--- title: "Payment Gateways in Colombia for Developers: Technical Comparison of Wompi, Mercado Pago, PSE & Bold" description: "A technical and financial breakdown of leading payment gateways in Colombia. Compare processing fees, REST APIs, cryptographic webhooks, PSE, and Nequi for e-commerce and SaaS." date: 2026-09-10 category: "FinTech" imageUrl: "/assets/images/blog/pasarelas-pago-colombia-pse-wompi-mercado-pago-comparativa.webp" imageAlt: "Technical and fee comparison across Colombia payment processors: Bancolombia Wompi, Mercado Pago, PSE, and Bold for e-commerce and SaaS software." readTime: "12 min read" author: "DoneAPI Engineering Team" tags: ["Payment Gateways", "FinTech", "Colombia", "Wompi", "Mercado Pago", "PSE", "Bold", "E-Commerce"] lang: "en" translationSlug: "pasarelas-pago-colombia-pse-wompi-mercado-pago-comparativa" featured: false --- Digital commerce and SaaS platforms in Colombia have undergone a massive transformation over the past five years. Unlike markets such as the United States or Western Europe, where credit cards account for more than 80% of digital transactions, the Colombian payments ecosystem is defined by unique banking rails: the dominance of **PSE (*Pagos Seguros en Línea* by ACH Colombia)**, the ubiquity of mobile wallets like **Nequi and Daviplata**, and consumers who expect to pay via direct bank transfers as readily as with credit cards. For technical leads, software architects, and startup founders, choosing a payment gateway is not merely a commercial agreement—it is a **mission-critical architectural decision**. Selecting a gateway with unstable REST APIs, unverified webhooks, or prolonged payout settlement windows will crush checkout conversion rates, inflate processing fees, and cause severe accounting reconciliation headaches. In this deep dive, we conduct a technical and financial comparison between the three dominant gateways in Colombia—**Wompi (Bancolombia), Mercado Pago, and Bold**—analyzing their fee structures, developer SDK ergonomics, webhook verification mechanics, and how to implement a unified **Payment Adapter Pattern in TypeScript** to decouple your business logic. --- ## 1. Colombia’s Payment Landscape: Consumer Payment Methods Before architecting checkout flows, engineering teams must understand the actual breakdown of consumer payment methods in Colombia: ``` ┌────────────────────────────────────────────────────────────────────────┐ │ Digital Payment Method Mix in Colombia │ └────────────────────────────────────────────────────────────────────────┘ [PSE (ACH Colombia)] ~ 45% (Real-time account-to-account transfer) [Digital Wallets: Nequi/Davi] ~ 25% (Mobile push payments and QR codes) [Credit & Debit Cards] ~ 22% (Visa, Mastercard, Amex, Diners) [Cash Collection Networks] ~ 8% (Efecty, Baloto, Su Red, Paga Todo) ``` - **PSE**: The undisputed payment standard for mid-to-high ticket items (travel and hospitality, B2B software, electronics, education). Funds debit directly from the customer’s savings or checking account. - **Nequi**: Indispensable for retail, dining, and mobile-first micro-transactions. Customers expect a seamless experience via dynamic push notifications (*push payment*) or QR scans. - **Credit Cards**: Essential for recurring SaaS billing, hotel reservation pre-authorizations (*card tokenization*), and installment payments (*cuotas*) tied to local bank interest promotions. --- ## 2. Technical & Fee Comparison: Wompi vs. Mercado Pago vs. Bold | Evaluation Dimension | Wompi (Bancolombia) | Mercado Pago (Mercado Libre) | Bold (Colombian FinTech) | | :--- | :--- | :--- | :--- | | **Base Processing Fee (Cards & PSE)** | 2.65% + $700 COP + VAT (Standard) | 3.29% + $800 COP + VAT (Instant) / 2.99% + $800 COP (14-day) | 2.99% + $900 COP + VAT (Cards) / $900 COP flat for PSE | | **Nequi Integration** | **Native and direct** (Dynamic push & Bancolombia QR) | Supported through debit cards or PSE rails | Supported via PSE or embedded app | | **Checkout UI Options** | Embedded iframe widget, redirect, or raw REST API | **Checkout Pro** (Redirect) or **Checkout Bricks** (Modular frontend SDK) | Payment links and embeddable payment button | | **Webhook Security** | JSON events verified via SHA-256 `checksum` header | Webhooks v2 with `x-signature` header (HMAC-SHA256 with timestamp) | Asynchronous webhook with