TourTask
ВозможностиЦеныДемо
Регистрация
  1. Главная
  3. Документация

  5. How to accept Swish payments

ДокументацияКонтакты
Практические руководства
  • How to accept Swish payments
  • How to accept bank transfers, Global66 and Wise

How to accept Swish payments

Swish is Sweden's everyday mobile payment. Your customer scans a QR code on your booking page, approves it with BankID, and the money lands in your own bank account within seconds.

Setting it up takes two things: an agreement with your bank, and a certificate you create yourself. The certificate is the only technical step in this guide — everything after it is pasting three values into TourTask.

How long this takes

Ordering the agreement takes a few minutes, but your bank may need anything from a few hours to a couple of days to issue your Swish number. Creating the certificate and setting up TourTask takes about half an hour once you have it.

Is Swish right for your tours?

Swish is excellent for a Swedish audience and useless for everyone else. It is worth being clear about that before you start.

  • ✓Your money arrives in real time, straight into your own business bank account. There is no payout schedule and no provider holding your balance.
  • ✓Your customers already have it. Swish is the default way Swedes pay each other and small businesses, so there is nothing for them to sign up for.
  • ✓There are no chargebacks. A Swish payment is authorised with BankID and cannot be reversed by the payer or their bank afterwards.
  • ✓Bank fees are usually a small fixed amount per payment rather than a percentage of the sale, which tends to suit higher-value bookings.
    • Do not make Swish your only payment method

    Paying with Swish requires a Swedish bank account and Mobilt BankID. A visiting tourist from another country cannot use it, no matter how much they would like to. If any meaningful share of your bookings come from outside Sweden, keep a card gateway running alongside Swish. You can see every option on the payment gateways page.

    What you need before you start

    Check this list first. If you are missing the last item in particular, the rest of the guide cannot proceed.

    • ✓A Swedish business bank account at a bank that offers Swish, and access to its business internet bank.
    • ✓Your organisationsnummer.
    • ✓A named person to be your certificate contact — Swish calls this the CPOC. This person must hold a Swedish BankID, because they log in to the Swish portal with it.
    • ✓The ability to run two openssl commands on a computer, or a colleague who can. This guide gives you the exact commands.
    • ✓A TourTask business that is already taking bookings.
    What it costs

    Your bank sets the price, not Swish. Expect a one-off setup fee, a monthly or yearly fee, and a small fixed fee per payment. The amounts differ significantly between banks, so ask yours for its current Swish Handel pricing before you sign. TourTask does not add anything on top.

    Step 1 — Order Swish Handel from your bank

    Contact your business bank and ask for Swish Handel (Swish for Merchants). Tell them it is for a website that creates payment requests automatically. You sign this agreement directly with your bank — there is no way to get it from Swish, from TourTask, or from any third party.

    Swish Handel, not Swish Företag

    These are two different products and this is the mistake almost everyone makes. Swish Företag is the one you use with a phone app to take payments over a counter. It has no API, so your booking page cannot create a payment request with it and it will never work with TourTask. If your bank offers you Swish Företag, say that you need Swish Handel.

    What the bank will ask you for

    At minimum: your company registration number, and the name and personnummer of the person who will be your certificate contact. You are allowed up to five certificate contacts — nominate two, so you are not blocked when one of them is on holiday or leaves the company.

    What you get back

    A Swish number of the form 123 XXX XXXX — ten digits beginning with 123. This is not anybody's mobile number; it belongs to the agreement. Keep it somewhere you can find it again, because you will need it twice: once to log in to the certificate portal, and once in TourTask.

    Note that the Swish number belongs to the bank that issued it. If you move your business banking later, you get a new Swish number and you will have to redo the certificate.

    Keep your Swish number off your website

    Your customers never need to see it — they scan the QR code TourTask generates. Publishing it invites unprompted payments that do not match any booking, and some banks block those to merchant numbers anyway.

    Step 2 — Create your certificate

    This is the one technical step. A certificate is simply how Swish knows that a payment request really came from you and not from someone pretending to be you. You create a key on your own computer, ask Swish to sign it, and paste the result into TourTask. Budget about fifteen minutes.

