> For the complete documentation index, see [llms.txt](https://docs.phptravels.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.phptravels.com/payments/paylolly.md). # PayLolly Set up the PayLolly payment gateway in PHPTRAVELS: add your API Key and Merchant ID, test in staging, then take live booking payments on the hosted page. ### Overview PHPTRAVELS integrates with PayLolly so customers can pay for bookings on PayLolly's hosted payment page. Card details are entered on PayLolly, not on your server. Money settles to your own PayLolly merchant account; PHPTRAVELS never holds the funds. This integration requires the PHPTRAVELS version that includes the PayLolly gateway (v10). PayLolly supports card brands including Visa, Mastercard, American Express and UnionPay. Which cards are offered to a traveller depends on your PayLolly merchant account. The integration process includes: 1. Creating or requesting a PayLolly merchant account. 2. Obtaining your PayLolly API credentials. 3. Enabling PayLolly in the PHPTRAVELS Admin Panel. 4. Configuring Development mode (PayLolly staging). 5. Adding the required API Key and Merchant ID, and the optional Account ID if PayLolly gave you more than one processing account. 6. Setting the currency your PayLolly account accepts. 7. Testing the API connection. 8. Creating a test booking. 9. Paying with a PayLolly staging test card on the hosted page. 10. Verifying that the booking is marked paid and the transaction is recorded. 11. Switching to production credentials when you are ready to accept live payments. *** ## Requirements Before starting, make sure you have: * PHPTRAVELS v10, or another release that includes the PayLolly gateway, and Admin Panel access * A PayLolly merchant account (staging credentials for testing, then live credentials) * Your PayLolly **API Key** (a GUID, used as the MerchantKey header) * Your PayLolly **Merchant ID** (a GUID) * Your PayLolly **Account ID**, only if PayLolly has given you several processing accounts * At least one currency your PayLolly account can accept * HTTPS on a production website > **Important** > > Complete the full flow in PayLolly's staging environment before you enable production payments. Staging and live use different keys and endpoints. Staging does not take real funds and has no connection to live card networks. *** ## 1. Create or access your PayLolly merchant account PayLolly onboarding is handled by their team. If you do not already have an account, go to or contact . * Sales: * Support: PayLolly's public FAQ says a virtual terminal or payment link can be issued within hours, and that most merchants connect to the hosted payment page within a few days. PayLolly will also run identity checks when the account is opened. PHPTRAVELS provides the technical connector only. You sign the commercial agreement with PayLolly, and the credentials and settlement are yours. *** ## 2. Get your PayLolly API credentials PayLolly provides the **API Key** (MerchantKey) and **Merchant ID** to the merchant during onboarding. Contact or use if you do not already have them. You need two values, plus a third only if PayLolly told you to use it: * **API Key** — a GUID. PHPTRAVELS sends this as the `MerchantKey` header on every API call. * **Merchant ID** — a GUID. PHPTRAVELS sends this as `merchantId` in the payment request. * **Account ID** — optional. Use this only when PayLolly has given you several processing accounts. Staging and live credentials are different. Use staging keys while Dev mode is on, and live keys only after you turn Dev mode off. PayLolly merchant portals: * Staging: * Live: PayLolly's API documentation is at . > **Security Warning** > > Never publish your API Key. Do not show production credentials in screenshots, videos, frontend code, public repositories or documentation. If a key is exposed, ask PayLolly to replace it. *** ## 3. Open PayLolly in PHPTRAVELS Log in to your PHPTRAVELS Admin Panel. Navigate to: **Settings → Payment Gateways** Locate **PayLolly**. Make sure the PayLolly gateway **Status** is **Enabled**, then open its settings. *** ## 4. Select Development mode For initial testing, turn **Dev mode** on. When Dev mode is on, PHPTRAVELS talks to PayLolly staging at `https://api.stg.paylolly.app`. When Dev mode is off, it talks to live at `https://api.paylolly.app`. Do not turn Dev mode off while you are using staging credentials. Staging and live keys are not interchangeable. *** ## 5. Add PayLolly credentials Enter the values from your PayLolly staging account into the matching fields and save. **API Key** (required) Paste your PayLolly API Key (GUID). **Merchant ID** (required) Paste your PayLolly Merchant ID (GUID). **Account ID** (optional) Paste an Account ID only if PayLolly gave you several processing accounts. Otherwise leave it empty. **Currency** Set the currency your PayLolly account accepts. If a booking is in another currency and PayLolly rejects it as invalid, PHPTRAVELS retries the payment in this currency, converted with your site's currency rates. **Status** Keep the gateway **Enabled**. Save the configuration. *** ## 6. Test the credentials After saving, click: **Test Credentials** PHPTRAVELS will make a read-only call to PayLolly to check that the API Key belongs to this Merchant ID on the selected environment. If the test succeeds, continue with a booking test. If it fails: * "API key missing" or "Merchant ID missing" — the required fields are empty. * "Invalid Merchant Key" — the API Key is not recognised on this environment. Check that Dev mode is on with a staging key, or off with a live key, and that the key was copied without spaces. * A message that the key belongs to another merchant — the API Key is valid but the Merchant ID (or Account ID) does not match. Recheck both values with PayLolly. *** ## 7. Check your currency Create test bookings in a currency your PayLolly account supports, or set the PayLolly **Currency** field to that currency so PHPTRAVELS can convert when needed. > **Important** > > Supported currencies depend on your PayLolly merchant account and acquirer setup. Confirm the currencies on your account with PayLolly before you take live payments. *** ## 8. Create a test booking Open the PHPTRAVELS frontend. For example, create a hotel