GoCardless Direct Debit

Collect UK Bacs, SEPA and Australian BECS direct debits on recurring invoices. Fees are 1 percent capped at 2 GBP per transaction, vs Stripe's 1.5 percent + 20p uncapped.

Step 1: Choose sandbox or live

GoCardless has two entirely separate accounts: sandbox for testing (fake bank accounts, no real money moves) and live for production. You will do this whole guide twice - once against sandbox to prove the flow, then once against live.

• Sandbox dashboard: manage-sandbox.gocardless.com
• Live dashboard: manage.gocardless.com

Sandbox access tokens start sandbox_. Live access tokens start live_. The CRM detects which mode you are in from the prefix.

Step 2: Create an access token

1. Log in to your GoCardless dashboard.
2. Left nav: Developers > Access tokens.
3. Click Create.
4. Name it crm-production (or crm-sandbox in the sandbox account).
5. Scope: tick Read and write. The CRM needs write to create customers and mandates.
6. Click Create access token.
7. Copy the token immediately. GoCardless only shows it once. It looks like live_A1b2C3d4E5f6...

Step 3: Paste the token into the CRM

1. In the CRM go to Settings > Integrations.
2. Scroll to Payment integrations > GoCardless.
3. Paste the token into the Access token field.
4. Click Save. The green Connected pill should appear, showing either "Live" or "Sandbox" mode based on the prefix.

Step 4: Add the webhook endpoint

Webhooks tell the CRM when a mandate is confirmed, when a payment collects successfully, when a payment fails and when a customer cancels. Without them, the CRM has no idea your money arrived.

1. In the GoCardless dashboard: Developers > Webhooks > Create.
2. Set URL to: https://your-crm-domain.com/api/gocardless.php?action=webhook
3. Under Events, tick the whole mandates group and the whole payments group. You want them all.
4. Click Create webhook endpoint.
5. On the webhook detail page, click the copy button next to Webhook secret. It is a random string.

Step 5: Save the webhook secret

The CRM verifies inbound webhooks using the shared secret. Save it via Settings > Integrations > GoCardless - there is a Webhook secret field just below the access token. Paste and save. If you cannot see that field yet, ask support to insert into settings under key gocardless_webhook_secret.

Step 6: Set up your first customer

Direct Debit needs the customer to give explicit consent (a "mandate") one time. After that, you can charge that customer on any schedule up to the mandate's cap.

1. Open a contact record.
2. Click Set up direct debit on the payments tab. This calls POST /api/gocardless.php?action=create_billing_request.
3. The CRM returns a hosted signup link.
4. Send the link to the customer (email or SMS).
5. The customer opens the link, enters bank details on the GoCardless-hosted flow, and confirms.
6. You get a webhook: mandates.submitted. The contact record shows Mandate pending.
7. 1-2 working days later: mandates.active. Contact record shows Direct debit ready. You can now collect.

Step 7: Create a subscription or one-off collection

1. On the invoice or subscription record, click Collect via GoCardless.
2. Confirm the amount and date.
3. The CRM calls POST /api/gocardless.php?action=create_payment.
4. Payment is Pending initially. 3 working days later (UK Bacs): payments.confirmed. Money is in your bank account.
5. If it fails (insufficient funds is the top cause): payments.failed. Invoice status flips back to Overdue. Automatic retry is possible - configure it in Settings > Payment retries in the GoCardless dashboard.

How to test it works

1. Do the whole flow against sandbox first with a made-up email and one of the test bank accounts: sort code 20-00-00, account number 44779911 is the "always confirms" sandbox account.
2. Verify webhooks arrive: in the GoCardless sandbox webhooks page, the last event should be green.
3. Verify the CRM contact record shows Mandate active within a few minutes.
4. Create a test payment for 10 GBP. In sandbox this fake-succeeds in seconds.
5. Once sandbox works end to end, delete the sandbox token from Settings and paste the live token.

Common problems

Webhook returns 401 "Invalid webhook signature"

Webhook secret is wrong or missing. Copy it fresh from the GoCardless webhook detail page.

Mandate stuck at "submitted" for more than 4 working days

Customer's bank rejected the mandate. Common reasons: name mismatch, closed account, or bank does not support Direct Debit for that account type. GoCardless dashboard shows the reason under the mandate detail page.

"Access token invalid" errors on every request

You copied the token with a trailing space or newline. Re-copy carefully. Or the token was revoked - check Developers > Access tokens.

Payment collects but the CRM invoice still shows Overdue

You are on sandbox and expecting a live webhook, or vice versa. Sandbox webhooks fire to sandbox endpoints only. Check the token prefix matches the environment.

Customer says "I never authorised this direct debit"

Under UK Direct Debit Guarantee they can raise an indemnity claim and their bank auto-refunds them, no questions asked. GoCardless will notify you via payments.charged_back. Your options are (a) contact the customer to sort it out or (b) accept the reversal. Never argue with the bank - the Guarantee is absolute.

First real payment fails with "Refer to payer"

Bank flagged it as unusual. Ring the customer, ask them to call their bank and pre-authorise. Retry after 3 days.

What this unlocks in the CRM

Recurring invoices can be collected automatically without chasing. The Subscriptions module can schedule monthly collections against a mandate. The MRR module tracks GoCardless as a payment source alongside Stripe. Cost per collected pound drops from about 1.7 percent (Stripe) to about 0.6 percent (GoCardless) once you factor in the fee cap - the difference on 100k of annual collections is 1000 GBP a year.