    2a. Generate your key and signing request

    Run this on your own computer, in a folder you can find again. Replace the two placeholders with your organisationsnummer and the ten-digit Swish number from step 1.

    openssl req -newkey rsa:4096 -nodes -keyout swish-private.key -out swish.csr -subj "/C=SE/O=5566778899/CN=1231234567"

    That produces two files:
    swish-private.key — your private key. Swish never sees it and can never give it back to you.
    swish.csr — the signing request you are about to paste into the portal.

    Guard the private key

    Anyone holding swish-private.key together with your certificate can take payments and issue refunds in your name. Keep it out of shared drives, email and chat. Setting the Common Name (CN) to your Swish number as shown above is never wrong and is sometimes required, so do it.

    2b. Turn it into a certificate in the Swish portal

    Your certificate contact does this, on their own device, with their own BankID.

    1. 1

      Open the Swish certificate portal

      Go to portal.swish.nu. This is the certificate portal only — it is not the Swish app and not your bank.

    2. 2

      Log in

      Enter your organisationsnummer and the Swish number you are setting up, then approve with Mobile BankID. You can only administer one Swish number per session, and the portal logs you out after 15 minutes of inactivity — so have swish.csr open and ready to copy before you start.

    3. 3

      Start a new certificate

      Open the New certificate tab.

    4. 4

      Skip the portal's own key generation

      The portal offers to create the signing request for you, or to download a tool that does. Skip that — you already made yours in step 2a, and using the portal's version means ending up with a key you did not generate.

    5. 5

      Paste your signing request

      Open swish.csr in a plain text editor, copy all of it including the BEGIN and END lines, and paste it into the CSR field.

    6. 6

      Choose the format and the issuing bank

      Choose PEM — not PKCS#7. Then choose the BIC of your bank as the issuer. Generate the certificate.

    7. 7

      Copy everything the portal gives you

      The certificate appears as text on the screen. Click into the box and select all of it. It must start at the first BEGIN CERTIFICATE line, end at the last END CERTIFICATE line, and include every block in between — that is your own certificate plus the chain of certificates above it. Save it as swish-cert.pem.

    You can download the certificate again later

    The portal keeps your certificates and lets you download them whenever you like. The private key is the part that only exists where you created it — the portal never had a copy and cannot re-issue it.

    2c. If you already have a .p12 file

    TourTask needs plain PEM text and cannot read a .p12 or .pfx bundle. If that is what you have, split it into the two pieces with these commands. The first asks for the bundle's password; the second writes the key without one.

    openssl pkcs12 -in swish.p12 -nokeys -out swish-cert.pem
    openssl pkcs12 -in swish.p12 -nocerts -nodes -out swish-private.key

    If your private key is protected by a passphrase, remove it — TourTask cannot open an encrypted key:

    openssl rsa -in swish-encrypted.key -out swish-private.key

    A bad certificate fails silently

    If your certificate is wrong, expired or revoked, Swish does not return an error message — the connection simply never gets established, and payments stop with nothing to explain why. That is why you will make a real test payment in step 5, and why you will put the expiry date in your calendar in step 6.

    Step 3 — Enter your credentials in TourTask

    Sign in to TourTask and go to Configuration → Payment options. Under Online payments, find Swish among the payment gateways and add it.

    If you cannot see Swish in the list, switch the filter from showing local gateways only to showing all gateways. When you add it, pick country SE and currency SEK — they are the only options Swish offers.

    1. 1

      Swish number

      The ten digits from your bank, starting with 123. No spaces, no country code.

    2. 2

      Certificate (PEM)

      The entire contents of swish-cert.pem — your own certificate first, then the whole chain, exactly as you copied it out of the portal.

    3. 3

      Private key (PEM)

      The entire contents of swish-private.key, including its BEGIN and END lines.

    Each field saves on its own

    A field is saved the moment you click out of it, so there is no separate save button for the three of them. If a paste loses its line breaks on the way, TourTask repairs it — but paste the whole thing from the first line to the last either way.

    Your private key stays visible in the field

    It is not hidden behind dots once pasted. Enter it on a device you trust, and do not screen-share or record this page while you do.

    Step 4 — Activate Swish

    Press Activate. The button stays disabled until all three fields have a value, so if it is greyed out, one of them is still empty.

    Once Swish is active it appears as a payment option on your booking pages. You can drag its card to change where it sits among your other payment options, and optionally add a surcharge of up to 10 % — which is shown to the traveller before they pay and is included in the amount charged.

    Deactivate keeps your credentials, Remove deletes them

    Deactivate takes Swish off your booking pages but keeps everything you pasted, so you can switch it back on in one click. Remove deletes the credentials for good and you would have to paste them again.