booking: **Hotels → Select Destination → Select Hotel → Select Room → Continue to Booking** Enter the customer and booking information and confirm the booking. *** ## 9. Select PayLolly and proceed to payment On the payment step, choose **PayLolly** and continue. PHPTRAVELS creates a hosted payment with PayLolly and redirects the customer to PayLolly's payment page. The customer enters card details there. Your website does not collect the card number. *** ## 10. Pay with a staging test card In Development, use PayLolly's official test cards from [PayLolly test cards](https://docs.stg.paylolly.app/Public/testcards.html). These cards do nothing in production. A simple approved card on the staging simulator: * Visa: `4000000000000002` * Mastercard: `5100000000000008` A simple declined card, if you also want to test a failed payment: * Visa: `4000000000000010` * Mastercard: `5100000000000016` If 3-D Secure is enabled on the staging account, PayLolly documents sandbox cards on the same test-cards page. The published challenge passcode is `1234`. > **Warning** > > Do not use real customer card details while Dev mode is on. Do not use test cards in production. *** ## 11. Verify the successful payment After PayLolly approves the payment, the customer is returned to your invoice page. PHPTRAVELS does not trust the return URL alone. It asks PayLolly for the payment status and marks the booking paid only when the payment is **Approved** for this booking's reference, amount and currency. Verify: * Payment Status: Paid * Booking status updated as expected * Amount and currency * The transaction record in PHPTRAVELS * The same payment in your PayLolly staging portal A successful test confirms: **Booking → PayLolly hosted page → Approved payment → PHPTRAVELS booking update** *** ## Moving to Production After the staging flow works, prepare your PayLolly account for live payments and obtain live credentials. In PHPTRAVELS, turn **Dev mode** off, then replace the staging API Key, Merchant ID and Account ID with the live values. Production calls `https://api.paylolly.app`. Do not leave staging keys on a production website. *** ## Production checklist Before accepting real customer payments: * PayLolly account is approved for live payments * Dev mode is off * Live API Key is configured * Live Merchant ID is configured * Account ID is set only if PayLolly requires it * PayLolly gateway Status is Enabled * The currency field matches a currency your live account accepts * A complete staging payment test has already succeeded * A small live test booking has been made and marked paid * Failed and cancelled returns have been checked (the booking must stay unpaid if PayLolly did not approve the payment) * Test cards are not used in production * Your live site is served over HTTPS > **Warning** > > Do not accept real customer payments until your PayLolly account is approved for production and the production configuration has been verified. *** ## Troubleshooting ### PayLolly does not appear at checkout Go to: **Admin Panel → Settings → Payment Gateways → PayLolly** Make sure the gateway Status is **Enabled** and the configuration has been saved. Also confirm you are running a PHPTRAVELS version that includes the PayLolly gateway (v10). *** ### Test Credentials fail Check the following: * API Key * Merchant ID * Account ID, if PayLolly issued one * Dev mode (on = staging, off = live) * That you did not mix a staging key with live mode, or a live key with staging If PayLolly says the key belongs to another merchant, the Merchant ID does not match the API Key. *** ### Currency is not supported PayLolly returned an invalid-currency response for the booking currency. Set the PayLolly currency field to a currency your account accepts, confirm your site has an exchange rate for that pair, and try again. Or create the test booking in a currency the account already allows. Confirm currency availability with PayLolly. *** ### Invalid Merchant Key The API Key is not recognised on the endpoint for the selected environment. Paste the matching staging or live key again, with no extra spaces. *** ### Payment is successful at PayLolly but the booking stays unpaid PHPTRAVELS confirms payment with PayLolly's payment status, not only the browser return. Check: * The payment status in the PayLolly portal (it must be Approved) * The booking's payment status and payment records in PHPTRAVELS * That Dev mode and the credentials match the environment where the payment was made * The booking reference on the payment If the payment is approved at PayLolly but the booking is still unpaid, submit a PHPTRAVELS support ticket with the booking reference, the PayLolly payment or merchant reference, the environment, and the error — not the API Key. *** ### The customer left the hosted page without paying The booking should remain unpaid. A return to the site without an Approved status is not treated as a payment. *** ## Security recommendations * Never share your API Key publicly or include it in screenshots, videos or tickets. * Keep staging and live credentials separate. * Restrict Admin Panel access to authorised users. * Use HTTPS on your production website. * Replace credentials immediately if they are exposed. * PHPTRAVELS verifies the payment server-side before it treats a booking as paid. Do not mark bookings paid from the return URL alone. *** ## Payment flow **Customer creates a booking → Selects PayLolly → PHPTRAVELS creates a hosted payment → Customer pays on the PayLolly page (including 3-D Secure when required) → PayLolly returns the customer to your invoice → PHPTRAVELS checks the payment status → If Approved, the booking is marked Paid** *** ## Official PayLolly references * PayLolly website: * Get started: * API documentation: * Test cards: * Staging portal: * Live portal: * Staging API: * Live API: *** ## Need Help? If you experience an issue with the PHPTRAVELS PayLolly integration, submit a support ticket through the PHPTRAVELS client area. When contacting support, include the relevant error message, booking reference, PayLolly payment or merchant reference, and whether Dev mode is on (staging) or off (live). **Never include your complete API Key, card information, or other sensitive payment credentials in a support ticket.**