Mandate / Auto-Debit
Mandate / Auto-Debit
Mandate / Auto-Debit is suitable for scenarios where, after the user completes an authorization once, you initiate subsequent debits based on your business needs. While the mandate is valid, the user typically does not need to confirm each debit, and each debit is processed as an independent transaction. PayCools provides the ability to create, query, and cancel mandates as well as initiate subsequent debits. Mandate / Auto-Debit is integrated via direct API connection.
How Mandate / Auto-Debit Works
Completing a mandate does not mean a debit has occurred; PayCools only processes the corresponding transaction after you initiate the debit. You need to manage the service cycle, debit timing, debit amount, and order or service status within your own platform, website, or app.
- Create a mandate: You create a mandate link via PayCools and guide the user to the corresponding payment channel to complete the authorization.
- Confirm the mandate result: After the user completes the process, you can receive a mandate result notification or proactively query the mandate status. Once the mandate is successful, save the mandate information and associate it with the corresponding user or business relationship.
- Initiate a debit: Once the debit conditions are met, you determine the debit time and amount according to your business rules, and initiate the debit via the PayCools API using a valid mandate.
- Confirm the debit result: You can receive a debit result notification or proactively query the transaction status, and update the order or service status based on the final result.
Business Flow
Mandate Token Lifecycle
The key credential for mandate / auto-debit is the mandate token (payToken), which merchants must properly safeguard and manage throughout its lifecycle:
| Stage | Description |
|---|---|
| Mandate activated | A payToken is generated after the user's first successful authorization, representing a valid auto-debit mandate |
| Debit usage | The merchant includes the payToken with each auto-debit; the system debits after verifying its validity |
| Mandate expiration | The mandate token has a validity period; after expiration, the user must re-authorize to obtain a new token. The default validity period is 10 years |
| Voluntary termination | The user or merchant actively terminates the mandate; the token becomes invalid and can no longer be used for debits |
| Involuntary invalidation | Situations such as the user changing their payment method, turning off password-free payments, or insufficient wallet balance may cause the token to become invalid |
If a debit fails due to an "invalid token", you should guide the user to complete the authorization again before initiating the debit; never repeatedly retry with an invalid token.
Debit Rules and Limits
| Dimension | Description |
|---|---|
| Debit frequency | Initiated as needed by the business (e.g., at the end of each trip, each billing cycle) |
| Per-transaction limit | Subject to the channel's password-free payment limit; exceeding the limit may require secondary user confirmation or a mandate upgrade |
| Debit amount | Can be fixed (e.g., monthly subscription fee) or dynamic (e.g., billed by actual usage or trip) |
| Debit timing | Immediate debit or periodic debit (daily / weekly / monthly) |
| Debit result | The acceptance result is returned synchronously; the final status is subject to the asynchronous notification |
Termination and Renewal
- Voluntary termination: Users can terminate the mandate on the merchant side or wallet side, and merchants can also terminate the token proactively via API.
- Renewal: Before the mandate token expires, you can guide the user to re-authorize and obtain a new token to avoid auto-debit interruptions.
- Mandate status inquiry: Merchants should provide an entry point for querying mandate status so users clearly understand the auto-debit services they have currently enabled.
Failure Compensation Mechanism
| Failure Reason | Compensation Recommendation |
|---|---|
| Insufficient balance | Delayed retry (e.g., the next day) or notify the user to top up / change payment method |
| Invalid token | Guide the user to re-authorize, then initiate the debit |
| Risk control interception | Contact the platform for investigation, with manual intervention if necessary |
| Channel issue | Wait for the channel to recover and retry, and inform the user accordingly |
For critical debits (e.g., subscription renewals), it is recommended to notify users via in-app message / SMS upon debit failure and provide a self-service repayment entry point to reduce churn.
Comparison with Regular Payments
| Dimension | Regular Payment | Mandate / Auto-Debit |
|---|---|---|
| User involvement | Each payment requires user confirmation (entering password / scanning QR code) | Only the initial authorization requires user involvement; subsequent debits are automatic |
| Debit trigger | Initiated proactively by the user | Initiated automatically by the merchant under agreed conditions |
| Use cases | One-time purchases, instant shopping | Recurring, postpaid, password-free scenarios |
| Experience | Requires action each time; conversion is affected by the payment step | Seamless debits with a smooth experience, but users must be informed |
Use Cases
Recurring Debits
You initiate debits according to cycles or service rules agreed with the user, suitable for:
- Monthly, quarterly, or annual memberships;
- Short dramas, digital content, and other continuous services;
- Insurance renewals;
- Other businesses requiring regular fee collection.
Non-Recurring Debits
You initiate debits after the service is completed or the actual fee is determined, suitable for:
- Ride-hailing and mobility services;
- Shared power banks and equipment rentals;
- Seamless payments;
- Businesses billed by actual usage or service outcomes.
Mandate Management
You can query the mandate status and cancel a mandate when it is no longer needed. The validity period and available scope of a mandate may vary by payment method; please refer to the specific payment method's documentation.
After a mandate is cancelled, you can no longer use it to initiate new debits. If you need to continue using mandate / auto-debit, you must guide the user to complete the authorization again.
Supported Payment Methods
Mandate / auto-debit supports bank cards and e-wallets with auto-debit authorization capabilities. The authorization process may vary across countries and payment channels; please refer to the payment methods you have actually enabled.
Compliance and User Disclosure
Auto-debit involves automatic charges, so compliance and user experience must be considered:
- Clear disclosure: Before enabling auto-debit, clearly explain the debit rules, frequency, amount range, and termination method to users.
- Debit notification: Send users a debit result notification (in-app message / SMS / push) after each debit.
- Convenient termination: Provide a convenient termination entry point; unreasonable termination barriers must not be set.
- Authorization records: Retain user authorization records for dispute handling and compliance audits.
Integration Preparation
Before using the mandate / auto-debit service, make sure that:
- You have completed the public key configuration in the Merchant Dashboard and obtained the AppID and platform public key
- You understand the signature and verification mechanism
- You have checked the environment information and confirmed the request URL
- You properly manage the lifecycle of the mandate token (payToken)
- You have implemented compensation for failed debits and a user notification mechanism
For complete API parameter descriptions, signature rules, and request / response examples, please refer to the API documentation.