How to accept Swish payments

Swish is excellent for a Swedish audience and useless for everyone else. It is worth being clear about that before you start.

• ✓Your money arrives in real time, straight into your own business bank account. There is no payout schedule and no provider holding your balance.
• ✓Your customers already have it. Swish is the default way Swedes pay each other and small businesses, so there is nothing for them to sign up for.
• ✓There are no chargebacks. A Swish payment is authorised with BankID and cannot be reversed by the payer or their bank afterwards.
• ✓Bank fees are usually a small fixed amount per payment rather than a percentage of the sale, which tends to suit higher-value bookings.

Check this list first. If you are missing the last item in particular, the rest of the guide cannot proceed.

• ✓A Swedish business bank account at a bank that offers Swish, and access to its business internet bank.
• ✓Your organisationsnummer.
• ✓A named person to be your certificate contact — Swish calls this the CPOC. This person must hold a Swedish BankID, because they log in to the Swish portal with it.
• ✓The ability to run two openssl commands on a computer, or a colleague who can. This guide gives you the exact commands.
• ✓A TourTask business that is already taking bookings.

Contact your business bank and ask for Swish Handel (Swish for Merchants). Tell them it is for a website that creates payment requests automatically. You sign this agreement directly with your bank — there is no way to get it from Swish, from TourTask, or from any third party.

This is the one technical step. A certificate is simply how Swish knows that a payment request really came from you and not from someone pretending to be you. You create a key on your own computer, ask Swish to sign it, and paste the result into TourTask. Budget about fifteen minutes.

openssl req -newkey rsa:4096 -nodes -keyout swish-private.key -out swish.csr -subj "/C=SE/O=5566778899/CN=1231234567"

That produces two files:
swish-private.key — your private key. Swish never sees it and can never give it back to you.
swish.csr — the signing request you are about to paste into the portal.

1. 1

Sign in to TourTask and go to Configuration → Payment options. Under Online payments, find Swish among the payment gateways and add it.

If you cannot see Swish in the list, switch the filter from showing local gateways only to showing all gateways. When you add it, pick country SE and currency SEK — they are the only options Swish offers.

1. 1

   Swish number

   The ten digits from your bank, starting with 123. No spaces, no country code.

2. 2

   Certificate (PEM)

   The entire contents of swish-cert.pem — your own certificate first, then the whole chain, exactly as you copied it out of the portal.

3. 3

   Private key (PEM)

   The entire contents of swish-private.key, including its BEGIN and END lines.

Press Activate. The button stays disabled until all three fields have a value, so if it is greyed out, one of them is still empty.

Once Swish is active it appears as a payment option on your booking pages. You can drag its card to change where it sits among your other payment options, and optionally add a surcharge of up to 10 % — which is shown to the traveller before they pay and is included in the amount charged.

There is no sandbox and no test mode for Swish in TourTask. That is not a shortcoming to work around — it is simply how Swish works for merchants, so your first test is a small real payment that you refund afterwards. Do it before you tell anyone Swish is available.

1. 1

   Make a small booking on your own booking page

   Any real tour, the smallest amount you can sell.

2. 2

   Pay it with Swish from your own phone

   Scan the QR code, or tap Open the Swish app if you are booking on the phone itself, and approve with BankID.

3. 3

   Check both sides

   The booking should flip to paid on its own within a few seconds, and the money should already be in your bank account.

4. 4

   Refund it

   Open the booking, find the payment, and choose to refund it through the payment provider. Confirm that it arrives back.

5. 5

   Only then tidy up

   Cancel or delete the test booking once the refund has landed.

Swish is now live on your booking pages. There is exactly one piece of ongoing maintenance, and skipping it is the most common way a working Swish integration breaks months later.

Swish never takes your customer away to another website. They stay on your booking page the whole time.

Either way the page shows a countdown and waits, then confirms the booking by itself the moment the payment goes through. Nobody has to click anything or refresh. Your customer has about three minutes to approve the request in the Swish app; if the code runs out they go back to the booking and start again to get a fresh one.

• Swish always charges in SEK. Your tours do not have to be priced in SEK, though — TourTask converts the booking total and the customer is charged the SEK amount.
• A merchant can receive at most 150 000 SEK in a single Swish payment. Above that, Swish is not an option for the full amount.
• The minimum is set by your bank as part of your agreement, so ask them what yours is.
• Your customer's own Swish limit is the usual reason a payment fails. Banks set a low daily or per-payment limit by default. The customer raises it themselves in their own bank's app, including a temporary raise for a single large purchase — there is nothing you can do from your side.
• Deposits work. You can take a percentage deposit through Swish and collect the balance later or by another method, which is a practical way around a customer's limit on an expensive tour.
• Swish is for customer bookings only. You cannot use it to pay your own TourTask invoice.

Open the booking, find the payment in its payment list, and choose to refund it through the payment provider. Refunds can be full or partial, and you can refund the same payment repeatedly until the original amount is used up, for up to 13 months after the payment. Your bank may apply a shorter window than Swish does, so check yours.

The money goes back to the account the customer has connected to Swish and normally arrives within minutes — considerably faster than a card refund. They get a notification in the Swish app.

• Swish is not in the gateway list — the list is filtered to your own country by default. Switch it to show all gateways.
• A warning says your country is not supported — that is advisory and does not stop you adding Swish, but you do need a Swedish bank agreement for it to actually work.
• The Activate button is greyed out — one of the three fields is empty. Each field saves when you click out of it, so check that all three kept their values.
• TourTask says the certificate or key is not valid PEM — the paste is incomplete, or the private key has a passphrase. Re-copy from the first BEGIN line to the last END line, and remove the passphrase as shown in step 2c.
• Payments fail immediately with an authentication error — the Swish number does not match the certificate, or the certificate has expired or been revoked. Check the number is the ten-digit 123 number from your bank, then check the expiry date.
• Swish worked and then stopped for no apparent reason — check the certificate expiry first. This is what an expired certificate looks like, because Swish gives no warning and no error when it lapses.
• A customer says their payment was declined — almost always their own Swish limit. They can raise it in their bank's app and try again.
• A customer says Swish told them something is already in progress — they have another Swish or BankID operation open. They should finish or cancel it and retry.
• The QR code expired before they scanned it — each code is only good for a few minutes. They go back to the booking and start again for a fresh one.
• A customer says they paid but the booking is not confirmed — in rare cases Swish loses track of whether a payment completed and cannot say either way. Do not ask them to pay again. Have them check with their bank, and check your own account, before you do anything.