Platforms
One integration, many stores, clear boundaries.
For marketplaces, agencies and software platforms that operate several stores: organisations, stores, team roles and scoped keys keep every tenant separate.
Workflow
How it runs, step by step.
- Platform
Organisation
One organisation per merchant business, with its own team, billing and verification status.
org_… - Merchant
Stores
Each store has its own checkout branding, currency and webhook endpoints.
store_… - Developers
Scoped keys
Live keys with scopes, optional store restriction, IP allowlists and one-time display — issued after approval.
gp_live_… - Team
Roles
Owner, admin, developer, finance, support and read-only, enforced on every server-side query.
RBAC - Auditors
Audit trail
Append-only audit events for privileged actions, exportable for reviews.
audit_events
Outcomes
What changes for your team.
Tenant isolation by default
The tenant always comes from the authenticated principal. Cross-tenant access is tested for every merchant object.
Per-store branding, safely
Store names and logos come from sanitised, verified settings — never from query parameters or untrusted input.
Least-privilege teams
Finance can export, support can read, developers can manage keys — without everyone being an owner.
Evidence for reviews
Audit events and payment timelines give compliance and support teams the same facts.
Before you integrate
Things to decide up front.
- Payments are custodial: they go to the platform’s wallets and each merchant withdraws its own balance through approved payouts. Private keys are never requested from merchants.
- Live payments are enabled per organisation once its business verification is approved and the platform’s release gates have passed; plan your onboarding around that.
- Business verification is a manual workflow until a verification provider is integrated — show merchants “pending”, not “verified”.
- Decide which webhook events each store subscribes to and who rotates their signing secrets.