How to Take Swish Payments with Gravity Forms in Sweden

In Sweden, Swish is how people pay each other, their football club, the local bakery and, more and more, the businesses they book and buy from online. If you sell courses, event tickets, memberships, services or a handful of products from a WordPress site, your customers will look for Swish at checkout. Gravity Forms is the form builder many of those sites already use for bookings, registrations, orders and donations. This tutorial shows how to join the two, so that every form submission becomes a Swish payment request for the exact form total, and every payment is confirmed by Swish before your team treats it as paid.

We use the Gravity Forms Swish Premium Add-on, a plugin that talks to the Swish Commerce API from your own server with your own Swish for merchants agreement. Once your certificate is ready, it takes about twenty minutes from installing the plugin to your first test payment with the Merchant Swish Simulator.

Why take Swish payments through Gravity Forms?

A lot of small businesses start by printing their Swish number on the booking page: the customer fills in the form, opens the app, types the number and the amount, and writes their name in the message. Then someone compares the bank statement with the bookings. It works for a few orders a week, but amounts get typed wrong, messages get left out, and nobody knows which booking a payment belongs to. Swish also recommends that businesses selling online do not show their Swish for merchants number to customers.

With the form and the payment joined together, the payment request is created for the customer with the right amount and message, the customer only has to approve it, and the entry in Gravity Forms shows the payment status, the Swish payment reference and any refunds. Your notification emails can wait until the payment is confirmed, so nobody starts work on an unpaid booking.

How a Swish payment works

• The customer fills in your form and sees the total in kronor, for example 1 250,50 Kr. If they like, they enter their mobile number.
• When they submit, your server creates a Swish payment request for that exact total and shows a payment page.
• With a mobile number, the request appears in the Swish app on their phone. Without one, the page shows an Open Swish button on a phone and a QR code on a computer.
• The customer approves the payment in the Swish app with BankID. Swish moves the money straight to your bank account.
• Your site reads the payment back from Swish and the payment page moves on to your thank-you message.

Forms that work well with Swish

• Course and workshop bookings with a fixed price per place.
• Event, race and conference registrations with ticket types and quantities.
• Club memberships, season fees and admission fees.
• Deposits for services, for example a consultation, a repair or a photo session.
• Simple product orders where a full online shop would be too much, and donations with a chosen amount.

What you need

• WordPress with Gravity Forms 2.9 or newer, on https.
• A Swish for merchants agreement with your bank for the Swish Commerce API, and your Swish number (ten digits starting with 123).
• A client certificate from Swish Certificate Management and the private key you made it with.
• For testing: the free Swish test certificate package for the Merchant Swish Simulator.

Step 1: Make your Swish certificate

Swish does not use passwords or API keys for this. Your site proves who it is with a client certificate, and Swish checks it on every call. You make the certificate once, and it lasts two years:

1. On your computer, create a private key and a certificate request (most hosts and IT partners can help with this step). Protect the key with a passphrase.
2. Log in to Swish Certificate Management with BankID, enter your organisation number and Swish number, paste the certificate request and choose PEM.
3. Save the certificate text Swish gives you. It includes your certificate and the Swish certificates above it.

Keep the private key safe. You will paste it into the plugin settings once; after that the plugin stores it encrypted and never shows it again.

Step 2: Install the add-on and connect it

1. Upload and activate the plugin, then activate your licence key in Forms → Settings → Swish.
2. Leave the mode on Test and enter the test Swish number, test certificate, key and passphrase from the Swish test package. Paste the simulator’s root certificate into the Test server root certificate field.
3. Save. The plugin checks that the key belongs to the certificate and that the certificate was made for the Swish number, then checks the connection with Swish in a way that creates nothing. The connection line turns green and shows the certificate’s expiry date.
4. In Forms → Settings, set the Gravity Forms currency to Swedish Krona.

Step 3: Build the form

Create the form as usual: name, email, your product fields and a total field. Add a phone field labelled something like “Mobile number for Swish (optional)”. Gravity Forms already knows the Swedish krona, so a course at 950 kronor shows as 950,00 Kr and the total as 1 250,50 Kr. Gravity Forms works out the total in the browser for the customer and again on your server when the form is submitted; the plugin always uses the server total, so a changed page cannot change the amount.

Step 4: Add a Swish feed

Open the form settings, choose Swish and add a feed. Pick Products and Services (or Donations) and map the Swish mobile number to your phone field. Write the message the customer sees in the Swish app, for example “Drejkurs {entry_id}”. Swish keeps messages to 50 characters of letters, digits and a few punctuation marks; the plugin tidies anything else away for you. Keep “Send form notifications only after the customer has paid” ticked if your team should only hear about paid bookings.