shared secret signature | | **Bank Account Payouts** | Automatic daily sweep to Bancolombia accounts (free) | Manual or scheduled withdrawals to any bank (1–2 business days) | Automatic next-business-day transfer to any bank | | **Ideal Architecture For:** | B2B SaaS, e-commerce focused 100% on Colombia & Bancolombia | **Hotels, hospitality, multi-national LATAM platforms** | Omnichannel retailers combining in-store POS with online stores | --- ## 3. Webhook Security: Cryptographic Verification Mechanics The most dangerous security exploit against digital checkouts is **fake webhook spoofing**. Adversaries simulate approved transaction events to trigger unauthorized order fulfillment. Each gateway enforces a specific verification algorithm: ### 1. Wompi: SHA-256 Checksum Validation Wompi concatenates key event parameters with your private `Event Secret`: $$\text{Hash} = \text{SHA256}(\text{transaction.id} + \text{status} + \text{amount\_in\_cents} + \text{timestamp} + \text{events\_secret})$$ Comparing the calculated hash against `signature.checksum` guarantees authenticity. ### 2. Mercado Pago: Timestamped HMAC-SHA256 (`x-signature`) Mercado Pago passes an `x-signature` header with two components: `ts` (UNIX timestamp) and `v1` (HMAC-SHA256 digest). Enforcing a 5-minute tolerance window prevents replay attacks while utilizing a dedicated secret independent of API tokens. --- ## 4. Production Implementation: Decoupled Payment Gateway Adapter in TypeScript To avoid strict vendor lock-in, Clean Architecture dictates abstracting payment providers behind a unified **Payment Gateway Adapter**: ```typescript import crypto from 'crypto'; import axios from 'axios'; // 1. Universal Payment Contract export interface CreatePaymentIntentParams { orderId: string; amountInCents: number; currency: 'COP' | 'USD'; customerEmail: string; redirectUrl: string; description: string; } export interface PaymentIntentResult { paymentId: string; checkoutUrl: string; gateway: 'WOMPI' | 'MERCADOPAGO'; } export interface PaymentGatewayAdapter { createPaymentIntent(params: CreatePaymentIntentParams): Promise; verifyWebhookSignature(headers: Record, body: any): boolean; } // 2. Wompi Gateway Adapter export class WompiAdapter implements PaymentGatewayAdapter { private publicKey: string; private privateKey: string; private eventsSecret: string; constructor() { this.publicKey = process.env.WOMPI_PUBLIC_KEY || ''; this.privateKey = process.env.WOMPI_PRIVATE_KEY || ''; this.eventsSecret = process.env.WOMPI_EVENTS_SECRET || ''; } async createPaymentIntent(params: CreatePaymentIntentParams): Promise { // Generate integrity signature for Wompi Checkout const rawSignature = `${params.orderId}${params.amountInCents}${params.currency}${process.env.WOMPI_INTEGRITY_SECRET}`; const signature = crypto.createHash('sha256').update(rawSignature).digest('hex'); const checkoutUrl = `https://checkout.wompi.co/p/?public-key=${this.publicKey}¤cy=${params.currency}&amount-in-cents=${params.amountInCents}&reference=${params.orderId}&signature:integrity=${signature}&redirect-url=${encodeURIComponent(params.redirectUrl)}`; return { paymentId: params.orderId, checkoutUrl, gateway: 'WOMPI', }; } verifyWebhookSignature(headers: Record, body: any): boolean { const transaction = body?.data?.transaction; if (!transaction || !body?.signature?.checksum) return false; // Concatenate parameters strictly in protocol order const concatenated = `${transaction.id}${transaction.status}${transaction.amount_in_cents}${body.timestamp}${this.eventsSecret}`; const calculatedChecksum = crypto.createHash('sha256').update(concatenated).digest('hex'); return crypto.timingSafeEqual( Buffer.from(calculatedChecksum), Buffer.from(body.signature.checksum) ); } } // 3. Mercado Pago Gateway Adapter export class MercadoPagoAdapter implements PaymentGatewayAdapter { private accessToken: string; private webhookSecret: string; constructor() { this.accessToken = process.env.MERCADOPAGO_ACCESS_TOKEN || ''; this.webhookSecret = process.env.MERCADOPAGO_WEBHOOK_SECRET || ''; } async createPaymentIntent(params: CreatePaymentIntentParams): Promise { const response = await axios.post( 'https://api.mercadopago.com/checkout/preferences', { items: [ { title: params.description, quantity: 1, unit_price: params.amountInCents / 100, // Mercado Pago operates in major currency units