reviews
• Custom Python / Node.js / Go SDKs and reproducible test harnesses
• Full pipeline: protocol analysis → build → validation → compliance sign-off
• Source code delivery from $300 — runnable API source plus full documentation; payment after delivery upon satisfaction
• Pay-per-call hosted API — call our managed endpoint and pay only per request, ideal for usage-based teams

Contact

To request a quote, share your target Satispay use case (transactions, BNPL, invest, merchant), or to ask about hosted API access, please open our contact page:

Open contact page

Typical reply time: 1 business day. NDAs and per-region compliance addenda are available on request.

Engagement workflow

1. Scope confirmation — which Satispay surfaces (statement, BNPL, invest, loyalty, merchant) and which output formats.
2. Protocol analysis and API design — 2–5 business days depending on complexity and webhook coverage.
3. Build and internal validation — 3–8 business days, including signature, retry and idempotency tests.
4. Documentation, sample apps and Postman collections — 1–2 business days.
5. Typical first delivery 5–15 business days; extra time may be needed when Satispay sandbox approvals or live-merchant onboarding are involved.

FAQ

What do you need from me to start?

How do you handle compliance?

Can you support both consumer and Business sides?

Pricing?