From an account to a real payment

Before you start

You need three things, and two of them live outside VinGate:

• A store with its own website. The URL identifies the business, so one site is one business. Up to 10 businesses fit on one login.
• A processor account you own. Square or Stripe. On Square the money settles to you with no platform in the middle; Stripe is what cloaking runs on and is a Premium feature.
• A real card for the plan. Live mode needs an active plan and the activation is charged to a card now: $99.00 for the first month plus the one-time $399.00 integration fee.

1. Account and business

Sign up with the business name, your email and a password. That creates the login and the first business together; more businesses are added under Businesses, and each one has its own keys, gateways, brand and cloaking setting.

The country on a business defaults to US and is fixed once a Stripe account exists for it, so check it before you connect Stripe.

2. Brand and website

Settings › Checkout branding: a display name, and a logo URL if you have one. That is what the buyer sees above the card form, and the only place the checkout looks like you.

Settings › Statement line: the tail a buyer recognises on their bank statement. Brand name, not a product line. Square has no per-payment descriptor, so copy the same line into each Square account by hand.

3. Connect a processor

Gateways › Connect with Square, and approve the permissions on Square's own site. One Square account per business; it appears in the list by itself when the connection returns.

Stripe is the other way, and has two doors, both under Gateways:

• Connect an account you already have (OAuth). Shortest path: Stripe already knows that business, so its verification, bank account and processing history come with it.
• Create a new account. Stripe's own form then opens inside VinGate and collects the business details, the bank account and the terms of service. Verification is Stripe's to give, and until it does the account sits out of routing.

Both doors end the same way: the account is listed under Gateways with a limit, and only Stripe's verification decides when it starts taking volume.

4. Activate a plan

Billing › pick a plan and put a card in. Test mode works free, so this is only needed for live money: a vg_live_ key answers 402 permission_erroruntil the plan is active.

Stripe accounts, live payments and cloaking are Premium. Square on its own runs on Base.

5. Make a key

Developers › Create secret key, once per business, in the mode you are testing. The key is shown once. A browser gets a publishable key instead, which can create a session but never a refund.

vg_test_...   test mode, Square sandbox, no money
vg_live_...   live mode, real cards, needs an active plan

6. Send a checkout

One call returns a hosted page. The buyer pays there, so card data never touches your server, which is what keeps you at SAQ A.

curl https://YOUR-VINGATE-DOMAIN/api/v1/checkout/sessions \
  -H "Authorization: Bearer vg_test_..." \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-1001" \
  -d '{
    "amount": 2500,
    "description": "BPC-157 5mg x2",
    "success_url": "https://yourstore.com/thanks",
    "cancel_url": "https://yourstore.com/cart"
  }'

Open checkout_url, pay with 4111 1111 1111 1111, any future expiry, CVV 111, ZIP 12345. The payment shows under Payments, and the order's line items reach the processor.

7. Or use the plugin

On WooCommerce, steps 6 and the webhook are one install. The plugin sends the buyer to the hosted page and completes the order from a signed webhook, so nothing is written by hand.

1. Download vingate.zip and upload it at Plugins › Add New › Upload Plugin, then activate it.
2. WooCommerce › Settings › Payments › VinGate: paste the key from step 5 and press Connect.
3. Read the rows it prints. The plugin registers its own webhook, reads test or live from the key, and tells you the rest: processor capacity, plan, cloak, currency. Then enable the method and save.

Webhooks are https only, and the API is USD only, so the method hides itself on an http or non-USD store rather than take payment it cannot complete. A reconcile pass every five minutes finishes orders whose webhook a host blocked. Refunds are issued from the order screen.

Without WooCommerce, step 6 and the webhook section of the API docs are the same work by hand.

8. Turn cloaking on

Settings › Cloaking: tick “Charge through VinGate instead of this business”, choose what the payment description says, and save. The charge then runs on VinGate and your account is only the destination, so the statement and the receipt say VinGate and the bank never sees your store.

The other half is what Stripe is shown: pair a front site from the plugin, under WooCommerce, Settings, Payments, VinGate, Front site. That site runs the same plugin and you approve from its own admin; its name and address then stand in for yours, and cloaked checkouts move ontocheckout.<that site> once you add the CNAME it prints. Pair before connecting Stripe, because an account keeps the site it was created with — a cloaked business with no pair is refused there.

Cloaking needs a verified Stripe account whose transfers capability is active and whose currency matches what you charge in: under Gateways, that account reads “Taking volume”. Square cannot be cloaked, so a checkout that lands there falls back to your own name — the brand line and the description policy still apply to it, because Square reads those too.

The cloaking guide has the rest: what changes, what does not, and how to check it.

8. Prove it worked

A small live charge, then read the PaymentIntent back on the platform:

calculated_statement_descriptor = "<PREFIX>* YOURTAIL"
transfer_data.destination       = acct_your_account
on_behalf_of                    = null
application_fee_amount          = VinGate's cut, never 0

Then refund it. The refund should carry reverse_transfer: true: the business's share is clawed back instead of the platform funding it, which is the proof the transfer was really there.

Where a setup stops

• Nothing connected. Gateways says no account is taking payments, and every checkout is refused with a buyer-safe message.
• Stripe has not verified the account. It stays out of routing until it does. Gateways links straight back into the unfinished form.
• No active plan. Live keys answer 402; test keeps working.
• Cloaking on a business with no verified Stripe account. The sale still goes through, uncloaked, with your own descriptor.
• The statement prefix. It comes from the platform account, not from you, so it is the one part of the line no setting can change. It currently reads VINNA.

Questions

Can I try it without a processor?

Not a payment. Connecting Square's sandbox or a Stripe test account is free and needs no verification, and everything except live money and cloaked transfers can be exercised there.

Whose bank account does the money reach?

Yours, always. VinGate never holds funds: the processor pays you, and even a cloaked charge only moves settlement to VinGate for the moment the transfer back to your account takes.

Do I need my own Stripe account to cloak?

Yes, a connected one, either existing or created from Gateways. Cloaking is a destination charge, so the destination has to exist and be verified.

Does a business need its own page to look legit?

The website is what a processor underwrites, so give it a real one. The checkout itself is hosted by VinGate and carries your brand, so nothing has to be built to take a payment.