currency_id: params.currency, }, ], external_reference: params.orderId, payer: { email: params.customerEmail }, back_urls: { success: params.redirectUrl, failure: params.redirectUrl, pending: params.redirectUrl, }, auto_return: 'approved', }, { headers: { Authorization: `Bearer ${this.accessToken}` }, } ); return { paymentId: response.data.id, checkoutUrl: response.data.init_point, gateway: 'MERCADOPAGO', }; } verifyWebhookSignature(headers: Record, body: any): boolean { const signatureHeader = headers['x-signature']; const requestId = headers['x-request-id']; const entityId = body?.data?.id; if (!signatureHeader || !requestId || !entityId) return false; let ts = ''; let v1 = ''; signatureHeader.split(',').forEach((part) => { const [key, val] = part.trim().split('='); if (key === 'ts') ts = val; if (key === 'v1') v1 = val; }); if (!ts || !v1) return false; const manifest = `id:${entityId};request-id:${requestId};ts:${ts};`; const calculated = crypto.createHmac('sha256', this.webhookSecret).update(manifest).digest('hex'); return crypto.timingSafeEqual(Buffer.from(calculated), Buffer.from(v1)); } } ``` --- ## 5. Architectural Decision Matrix: Wompi vs. Mercado Pago ### Choose Wompi if: 1. **Your user base is primarily based in Colombia**: Bancolombia accounts for over 18 million banking users. The integrated Nequi push notifications and Bancolombia App QR flows offer the lowest checkout friction in the domestic market. 2. **You want automated daily clearing**: For merchants with Bancolombia corporate accounts, Wompi clears funds automatically every night with zero bank transfer fees. 3. **You build local B2B SaaS subscriptions**: Wompi’s tokenization and customer recurring charging APIs are lightweight, stable, and well documented. ### Choose Mercado Pago if: 1. **You operate in Hospitality and Tourism**: Mercado Pago allows you to accept local cards and payment methods from tourists across Mexico, Brazil, Chile, Argentina, and Peru without requiring multiple regional subsidiaries. 2. **You rely on Booking Engines and CMS Platforms**: A massive ecosystem of community and official extensions (such as our **VikBooking Mercado Pago Plugin for $7 USD**) enables deployment in minutes. 3. **You want to offer Interest-Free Installments**: Mercado Pago negotiates zero-interest promotion agreements directly with issuing banks, boosting average order values. --- ## 6. Payment Gateway Engineering & Advisory with DoneAPI Integrating payment gateways reliably—with zero reconciliation leakage and maximum card authorization rates—requires deep mastery of both cryptographic webhook verification and regional tax withholdings. At **DoneAPI**, we help digital startups, scale-ups, and hospitality brands across LATAM to: - **Custom Payment Adapters & Smart Routing**: Engineering dynamic gateways that route transactions across Wompi, Mercado Pago, or Bold to guarantee 99.9% checkout uptime. - **Official VikBooking Mercado Pago Plugin ($7 USD)**: Automate hotel reservations in WordPress with instant webhook confirmation and accounting ledger synchronization with zero recurring SaaS fees. - **Cryptographic Webhook Hardening**: Bulletproof notification endpoints against replay attacks and spoofing attempts. - **E-Commerce Utility Micro-APIs**: Offload auxiliary complexity with our banking holiday calendars, WhatsApp tracking shorteners, and business verification APIs. > 💬 **Looking to integrate payment processors in Colombia, connect Wompi or Mercado Pago, or acquire the VikBooking plugin ($7 USD)?** > Connect directly with our FinTech integration engineers on WhatsApp.

Integrate Colombian Payment Gateways with Senior DoneAPI Support

Boost checkout conversions with PSE, Nequi, and credit cards, and automate settlements with idempotent code.

Speak with a FinTech Engineer on WhatsApp
--- ## 7. Conclusion The Colombian payments ecosystem provides mature and competitive options. **Wompi** excels in domestic conversions via Bancolombia and Nequi, while **Mercado Pago** offers unmatched multi-country reach for hospitality and regional digital platforms. By designing your architecture around **decoupled gateway adapters and strict cryptographic webhook validation**, you safeguard your platform's revenue, eliminate fraud risks, and provide Colombian shoppers with an instantaneous, frictionless payment experience.