Step 5: Test with the Merchant Swish Simulator

Open your form, fill it in with a mobile number and submit. You land on the payment page with the amount and the instruction to open Swish. The simulator answers like Swish does and posts its callback to your site; the payment page moves on to your thank-you message. In Forms → Entries, the entry shows Paid, the Swish payment reference and a note that it was a test payment. Then submit again without a number to see the Open Swish button and the QR code.

What happens behind the scenes

1. The form is checked on the server: the currency must be SEK, the total must have no more than two decimals and be within the limits, and a mobile number, if given, must be one Swish can use.
2. The payment is saved with the entry: a unique reference, the exact amount, the mode and the message.
3. Your server creates the payment request at Swish with its own id, your Swish number and the saved amount. The certificate files exist only for the length of that call.
4. When Swish posts its callback, when the payment page asks and every five minutes, the plugin reads the payment request back from Swish.
5. Only a request Swish reports as paid, with the entry’s reference, your Swish number, the amount and SEK, marks the entry Paid. Anything else is noted and left for you to check.

Step 6: Refunds

Customers cancel, and sometimes you need to give money back. Open the entry, type the amount in the Swish box and press Refund with Swish. The plugin reads the payment back first, sends the refund to Swish and records it when Swish reports it paid out, usually within seconds. You can refund in parts, several times, up to the amount paid, for up to 13 months after the payment. When everything has been refunded, the entry becomes Refunded.

A worked example

A ceramics studio in Stockholm sells an evening wheel course at 950,00 Kr and a clay and glaze kit at 300,50 Kr. A customer books both and enters 070-123 45 67. The form shows 1 250,50 Kr. On submit, the plugin saves the reference and creates a payment request for 1250.50 SEK to 46701234567 with the message “Drejkurs 1042”. The request pops up in the customer’s Swish app; they approve it with BankID. Swish posts its callback a few seconds later, the plugin reads the request back (paid, 1250.50 SEK, the studio’s Swish number, the right reference) and the entry becomes Paid. The held booking email goes out and the payment page shows the thank-you message. The next week the customer skips the kit, and the studio refunds 300,50 Kr from the entry. Swish pays it out, it is recorded once, and the entry stays Paid with 950,00 Kr left.

When a payment does not go through

A Swish payment request waits three minutes for the customer. If they decline it, cancel it or let it time out, the payment page says so in plain words and offers two buttons: send the request to the phone again, or pay with the app button or a QR code instead. The order and the amount stay the same, and the entry stays Processing. If the customer typed a number that is not connected to Swish, the page suggests the QR code. If Swish says it lost contact with the customer’s bank after the payment started, the plugin does not offer a new request: the customer is asked to check the bank account and contact you, so nobody pays twice.

How it differs

• It connects to your own Swish for merchants agreement directly, with your certificate, so the money goes straight to your bank account under your own agreement.
• The payment request is created on your server from the saved entry: the amount, the currency, the reference and your Swish number never come from the browser.
• Swish callbacks are not signed, so the add-on never trusts one on its own. It reads the payment request back from Swish over your certificate connection, and only a paid request with the entry’s reference, your Swish number, the amount and SEK marks the entry Paid.
• The customer is never left on a dead end: after a declined, cancelled or timed-out request, the payment page offers a new request to the phone or by QR code, for the same order and amount.
• Your certificate and key are stored encrypted, never shown again, and written to private temporary files only for the length of each call.

Tips for smooth payments

• Keep the mobile number optional: phone users can pay with the app button and computer users with the QR code.
• Use a short message with the entry number, so the customer recognises the payment and your team can find it.
• Note the certificate expiry date shown in the settings and make a new certificate in good time.
• Make sure your site’s https certificate is valid: Swish checks it before it posts a callback.
• Check the Callbacks line in the settings after your first payment: it shows when the last callback arrived.

Step 7: Go live

When your tests look right, enter your live Swish number, paste your own certificate, key and passphrase, leave the live server root certificate empty, switch the mode to Live and save. Make one small real payment with your own phone and refund it. Each entry remembers whether it was paid in Test or Live, so older test entries keep working.

Questions

Do card details or bank logins reach my website?

No. The customer approves the payment in the Swish app with BankID. Your site only learns from Swish whether the payment request was paid.

Which currency can I use?

Swedish kronor only, which is what Swish supports. Gravity Forms already includes the krona.

What if the callback never arrives?

The payment page asks your site every few seconds and a status check runs every five minutes, and both read the payment back from Swish, so the entry is updated anyway.

Can I refund part of a payment?

Yes, several partial refunds up to the paid amount, from the entry screen, within 13 months of the payment.

Are recurring payments supported?

Not in this version. The plugin handles one-off payments for products, services and donations.

Get started

Get the Gravity Forms Swish Premium Add-on and follow the setup guide. Plans: one site $49 a year, five sites $69 a year, unlimited sites $199 a year.