Online Payments

Availability — Part of the Sales module. Manage modules and your plan tier in Account & Billing.

Knowledge ERP can collect customer invoice payments online through your own Stripe or Square account. Customers pay from the customer portal using a secure hosted checkout page, and the payment is recorded against the invoice when your provider's notification arrives and matches your signing secret (see Webhooks).

Payments use the provider's hosted checkout, so card details never touch Knowledge ERP and you stay outside of PCI scope.

Connecting a provider #

Open the Payment Collection settings page (under Account Administration), choose your provider, and enter its credentials. The connection is stored per account and the secrets are encrypted at rest.

Stripe #

Enter your secret key and publishable key. Spaces or a line break copied along with a key are removed when you save.

Square #

Enter your access token and location ID, and choose the environment (sandbox or production). Spaces or a line break copied along with the token or location ID are removed when you save.

The webhook signing secret comes after connecting, in the two steps under Webhooks below. If you already have it, you can enter it with the credentials.

Only one provider is active at a time. Connecting a different provider stops the first; reconnecting the same provider keeps your webhook address, so an endpoint you have already added to your provider's dashboard keeps working.

Saving makes one test call against the provider first. Nothing is stored, and your existing connection is left alone, unless the provider accepts the credentials — so "Connected" on this page means the provider itself confirmed them, not merely that the fields were filled in. If it refuses, the page shows the provider's own error; if it cannot be reached at all, it says so separately, because that means we could not tell either way.

Webhooks #

Completed payments reach Knowledge ERP through a webhook: your provider calls an address that is unique to your account, and the payment is recorded against its invoice. After connecting, the settings page shows that address. Set it up in two steps, in this order:

1. Add the address in your provider's dashboard. Stripe: subscribe it to checkout.session.completed, checkout.session.async_payment_succeeded and checkout.session.async_payment_failed. Square: subscribe it to payment.updated. Your provider then shows you a signing secret (Stripe's starts with whsec_; for Square it is the signature key). Paste the whole value: a Stripe signing secret is whsec_ followed by the rest of the secret, and a Square signature key is at least 16 visible characters; anything shorter is refused, and so is whsec_ on its own.
2. Paste that secret on the Payment Collection page and choose Save signing secret. There is no need to disconnect. Spaces or a line break around the secret are ignored, whether you paste it now or saved it earlier.

Until the secret is saved, customers are not offered online payment: no Pay button appears in the customer portal, and the settings page says setup is not finished. If your provider calls the address before then, Knowledge ERP does not accept the delivery, so the provider treats it as failed and can send it again, and the settings page tells you a webhook arrived that could not be checked. Providers retry for a limited time only, so check your provider's dashboard for any payment that is older.

Each incoming webhook is signature-verified, matched to its invoice, and recorded idempotently — a duplicate delivery never double-posts a payment.

If a notification arrives with a signature that does not match the signing secret saved on this page, Knowledge ERP does not record it and does not accept the delivery, so your provider treats it as failed and can send it again. The settings page then shows a notice with the time it arrived. The usual cause is a secret pasted from the wrong webhook address, or one changed at the provider: replace it with the one your provider shows for this address. A request that did not come from your provider shows the same notice, and so does a Stripe notification whose time is more than five minutes from this server's clock, for example a request captured and sent again, or a clock that is off. The notice goes away when you save a secret, when you disconnect, or when a correctly signed notification arrives. Providers retry for a limited time only, so check your provider's dashboard for any payment that is older.

How customers pay #

From the invoice email. Every invoice you email, rentals' and everyone else's, carries a Pay online button while it still owes something and a payment provider is connected with its signing secret saved. It opens a page showing what is owed; the customer presses Pay there and is taken to the provider's hosted checkout, as from the portal. Opening the link on its own starts nothing. The link keeps working: once the invoice is paid, or voided, or has a bank payment being confirmed, the page says so instead of offering to take a payment, and if card payments have been switched off since, it tells the customer to contact you.

Any receipt for the payment comes from your Stripe or Square account's own receipt settings. Knowledge ERP does not send one yet.

From the portal. On the customer portal, any invoice with a balance remaining shows a Pay button once a payment provider is connected and its signing secret is saved. The customer is redirected to the provider's hosted checkout, pays, and is returned to the portal. Once the provider confirms the payment and its notification arrives and matches your signing secret, it posts against the invoice as a credit-card payment and the balance updates.

Payment methods that settle later. If your Stripe account accepts a method that settles later, such as a bank debit, the customer's payment is submitted first and confirmed by the bank afterwards, which can take days. Knowledge ERP records it when Stripe sends the confirmation (the second Stripe event above), and only then. Until then the invoice shows Payment pending in the customer portal in place of the Pay button, with a note that the bank payment is being confirmed and can take several days, and the portal does not start another payment for that invoice while it shows. It appears when Stripe reports that the customer submitted the payment. The invoice still shows its balance, still counts as owing in accounts receivable, and can still be sent a reminder: nothing on the balance changes until the bank confirms the payment. If the bank rejects the payment (the third event), the pending notice clears and the Pay button returns, so the customer can pay again from the portal; the balance does not change and no notice is sent. If Stripe never sends either event, the marker lapses after 14 days and the Pay button returns (Stripe documents ACH Direct Debit at up to 4 business days to confirm or fail, and 14 days covers other delayed methods with margin). Staff can end it sooner with Clear Pending Payment on the invoice; it warns that the customer may have paid twice if the debit later succeeds. For now a payment made this way is recorded as a credit-card payment, as every online payment is.