    Step 5 — Test it with a real payment

    There is no sandbox and no test mode for Swish in TourTask. That is not a shortcoming to work around — it is simply how Swish works for merchants, so your first test is a small real payment that you refund afterwards. Do it before you tell anyone Swish is available.

    1. 1

      Make a small booking on your own booking page

      Any real tour, the smallest amount you can sell.

    2. 2

      Pay it with Swish from your own phone

      Scan the QR code, or tap Open the Swish app if you are booking on the phone itself, and approve with BankID.

    3. 3

      Check both sides

      The booking should flip to paid on its own within a few seconds, and the money should already be in your bank account.

    4. 4

      Refund it

      Open the booking, find the payment, and choose to refund it through the payment provider. Confirm that it arrives back.

    5. 5

      Only then tidy up

      Cancel or delete the test booking once the refund has landed.

    Test the refund, not just the payment

    Refunds have their own failure modes — an empty account balance is the common one — and you do not want to discover them while a real customer is waiting for their money.

    Step 6 — Go live and keep it working

    Swish is now live on your booking pages. There is exactly one piece of ongoing maintenance, and skipping it is the most common way a working Swish integration breaks months later.

    Put your certificate's expiry date in your calendar now

    Open swish-cert.pem, or check the portal, and read the expiry date off your own certificate — certificates issued today typically run for about two years. Neither Swish nor TourTask will remind you, and an expired certificate produces no error anywhere: Swish payments just stop working. Set a reminder for two months before it expires. Renewing means repeating step 2 and pasting the new certificate into step 3 — your Swish number does not change.

    What your customers see

    Swish never takes your customer away to another website. They stay on your booking page the whole time.

    On a phone

    They get a QR code and an Open the Swish app button. Tapping the button switches straight into Swish, where they approve with BankID and come back to the booking page, which confirms itself.

    On a laptop or desktop

    They get the QR code only — the app button is hidden, because the Swish app lives on the phone. They scan the code with the Swish app on their phone and approve it there.

    Either way the page shows a countdown and waits, then confirms the booking by itself the moment the payment goes through. Nobody has to click anything or refresh. Your customer has about three minutes to approve the request in the Swish app; if the code runs out they go back to the booking and start again to get a fresh one.

    There is no code to copy and paste

    Unlike some QR payment methods, Swish has no typed code as a fallback. A customer sitting at a laptop with no phone within reach cannot complete a Swish payment. That is one more reason to keep a card option available.

    Limits and amounts

    • Swish always charges in SEK. Your tours do not have to be priced in SEK, though — TourTask converts the booking total and the customer is charged the SEK amount.
    • A merchant can receive at most 150 000 SEK in a single Swish payment. Above that, Swish is not an option for the full amount.
    • The minimum is set by your bank as part of your agreement, so ask them what yours is.
    • Your customer's own Swish limit is the usual reason a payment fails. Banks set a low daily or per-payment limit by default. The customer raises it themselves in their own bank's app, including a temporary raise for a single large purchase — there is nothing you can do from your side.
    • Deposits work. You can take a percentage deposit through Swish and collect the balance later or by another method, which is a practical way around a customer's limit on an expensive tour.
    • Swish is for customer bookings only. You cannot use it to pay your own TourTask invoice.

    Refunds

    Open the booking, find the payment in its payment list, and choose to refund it through the payment provider. Refunds can be full or partial, and you can refund the same payment repeatedly until the original amount is used up, for up to 13 months after the payment. Your bank may apply a shorter window than Swish does, so check yours.

    The money goes back to the account the customer has connected to Swish and normally arrives within minutes — considerably faster than a card refund. They get a notification in the Swish app.

    Three things that stop a Swish refund

    You need the money in your account. A Swish refund debits your balance immediately; it is not netted against future sales the way card refunds are.
    The customer must still have the same mobile number on Swish. If they have changed number or left Swish, the refund fails and you will have to pay them another way.
    A cancelled booking cannot be refunded through the gateway. Refund the payment first, then cancel the booking.

    If a refund does not report back cleanly

    If TourTask reports the refund as pending, the money has already left your account and is settling — check your bank rather than sending it again. If TourTask says it could not confirm the outcome, verify at Swish or with your bank before retrying, or you may end up refunding twice.

