01, In-person payments
In the shop
Terminals on the counter, in the hand, on the wall, and out in the weather. Tap to Pay on iPhone and Android when there is no terminal at all.
- Countertop
- Handheld
- Tap to Pay
- Unattended
Surfboard Payments
Surfboard is the payments platform behind financial institutions, ISVs and enterprises. In-store, online and agentic, one integration, one settlement, multi-clouds.
Point your coding agent at Surfboard
See it in your colours
We read your public site to pick the terminals, capabilities and guides that fit, and to put your brand on the hardware. Nothing is stored on our side.
Cards · Apple Pay · Google Pay · Swish · Vipps · MobilePay · Klarna · Pay by Bank · Gift cards · Invoice
The same methods, across every channel
Trusted by
Customers include SAS, BookSalon, Liveday, CareLabs, Swepearl, AB Karl Hedin, Payer and Hemglass.
A terminal vendor. A gateway. An acquirer who owns the hardware. A reconciliation spreadsheet only one person in finance fully understands. Each new channel arrives as another integration, another report, and another wait on somebody else's roadmap.
None of it was designed. It just kept being added to.
4–6
vendors to take payments in a single shop
12–24
months waiting on a feature you don't control
250+
questions on a full PCI assessment
0
of your hardware kept when you change acquirer
Merchant onboarding, terminals, Tap to Pay, online checkout, tips, tokenization, gift cards, settlement and analytics arrive through the same API. Add a channel later and there is nothing new to integrate, only something new to switch on.
One POST /orders creates the order
and starts the payment.
initiatePaymentsOptions picks the
method, card, Swish, Klarna, gift card, invoice, a saved token, and
the rest of controlFunctions carries
the behaviour: tips, pre-auth, delayed capture, delayed payout,
surcharges, split payments, NFC tag reads.
Add an online block and the same call
hands back a hosted payment page instead, 3-D Secure, tokenization,
link expiry and your own redirect URLs. Nothing else about the request
changes, and both land on one settlement report.
The documentation is addressable by machines as well as people, so a coding assistant can do most of the work while you read this.
Create an order and take a payment on a terminal
POST /orders
{
"terminal$id": "83a3b280c51b280604",
"referenceId": "order-3312",
"orderLines": [
{
"id": "0000CHI01",
"name": "Nike Shoes",
"quantity": 2,
"amount": {
"regular": 200, "campaign": 100, "shipping": 50,
"total": 350, "currency": "752",
"tax": [{ "amount": 0, "percentage": 0, "type": "VAT" }]
}
}
],
"controlFunctions": {
"orderLineLevelCalculation": true,
"tipsMode": "ROUNDUP",
"delayCapture": true,
"initiatePaymentsOptions": {
"paymentMethod": "CARD"
}
}
} What comes back
initiatePaymentsOptions is what turns order creation into a payment. Drop it and you get an order that waits.
The same call, returning a hosted payment page
POST /orders
{
"terminal$id": "83abab731f6fb00704",
"orderLines": [ /* … */ ],
"controlFunctions": {
"initiatePaymentsOptions": {
"paymentMethod": "CARD"
},
"online": {
"enforce3DSecure": true,
"enforceTokenization": true,
"paymentPageValidFor": "15m",
"generateShortLink": true,
"redirectUrl": "https://shop.example/thanks",
"failureRedirectUrl": "https://shop.example/retry"
}
}
} What comes back
The online block is the only difference. Same endpoint, same order model, same settlement report as the shop floor.
Follow the order to completion
GET /orders/{orderId}/status
{
"status": "SUCCESS",
"data": {
"orderStatus": "PAYMENT_COMPLETED",
"payments": [
{ "paymentId": "83a1ba3264bd500106",
"paymentStatus": "PAYMENT_COMPLETED",
"paymentMethod": "CARD",
"amount": 350 }
],
"transactions": [
{ "transactionId": "…", "rrn": "…", "cardBrand": "VISA",
"truncatedPan": "4242", "cvmMethod": "…",
"fee": "…", "payout": "…",
"settlementStatus": "SETTLED" }
]
}
} What comes back
Or skip the polling entirely, set controlFunctions.callBackUrl and we webhook you instead.
01, In-person payments
Terminals on the counter, in the hand, on the wall, and out in the weather. Tap to Pay on iPhone and Android when there is no terminal at all.
02, Online checkout
Hosted pages, SDKs, server-to-server, payment links. Cards, Swish, Klarna, Apple Pay, Google Pay, Pay by Bank, settled on the same report as the shop floor.
03, Agentic commerce
Autonomous software creates orders, triggers payments and manages the full lifecycle over the same API a human would use. Endpoints documented for LLMs.
Open the box, enter a pairing code, take a payment. Every device runs the same payment application, so the terminal on the counter and the one on the delivery bike behave identically against the integration you have already written. Fleet configuration is remote, and it is an API call.
Active instances run on Google Cloud, AWS and Azure at the same time, three independently certified providers, in sync. If one slows, traffic moves. No manual failover, no maintenance window, no apology email.
Under certain conditions the architecture satisfies PCI B-IP, taking your assessment from 250-odd questions down to roughly 45, close to P2PE simplicity without the P2PE bill.
What PCI DSS actually requiresNot a pilot, and not a sandbox, a real merchant taking real money the same working day. Most platforms measure onboarding in quarters. We had time for lunch.
Minutes
Sign up and get a full test environment with every endpoint live.
Hours
One integration covers every channel you will ever switch on.
Same day
Merchants, stores and terminals configured over API or portal.
5 h record
Flip to production and start settling real transactions.
Every authorisation carries context, who paid, on what, in which channel, at which store. The platform hands that back to you as something you can build a business on rather than a CSV you reconcile on Fridays.
Save a card at the terminal and charge it again later. No PCI scope lands on you.
Presets or free amounts, configured at partner, merchant, store or terminal level. Override at any tier.
Authorise now, capture later. Partial captures, voids and refunds through the API.
One physical device, several merchants, each settling to their own account.
Fund-based or entitlement-based, created over the API and redeemed in every channel.
One settlement and one set of analytics covering every method and every channel.
Surfboard Payments AB is a licensed payment institution supervised by Finansinspektionen, the Swedish Financial Supervisory Authority. We carry the regulatory weight so the software on top of us doesn't have to.
In the press
Apple
Google Cloud
Financial IT
Dagens Industri
IBS Intelligence
The Paypers
Accepted everywhere we operate
From the newsroom
All writingShipped recently
ChangelogSpin up a sandbox this afternoon, or tell us what you are trying to launch and we will show you where Surfboard fits. Either way, the first payment is closer than you think.
Tell us what you're building