Quick Answer: Philippine merchants can accept GCash payments via API by integrating with a licensed payment gateway — HitPay supports GCash as both an online and offline (in-person) payment method in the Philippines, with next business day settlement in PHP for domestic transactions. The integration uses a payment request API, a hosted checkout or embedded QR, and a webhook endpoint to confirm payment status. Merchants who prefer not to build a custom integration can use HitPay's no-code payment links or plugins for Shopify, WooCommerce, and Wix.

GCash has become one of the Philippines' most widely used digital wallets, with transaction volumes tracked by the Bangko Sentral ng Pilipinas rising consistently year-on-year as the country accelerates its shift away from cash. For online businesses in BGC, Makati, and Cebu, offering GCash at checkout is no longer optional — it is a baseline expectation from Filipino consumers.

Integrating GCash via API, however, is not a direct wallet-to-wallet connection. Philippine merchants do not integrate with GCash's infrastructure directly. Instead, they connect through a licensed payment gateway that holds the GCash acquirer relationship — and build against that gateway's API. Understanding this architecture is the first step to a reliable integration.

According to BSP payment system statistics, digital payment transactions in the Philippines have grown substantially, with InstaPay and PESONet volumes reflecting broad adoption of real-time fund transfers alongside e-wallet payments — reinforcing the commercial case for multi-method acceptance.

What Does a GCash API Integration Actually Involve?

GCash acceptance through an API follows a three-stage flow common to most Philippine payment gateways:

1. Create a payment request — the merchant's server calls the gateway API with the transaction amount, currency (PHP), and specified payment method (GCash).

2. Present the checkout — the API returns either a hosted checkout URL or an embedded QR code. The customer is redirected or shown the QR to scan with their GCash app.

3. Handle confirmation — the gateway sends a webhook POST to the merchant's server when the payment completes. The server verifies the signature and updates the order status.

This flow applies whether the merchant is building a custom e-commerce checkout in Quezon City or embedding payments into a mobile app serving customers across Davao.

The most consequential decision in this flow is step three. Polling the API for payment status is unreliable in production — if a customer closes the browser before the poll cycle completes, the payment may be missed. Webhooks are the production-grade approach.

How Do Webhooks Work for GCash Payment Confirmation?

When a GCash payment is completed, the gateway sends an HTTP POST to the merchant's registered webhook endpoint. The payload includes payment status, reference numbers, and an HMAC-SHA256 signature that must be verified before the merchant system trusts the event.

The verification process follows this pattern:

1. Receive the POST payload at the merchant's webhook URL (e.g. /api/hitpay/webhook).

2. Extract all fields except hmac from the payload.

3. Sort the remaining keys alphabetically.

4. Concatenate as key + value pairs in sorted order.

5. Compute HMAC-SHA256 of the concatenated string using the merchant's API salt.

6. Compare the computed hash against the hmac field in the payload.

7. If they match and status === 'completed', update the order record.

8. Return HTTP 200 to acknowledge receipt.

Signature mismatches are most commonly caused by using a sandbox salt in a production environment, or by computing the HMAC over a re-serialised payload rather than the raw field values. The salt value is environment-specific — sandbox and production keys are separate.

The HitPay API also enforces rate limits: 400 requests per minute across all endpoints, with an additional cap of 70 requests per minute on the payment request endpoint specifically. For high-volume merchants, this means webhook-driven confirmation is not just preferable — it is architecturally necessary to avoid hitting limits from polling.

What Are the API Endpoints and Parameters for GCash Payments?

HitPay's payment request API accepts a payment_methods parameter that specifies which methods to present at checkout. To surface GCash specifically, merchants pass the GCash method identifier alongside any other methods they wish to enable — for example, GCash together with QR Ph, Maya, Visa, and Mastercard.

A minimal payment request includes:

• Amount — in PHP, as a decimal string

• Currency — PHP

• Payment methods — array specifying gcash and any additional methods

• Webhook URL — the merchant's endpoint for payment confirmation (note: the production-grade approach is to register the webhook URL in the HitPay dashboard rather than passing it inline per request — check the current API docs for the recommended configuration)

• Redirect URL — where to send the customer after payment

The API response returns a url field — the hosted checkout page where the customer completes the GCash payment. For in-person scenarios, the API can return an embedded QR code value that the merchant renders on a display or receipt.

HitPay's changelog confirms that GCash offline (in-person) support was activated in April 2025, with daily settlements credited to the merchant's HitPay wallet. New merchants onboard through the Payment Methods page via form submission; existing GCash merchants have offline support auto-enabled.

Does a Custom API Build Make Sense for Every Merchant?

Not always. API integration makes sense when a merchant has:

• A custom-built e-commerce platform or mobile app that cannot use a plugin

• Specific checkout UI requirements that a hosted page cannot satisfy

• Backend order management systems that require programmatic payment triggering

For merchants running Shopify, WooCommerce, or Wix stores, plugin-based integration is faster and requires no server-side code. HitPay's WooCommerce plugin for the Philippines and Shopify plugin for the Philippines both support GCash, QR Ph, Maya, cards, and other local methods out of the box — without writing a single line of API code.

For merchants who want to accept GCash without any integration at all, payment links are the fastest path. HitPay's payment links generate a checkout URL that accepts GCash and other methods — shareable via Viber, email, or SMS — with no technical setup required. This approach is particularly common among Makati-based service businesses and freelancers who invoice clients directly. For a deeper look at how payment links support cash flow for Philippine SMEs, the guide on invoice payment for SMEs in Southeast Asia covers the mechanics in detail.

For developers evaluating drop-in UI options — where the checkout form is embedded directly on the merchant's page rather than via a redirect — HitPay also provides HitPay.js, a drop-in checkout UI that supports all local Philippine payment methods with minimal front-end code.

What Payment Methods Should a Philippines API Integration Support Alongside GCash?

GCash is the dominant e-wallet in the Philippines, but a production-grade integration should support the full range of Filipino payment preferences. The table below covers the primary methods and their use cases:

For Philippine merchants serving international visitors or overseas Filipino customers, HitPay also supports cross-border acceptance of PayNow (Singapore), QRIS (Indonesia), PromptPay and TrueMoney (Thailand), DuitNow (Malaysia), and KakaoPay, PayCo, and Naver Pay (South Korea) — with settlement timelines that vary by market for cross-border transactions. The broader picture of how alternative payment methods drive conversion across Southeast Asia is covered in detail in this guide to alternative payment methods in Southeast Asia.

HitPay supports GCash alongside all of the above methods through a single API integration, with no monthly fees and no setup fees — pay per transaction only. Domestic transactions settle next business day in PHP. For current card transaction rates, see hitpayapp.com/pricing.

Practical Takeaway

GCash API integration in the Philippines is not a direct wallet connection — it runs through a licensed gateway that holds the acquirer relationship. The core integration involves three elements: a payment request API call, a hosted checkout or embedded QR, and a verified webhook endpoint for confirmation. Merchants building on Shopify or WooCommerce can skip the API entirely and use a plugin. Those who need programmatic control should prioritise webhook-based confirmation over polling, register webhook endpoints in the dashboard rather than passing them inline per request, and test against the sandbox environment before going live. Settlement on domestic GCash transactions is next business day in PHP.

Frequently Asked Questions