autopaylab · autopay‑mcp‑server
Open Beta

Autopay checkout, exposed as tools an AI agent can call directly.

An MCP server covering both of Autopay's integration models — Online v1.1's hosted redirect and WhiteLabel's API-driven flow — as seven callable tools: list channels, start a payment, verify the confirmation. No UI, no card data touching this server, no human required in the loop.

Hash verification
SHA256("1|11|91|11.11|PLN|1|20010101111111|SUCCESS|AUTHORIZED|1test1")
= a103bfe581a938e9ad78238cfc674ffafdd6ec70cb6825e7ed5c41787671efe4
✓matches the digest in Autopay's own worked ITN example, byte for byte — this is the real signing algorithm, not a mock.
Two integration models

Same signature scheme, two different shapes

Both flows sign requests with the same SHA256/512(fields | shared key) scheme and confirm payments through the same ITN XML mechanism — they differ only in how the payer reaches Autopay.

Online v1.1 redirect

The merchant signs a request and sends the payer's browser straight to Autopay's hosted payment page. One tool: build the signed fields, redirect.

POST https://testpay.autopay.eu/
developers.autopay.pl →

WhiteLabel API-driven

The merchant calls Autopay server-to-server to discover channels and required consents, then starts the transaction on its own UI.

POST https://{host}/gatewayList/v3
autopay.gitbook.io →
Seven tools

What an agent can actually do here

Grouped by what they're for, not forced into one fake sequence — WhiteLabel's three steps run in order, Online v1.1 needs only one call, and the rest are for testing.

Starting a payment

online_create_checkout
Cart summary → signed redirect fields (Online v1.1).
whitelabel_list_gateways
Step 1 — the current payment-channel catalog.
whitelabel_get_legal_data
Step 2 — required consents for the chosen channel.
whitelabel_start_payment
Step 3 — starts the transaction, carrying acceptance IDs forward.

Confirming it

verify_itn
Recomputes the hash on an inbound notification, never trusts it blind, returns the reply XML.

Testing it

list_test_scenarios
Real test card numbers and BLIK codes, pulled from Autopay's own published test-scenario workbook.
build_test_itn
Builds a correctly-signed fake notification so verify_itn has something real to check.
Why this exists

The UI was never the moat

Wrapping a checkout in a conversational widget is easy for any competing PSP to copy through their own WhiteLabel integration. Exposing checkout as MCP tools is a different claim — that the integration is agent-native, not just human-native.

Being early here isn't about inventing something nobody else has — it's about being the obvious, working choice the moment an agent needs to check out with Autopay, before anyone else in our market has one.
— from this repo's commit history, 2026-08-31
Documentation ledger

What's confirmed, what's a best guess, what's missing

Autopay's docs weren't written for this — some of it is verified byte-for-byte, some is a best-effort reconstruction, and some genuinely isn't documented anywhere. All three are marked, in the docs and in this code, rather than smoothed over.

Hash algorithm — SHA256/512(fields | shared key)
Confirmed
ITN request + confirmation XML shape
Confirmed
Test card numbers & BLIK codes
Confirmed
Full hash field order beyond ServiceID·OrderID·Amount
Best‑effort
WhiteLabel gatewayList / legalData JSON response shape
Best‑effort
Consolidated gatewayID table
Gap
Full error-code catalog
Gap
Refund flow for an already-settled payment
Gap
Connect a client

Point an MCP client at it

Deployed at mcp.autopaylab.com — clone the repo to run it locally instead, or read the full setup (Bearer token, WhiteLabel host, real credentials) in the README.

Claude Code
claude mcp add --transport http autopay-checkout \
  https://mcp.autopaylab.com/api/mcp
Official Autopay MCP server — Open Beta. Actively developed and open to review: found something wrong, missing, or worth discussing? File an issue or open a PR against the repository.