Google Pay

Google Pay is the digital wallet offered by Google to store your cards and pay quickly and securely.

Activation

To make this payment method available on the checkout page, it is necessary to configure and activate the service by accessing the page dedicated to Google Pay in the back office. A Google registration is not required.

Payment

Payment with Google Pay is compatible and follows the specifications of the following integration methods:

• Hosted Payment Page
• Pay-by-Link
• XPay Build

Below is a summary table of the compatibility and potential limitations of the payment method with the services provided by the XPay gateway:

Countries	Global
Minimum amount	No limit
Maximum amount	No limit
Payment	Yes
Preauthorization	Yes
Maximum preauthorization period	27 days
Implicit capture	Yes
Explicit capture	Yes
Maximum explicit capture period	5 days
Recurring	No
OneClick	No
Full refund	Yes
Partial refund	Yes
Multiple partial refunds	Yes
Maximum refund deadline	365 days

Integration via Google API

Through this method, Nexi will only handle the payment authorization; data related to Google Pay will be collected by the merchant's website or app, which will forward the JSON received from Google to Nexi through the API:

POST /orders/googlepay

To use this service, it is required to follow the official integration guide for the Google Pay API. To integrate Google Pay, it is necessary for the merchant to adhere to the Google API Terms of Service, Usage Policy, and Brand Guidelines: https://developers.google.com/pay/api/web/guides/brand-guidelines.

Below is the payment flow:

1. Payment initiation: the user clicks the Google Pay button.
2. Card selection from the wallet: the native Google Pay (Google Wallet) interface is activated, displaying the cards stored on the user's account or device.
3. Token generation: The user selects a card and authenticates if required by the device (biometric unlock or passcode). Google Pay then returns a payment token to the website's front-end.
4. Submission to the backend: The website's front-end transmits the payment token and order details to its backend.
5. Authorization via Nexi: the backend processes the transaction and sends the token to Nexi for charging via the API:
   POST /orders/googlepay

During integration, Google will request information about the payment provider used during the authorization phase through the "tokenizationSpecification" object. Below are the data to set:

• "gateway": "nexigtw"
• "gatewayMerchantId": "" → generate a UUID and use it as a fixed identifier. The same value must be reused for all requests, without regenerating it each time. It only needs to be unique.

The behavior of the POST /orders/googlepay API varies depending on how Google Pay returns the payload with payment data:

• Payload with tokenized PAN (CRYPTOGRAM_3DS): the XPay API will process the payment by completing the transaction. This scenario applies when the payment is made from an Android device with Google Wallet installed and a registered card. The device must also have an active authentication method (screen lock) with an adequate security level.
  Below is an example of a response:
  { "operation": { "additionalData": { "functionCode": "101", "maskedPan": "411111******1112", "cardCountry": { "alpha3Code": "ITA", "alpha2Code": "IT", "italy": true, "description": "ITALY", "code": "380", "sqlValue": "380" }, "authorizationCode": "600806", "cardType": "MONETA", "authorizationStatus": "000", "cardId4": "EwmGJbC4NG1MTP5LdKpgzsd/P9Sjuugx+OyPgEWuChc=", "tokenization": "GOOGLE_PAY", "rrn": "433388888888", "messageReasonCode": "1510", "trn": "PDV", "omnichannelId": "MZSBXTFI08001260710-15176189880110001", "posDataCode": "100050J00100", "installmentQty": 0, "securityType": "1", "cardId": "04c447dce14bbbcbbc5aad3d2b512ae52782fe407ea37128cc91f2483d70ba52", "authMethod": "CRYPTOGRAM_3DS", "cardBrand": "VISA" }, "channel": "ECOMMERCE", "customerInfo": { "recontactConsent": false }, "operationAmount": "200", "operationCurrency": "EUR", "operationId": "785768057300861919", "operationResult": "AUTHORIZED", "operationTime": "2026-07-10 15:39:43.485", "operationType": "AUTHORIZATION", "orderId": "order-1783690783", "paymentCircuit": "GOOGLE_PAY", "paymentEndToEndId": "600806", "paymentInstrumentInfo": "***1112", "paymentMethod": "APM", "warnings": [] }, "paymentFlow": "CRYPTOGRAM" }
  For details on the object's content, please refer to the response schema of the GET /operations/{operationId} API.
• Payload with clear PAN (real PAN, PAN_ONLY): the XPay API will not directly process the payment but it will return the data required to perform 3D Secure authentication. This scenario applies in cases that do not fall under the CRYPTOGRAM_3DS category, for example when the payment is made from a Windows PC or an iOS device.
  The flow is described below.

PAN_ONLY flow

To allow customers to pay using this method, you must configure the following constant on the Google side:

It is also mandatory to include the following parameters in the POST /orders/googlepay API call:

• resultUrl
• notificationUrl
• cancelUrl

These fields are required to handle the transaction outcome upon completion of the 3D Secure authentication.

After receiving the token from Google and subsequently calling the POST /orders/googlepay API, the following object will be returned:

You must create a new HTML page layout containing a single iframe to allow the 3D Secure server to collect the sensitive browser data needed to assess the transaction risk. The content of the iframe must be the URL specified in the "src" parameter.

In this case, the frame can remain hidden as the loaded page does not show any information.
The operation can take from 2 to 10 seconds, so it is appropriate to show a loader to let the user know that something is going on in background.
The iframe will communicate the completion of the data collection via an event; to handle these communications, you must include the Nexi SDK on the page. Insert this declaration anywhere on the page, replacing "nexiDomain" with the XPay sandbox (https://xpaysandbox.nexigroup.com) or production (https://xpay.nexigroup.com) domain:

At the end of the GDI phase, one of the following two scenarios may occur:

• 3D Secure Authentication: the payment requires strong customer authentication (SCA - Strong Customer Authentication) by the cardholder. The onBuildFlowStateChange event containing the 3D Secure authentication address will be returned. The customer must be redirected to this address:
  { "event": "BUILD_FLOW_STATE_CHANGE", "state": "READY_FOR_PAYMENT", "data": { "state": "REDIRECTED_TO_EXTERNAL_DOMAIN", "url": "https://xpaysandbox.nexigroup.com/authorization-stub/ui/threeds/one/5069aec8-97bb-4c92-ae2e-5d9210ac948f/auth" } }
  • evtData.data.state: populated with "REDIRECTED_TO_EXTERNAL_DOMAIN".
  • evtData.data.url: 3D Secure authentication URL, to which the customer must be redirected.

  Redirecting to the external page will allow the customer to complete any authentication required by the bank and, at the same time, enable the XPay gateway to finalize the payment.

  To handle the outcome, the URLs configured in the parameters sent during the initial POST /orders/googlepay API call will be used:

  • resultUrl
  • notificationUrl
  • cancelUrl
• Payment result: the transaction does not require 3D Secure authentication by the cardholder, the payment is then completed. Parameters are returned:
• "operation": object containing the detail of the operation. For details on the object's content, please refer to the response schema of the GET /operations/{operationId} API.
• "state": set with "PAYMENT_COMPLETE". Please note: this status only indicates that the payment process has ended, not that the transaction was successful. To determine the actual outcome of the payment, check the "operationResult" parameter within the "operation" object mentioned above.