    Troubleshooting

    • Swish is not in the gateway list — the list is filtered to your own country by default. Switch it to show all gateways.
    • A warning says your country is not supported — that is advisory and does not stop you adding Swish, but you do need a Swedish bank agreement for it to actually work.
    • The Activate button is greyed out — one of the three fields is empty. Each field saves when you click out of it, so check that all three kept their values.
    • TourTask says the certificate or key is not valid PEM — the paste is incomplete, or the private key has a passphrase. Re-copy from the first BEGIN line to the last END line, and remove the passphrase as shown in step 2c.
    • Payments fail immediately with an authentication error — the Swish number does not match the certificate, or the certificate has expired or been revoked. Check the number is the ten-digit 123 number from your bank, then check the expiry date.
    • Swish worked and then stopped for no apparent reason — check the certificate expiry first. This is what an expired certificate looks like, because Swish gives no warning and no error when it lapses.
    • A customer says their payment was declined — almost always their own Swish limit. They can raise it in their bank's app and try again.
    • A customer says Swish told them something is already in progress — they have another Swish or BankID operation open. They should finish or cancel it and retry.
    • The QR code expired before they scanned it — each code is only good for a few minutes. They go back to the booking and start again for a fresh one.
    • A customer says they paid but the booking is not confirmed — in rare cases Swish loses track of whether a payment completed and cannot say either way. Do not ask them to pay again. Have them check with their bank, and check your own account, before you do anything.

    Questions we get asked

    Can I use the Swish number I already have?

    Only if it came with a Swish Handel agreement. A personal Swish number, or a Swish Företag number used with the phone app, cannot create payment requests and will not work here.

    Can my international customers pay with Swish?

    No. Paying with Swish requires a Swedish bank account and Mobilt BankID, so a visiting tourist cannot use it. Offer a card gateway alongside Swish for everyone else.

    Do I have to price my tours in SEK?

    No. Price them in whatever currency you sell in — TourTask converts the total and Swish charges the customer the SEK equivalent.

    Is there a sandbox I can test in?

    No. Make a small real booking, pay it with Swish, and refund it, as described in step 5.

    What happens when my certificate expires?

    Swish payments stop working, with no error message from Swish and no warning from TourTask. Renew it before that happens — see step 6.

    Can my company take Swish if it is not Swedish?

    Officially, any merchant who can become a customer of a Swedish bank can sign a Swish Handel agreement, and the service is only offered for trade in SEK. In practice your bank decides, and your certificate contact needs a Swedish BankID. Ask your bank before you plan around it — it is their call, not ours.

    Do I have to show the Swish logo?

    TourTask already labels the payment option and draws the Swish QR code for you, so there is nothing to add to your booking page. If you want Swish materials for your own marketing, take them from Swish's own brand toolbox rather than recreating the logo yourself.

    Can I pay my TourTask invoice with Swish?

    No — Swish is available for customer bookings only.

    Comparing options? See every payment gateway TourTask supports, or browse the rest of the documentation.

    На этой странице
    • Is Swish right for your tours?
    • What you need before you start
    • Step 1 — Order Swish Handel from your bank
    • What the bank will ask you for
    • What you get back
    • Step 2 — Create your certificate
    • 2a. Generate your key and signing request
    • 2b. Turn it into a certificate in the Swish portal
    • 2c. If you already have a .p12 file
    • Step 3 — Enter your credentials in TourTask
    • Step 4 — Activate Swish
    • Step 5 — Test it with a real payment
    • Step 6 — Go live and keep it working
    • What your customers see
    • On a phone
    • On a laptop or desktop
    • Limits and amounts
    • Refunds
    • Troubleshooting
    • Questions we get asked
    • Can I use the Swish number I already have?
    • Can my international customers pay with Swish?
    • Do I have to price my tours in SEK?
    • Is there a sandbox I can test in?
    • What happens when my certificate expires?
    • Can my company take Swish if it is not Swedish?
    • Do I have to show the Swish logo?
    • Can I pay my TourTask invoice with Swish?
    TourTask

    Универсальная платформа для управления, автоматизации и развития вашего туристического бизнеса.

    Продукт
    ВозможностиЦеныЗаказать демо
    Ресурсы
    ДокументацияПлатёжные шлюзыОнлайн-турагентства
    Компания
    КонтактыПолитика конфиденциальности

    © 2026 TourTask. All rights reserved.