> ## Documentation Index > Fetch the complete documentation index at: https://docs.hitpayapp.com/llms.txt > Use this file to discover all available pages before exploring further. # Overview > How SaaS platforms, marketplaces, and aggregators can offer HitPay payments to the businesses they serve ## Overview Platforms that serve other businesses - CRMs, booking systems, marketplaces, agency tools, and vertical SaaS products - often need to offer payment acceptance to their customers without holding a payment institution licence themselves. HitPay's **Platforms** model is designed for this, commonly referred to as a **master–sub-merchant** or **aggregator** model: * **You (the platform)** integrate HitPay once and create payments on behalf of your business customers. * **Your sub-merchants** (your business customers) each hold their own HitPay account, complete their own verification, and receive payouts directly to their own bank account. * **HitPay** holds the relevant payment institution licences (e.g. MAS in Singapore, BNM in Malaysia, BSP in the Philippines), performs KYB/KYC review, and processes the underlying payments. Whichever integration path you choose below, every sub-merchant needs their own verified HitPay account: they [sign up](https://dashboard.hit-pay.com), complete [Business Verification](/setup/business-verification), and remain subject to HitPay's standard [business restrictions](/onboarding/business-restrictions). Payouts follow HitPay's standard [payout schedule](/getting-started/payouts) and go directly to each sub-merchant's own bank account - funds are not pooled through the platform. ## Ways to integrate There are two ways for your platform to get access to a sub-merchant's account, plus an add-on that works with either. ### Option 1: Direct API key integration The simplest approach: the sub-merchant generates their **Merchant API key** in their dashboard under **Developers → API Keys** and enters it into your platform's UI. You store the key and call the HitPay API on their behalf using the `X-BUSINESS-API-KEY` header, exactly as documented in the [API Reference](/apis/overview). This requires no platform setup at all - but it comes with real risk: * The API key grants **full access** to the sub-merchant's account, far more than most platform integrations need. * You are storing a live, non-expiring secret for someone else's business. * If the sub-merchant also uses that key for their own integration, rotating it on either side silently breaks the other. > [!WARNING] > > Not recommended when the sub-merchant has (or may build) their own HitPay API integration. Use OAuth instead. ### Option 2: OAuth - "Connect your HitPay account" The structured alternative to collecting API keys. You build an OAuth app once, add a **Connect your HitPay account** button to your platform, and sub-merchants authorize it in a couple of clicks. Your platform receives its own access tokens, scoped to just the permissions you requested, and sub-merchants can revoke access from their dashboard at any time - no secrets change hands. See [Connect Merchant Accounts (OAuth)](/platforms/oauth) for the full integration guide. > [!NOTE] > > OAuth apps are currently in **beta**. Tokens currently cover payments (payment requests, charges, refunds, subscription plans, and recurring billing), commerce (products, product categories, orders, and invoices), and customers. Other APIs — for example webhooks, virtual accounts, static QR, and terminals — still require a merchant API key. See [OAuth scopes](/platforms/oauth#scopes). ### Add-on: Platform enablement Independent of how you access sub-merchant accounts, you can have your own HitPay account enabled as a **Platform account** (contact **[support@hit-pay.com](mailto:support@hit-pay.com)**). This gives you a **Platform Key** (dashboard: **Settings → Platform**) which you pass as an `X-PLATFORM-KEY` header alongside either a merchant API key or an OAuth token. It unlocks two things: 1. **Commissions** - earn a share of every payment you create for your sub-merchants, either as a platform-wide percentage Commission Rate or a fixed `platform_commission_amount` per transaction. 2. **Unified webhooks** - charge events for all your sub-merchants' payments are delivered to webhook endpoints registered on **your** platform account, so you monitor one webhook instead of one per sub-merchant. See [Platform Key](/apis/guide/platform-apis) for setup and API details. ## Choosing a path | | Direct API key | OAuth | | - | - | - | | Sub-merchant onboarding | Copies API key from their dashboard into your UI | Clicks **Connect your HitPay account** and approves | | Access granted | Full account access | Only the scopes you request | | Secret handling | You store their live API key | You store tokens issued to your app | | Revocation | Sub-merchant rotates their key (breaks their own integrations too) | Sub-merchant revokes your app from their dashboard | | API coverage | Entire HitPay API | Payments, commerce, and customers (see [OAuth scopes](/platforms/oauth#scopes)) | | Commissions & unified webhooks | ✓ with `X-PLATFORM-KEY` | ✓ with `X-PLATFORM-KEY` | > [!NOTE] > > This page reflects the model as it exists **today**. HitPay's Platforms program continues to evolve, and partner needs vary by market and merchant profile - where a use case goes beyond what's described here, our Sales & Partnerships Team at **[sales@hit-pay.com](mailto:sales@hit-pay.com)** can advise on the best path forward. ## FAQ > **Do sub-merchants need their own payment institution licence?** > > No. This is a core benefit of onboarding as a HitPay sub-merchant - HitPay is the licensed, regulated entity, and sub-merchants operate under HitPay's compliance umbrella once verified. > **Where do payouts go - to the platform or to the sub-merchant?** > > Directly to each sub-merchant's own bank account, following HitPay's standard [payout schedule](/getting-started/payouts). Funds are not pooled through the platform. > **Can our platform create the HitPay account and complete verification for our sub-merchants, since we already collect their documents?** > > Today, each sub-merchant signs up and completes [Business Verification](/setup/business-verification) directly with HitPay - this keeps KYB ownership clearly with HitPay and gives the sub-merchant direct visibility into their own account from day one. Many platforms streamline this by referring merchants straight into HitPay's sign-up flow so the handoff feels seamless. If your program has specific onboarding requirements - including using documents you've already collected - our Sales & Partnerships Team at **[sales@hit-pay.com](mailto:sales@hit-pay.com)** can work with you to find the best approach for your markets and merchant profile. > **Is there an API for submitting a sub-merchant's KYC/KYB documents to HitPay?** > > Not yet as a standalone API - Business Verification is currently a dashboard flow completed by the sub-merchant. This is an area we're happy to discuss further with platform partners who have high onboarding volume, so reach out to our Sales & Partnerships Team at **[sales@hit-pay.com](mailto:sales@hit-pay.com)** to explore what's possible for your program. > **Can commissions be set per sub-merchant or per transaction?** > > Yes. A platform-wide percentage Commission Rate can be set, or overridden per transaction with `platform_commission_amount`. See [Platform Key](/apis/guide/platform-apis#set-a-commission-per-transaction). > **What if sub-merchants are outside Singapore, Malaysia, the Philippines, or Indonesia?** > > Card payments for merchants outside these markets are processed through Stripe Standard Connect, which the sub-merchant sets up directly with their own Stripe account. See [Standard Connect Integration](/connections/stripe/standard-connect). ## Get started Contact **[support@hit-pay.com](mailto:support@hit-pay.com)** to enable Platform access for your account. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.