Platform · Checkout
A hosted checkout tuned for mobile-first shoppers
A hosted checkout is a payment page LekkaPay runs for you: your customer reaches it at payment time, pays on a page we secure, and returns to your site with the result confirmed. Every LekkaPay payment method appears on one mobile-first page styled to your brand, and card data never touches your servers - the PCI DSS burden stays with LekkaPay.
LAST UPDATED ·
- Every method on one page Cards, Google Pay, Apple Pay, Samsung Pay, instant EFT, M-Pesa and vouchers - one page, one integration.
- Mobile-first by design Built and tested for mid-range Android on mobile data, where most South African purchases happen.
- Your branding throughout Your logo, colours and trading name on the page and the receipt - customers stay in your world.
- Frictionless 3-D Secure 2 Authentication that protects conversion, not just compliance.
- PCI burden stays with us Card data goes straight to the LekkaPay vault, keeping your PCI obligations to the lightest tier.
How it works
How it works
-
Redirect or embed
Create a payment from your server or plugin, then send the customer to their checkout session - or embed it so they never leave your page.
-
Your customer pays
They choose any enabled method; cards go through 3-D Secure 2 with the frictionless flow where risk allows, so most never see a challenge.
-
You receive a confirmation webhook
A signed server-to-server notification confirms the outcome, so fulfilment never depends on the customer's browser making it back to your site.
Why host the payment page at all?
Because the payment page is where money is won or lost, and tuning it is a full-time job. LekkaPay's hosted checkout is conversion-tuned centrally: layout, payment-method ordering, error handling and 3-D Secure 2 flows are tested and improved across the whole platform, and every merchant inherits each improvement without shipping a line of code. Hosting also settles the compliance question outright - card details are entered on a page LekkaPay serves and secures, so they never pass through your infrastructure, and your PCI DSS obligations stay at the lightest self-assessment tier.
Why mobile-first matters in South Africa
Most South African online purchases happen on a phone, and most of those phones are mid-range Android devices on variable mobile data - not flagship handsets on fibre. The checkout is engineered for that reality: lightweight pages that load quickly on slow connections, large touch targets, numeric keyboards where numbers are expected, and payment methods suited to mobile behaviour. Instant EFT is approved inside the customer's own banking app; Google Pay, Apple Pay and Samsung Pay reduce a card payment to a single tap. A checkout that assumes a desktop shopper quietly loses the majority of the market before the first field is typed.
What happens to card data - and to your PCI obligations?
Card numbers are entered on the hosted page, transmitted directly to LekkaPay and stored only in our tokenisation vault. Your systems receive a token and a result - never a card number - and returning customers can pay with a saved card in one click. LekkaPay is a PCI DSS Level 1 compliant service provider, which means the heaviest compliance obligations sit with us, where the card data actually lives, not with you.
Whose brand does the customer see?
Yours. The hosted checkout is customisable with your logo, your colours and your trading name, on both the payment page and the receipt, so the handover from your site feels like a page transition rather than a departure. That continuity matters for conversion: shoppers abandon payments that suddenly look like someone else's website. Every method you enable - cards, wallets, instant EFT, M-Pesa, vouchers - appears on that same branded page, and a signed webhook confirms each outcome to your server so fulfilment never depends on a mobile browser completing a redirect.
- of South African online purchases are made on mobile devices, most of them mid-range Android handsets
- Majority
- Industry studies of South African e-commerce, 2025
Hosted checkout
What does your branded checkout look like?
Every method on one page, then card or Instant EFT - all on a checkout in your colours, not ours.
FAQ
Your questions, answered
Is the hosted checkout PCI compliant for me?
Yes - this is the main compliance benefit of hosting the payment page with LekkaPay. Card details are entered on a page we serve and secure, so they never touch your servers, which keeps your own PCI DSS obligations to the lightest self-assessment tier. LekkaPay is a PCI DSS Level 1 compliant service provider, so the heavy compliance sits where the card data sits.
Can I brand the checkout as my business?
Yes. The hosted checkout carries your logo, your colours and your trading name on the payment page and the receipt. Customers should feel they are paying you, not a third party - the page is customisable so the handover from your site is seamless.
Which payment methods appear at checkout?
Whichever you enable: cards with 3-D Secure 2, Google Pay, Apple Pay and Samsung Pay, instant EFT via Ozow (with NIBSS pay-by-bank in Nigeria), M-Pesa, and vouchers - 1Voucher and OTT today, with additional voucher networks onboarding. The page adapts to your configuration automatically.
Does it work well on mobile?
It is built for mobile first. Most South African online shoppers are on mid-range Android phones on mobile data, so the checkout ships lightweight pages that load fast on slow connections, large touch targets and numeric keyboards for card fields - and one-tap wallets like Google Pay, Apple Pay and Samsung Pay where the device supports them.
Can I build my own checkout instead?
Yes. If you want full control of the payment experience, integrate the LekkaPay API directly and use tokenisation so card data still flows to the LekkaPay vault rather than your servers. Many merchants start on the hosted checkout and move to an API integration later - same platform, no lost history.
One platform, two models.
Start on LekkaPay merchant accounts or bring your own MID - same API, same back office, no re-integration.