Module and release scope
This guide covers Adyen Pay by Link 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.
Open System → Payment gateways (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.
Exact connection fields
These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.
| Key / label | Type | Required | Default / guidance |
|---|---|---|---|
mode — Environment |
select | Yes | Default: "sandbox" Choices: sandbox = Sandbox, live = Live |
api_key — Server API key |
secret | Yes | Use the account-specific value described below. |
merchant_account — Merchant account |
text | Yes | Use the account-specific value described below. |
live_prefix — Live API URL prefix |
text | No | For live payments only: Developers → API URLs → Prefix. Enter the prefix, not a URL. |
hmac_key — Standard webhook HMAC key |
secret | Yes | 64 hexadecimal characters. Enable Standard JSON CAPTURE notifications and delayed automatic or manual capture. AUTHORISATION alone never records payment. |
accepted_currencies — Enabled invoice currencies |
text | Yes | Default: "EUR" Comma-separated approved two-decimal invoice currencies. |
Adyen Checkout API v72 payment links, with confirmed-capture Standard JSON webhooks. Requires EmailaBiller 1.3.6 or later. Installed disabled and without merchant data.
Configure
- Create an Adyen test merchant account. Add the terms and conditions required for Pay by Link and enable approved payment methods in the Customer Area.
- Under Developers → API credentials, create a server API key for the merchant account with Merchant PAL webservice role and Checkout webservice role. Copy the merchant account name exactly. A client key is not the server API key.
- Configure a Standard JSON webhook with this connection's HTTPS webhook URL. Generate its HMAC key and enter the 64-character hexadecimal value in this module. Use separate credentials and HMAC keys for test and live environments.
- This module requires CAPTURE events. Configure delayed automatic capture and enable CAPTURE notifications, or use manual capture and capture the payment in Adyen. Include Pay by Link
paymentLinkIdadditional data. The default immediate-authorization webhook alone does not confirm captured funds and will leave an invoice unpaid. - Enter approved two-decimal invoice currencies. Save and Test; the test only retrieves available payment methods. It creates no payment link, authorization or charge. Complete a sandbox checkout and confirm capture delivery before enabling production.
- In live mode also enter Developers → API URLs → Prefix, not a whole URL. The module constructs only Adyen's fixed live endpoint. Re-test and enable explicitly.
Payment verification
The customer opens an Adyen-hosted link. A successful CAPTURE webhook must pass the Standard HMAC check, merchant-account and environment checks. The module then authenticates a read of the indicated payment link and matches its original reference, exact amount/currency and completed status. HMAC-uncovered additional data cannot redirect API reads to another host. The core also checks the known invoice attempt and deduplicates the PSP payment reference.
AUTHORISATION, failed captures, refunds and unsigned browser claims never record payment. Do not configure SOAP/batched notifications. Payment-link reads alone cannot prove capture, so browser settlement and staff reconciliation are intentionally not exposed. After Adyen's payment-link retention window, use provider-led billing review. Recurring payments and automated captures/refunds are not implemented.
Provider documentation
- Pay by Link API and setup
- Checkout v72 payment-link endpoint
- API roles
- Merchant-specific live endpoints
- Standard webhook HMAC verification
- Capture payload and payment-link additional data
- CAPTURE delivery and JSON notification structure
- Read-only payment-method lookup
Checkout creation is submitted once, with an idempotency key. Errors show safe HTTP status guidance without disclosing API credentials or customer response bodies.