Payment Gateways in Colombia for Developers: Technical Comparison of Wompi, Mercado Pago, PSE & Bold

Digital commerce and SaaS platforms in Colombia have undergone a massive transformation over the past five years. Unlike markets such as the United States or Western Europe, where credit cards account for more than 80% of digital transactions, the Colombian payments ecosystem is defined by unique banking rails: the dominance of PSE (Pagos Seguros en Línea by ACH Colombia), the ubiquity of mobile wallets like Nequi and Daviplata, and consumers who expect to pay via direct bank transfers as readily as with credit cards.

For technical leads, software architects, and startup founders, choosing a payment gateway is not merely a commercial agreement—it is a mission-critical architectural decision. Selecting a gateway with unstable REST APIs, unverified webhooks, or prolonged payout settlement windows will crush checkout conversion rates, inflate processing fees, and cause severe accounting reconciliation headaches.

In this deep dive, we conduct a technical and financial comparison between the three dominant gateways in Colombia—Wompi (Bancolombia), Mercado Pago, and Bold—analyzing their fee structures, developer SDK ergonomics, webhook verification mechanics, and how to implement a unified Payment Adapter Pattern in TypeScript to decouple your business logic.

1. Colombia’s Payment Landscape: Consumer Payment Methods

Before architecting checkout flows, engineering teams must understand the actual breakdown of consumer payment methods in Colombia:

┌────────────────────────────────────────────────────────────────────────┐
│               Digital Payment Method Mix in Colombia                   │
└────────────────────────────────────────────────────────────────────────┘

  [PSE (ACH Colombia)]           ~ 45% (Real-time account-to-account transfer)
  [Digital Wallets: Nequi/Davi]  ~ 25% (Mobile push payments and QR codes)
  [Credit & Debit Cards]         ~ 22% (Visa, Mastercard, Amex, Diners)
  [Cash Collection Networks]     ~  8% (Efecty, Baloto, Su Red, Paga Todo)

PSE: The undisputed payment standard for mid-to-high ticket items (travel and hospitality, B2B software, electronics, education). Funds debit directly from the customer’s savings or checking account.
Nequi: Indispensable for retail, dining, and mobile-first micro-transactions. Customers expect a seamless experience via dynamic push notifications (push payment) or QR scans.
Credit Cards: Essential for recurring SaaS billing, hotel reservation pre-authorizations (card tokenization), and installment payments (cuotas) tied to local bank interest promotions.

2. Technical & Fee Comparison: Wompi vs. Mercado Pago vs. Bold

Evaluation Dimension	Wompi (Bancolombia)	Mercado Pago (Mercado Libre)	Bold (Colombian FinTech)
Base Processing Fee (Cards & PSE)	2.65% + $700 COP + VAT (Standard)	3.29% + $800 COP + VAT (Instant) / 2.99% + $800 COP (14-day)	2.99% + $900 COP + VAT (Cards) / $900 COP flat for PSE
Nequi Integration	Native and direct (Dynamic push & Bancolombia QR)	Supported through debit cards or PSE rails	Supported via PSE or embedded app
Checkout UI Options	Embedded iframe widget, redirect, or raw REST API	Checkout Pro (Redirect) or Checkout Bricks (Modular frontend SDK)	Payment links and embeddable payment button
Webhook Security	JSON events verified via SHA-256 `checksum` header	Webhooks v2 with `x-signature` header (HMAC-SHA256 with timestamp)	Asynchronous webhook with shared secret signature
Bank Account Payouts	Automatic daily sweep to Bancolombia accounts (free)	Manual or scheduled withdrawals to any bank (1–2 business days)	Automatic next-business-day transfer to any bank
Ideal Architecture For:	B2B SaaS, e-commerce focused 100% on Colombia & Bancolombia	Hotels, hospitality, multi-national LATAM platforms	Omnichannel retailers combining in-store POS with online stores

3. Webhook Security: Cryptographic Verification Mechanics

The most dangerous security exploit against digital checkouts is fake webhook spoofing. Adversaries simulate approved transaction events to trigger unauthorized order fulfillment. Each gateway enforces a specific verification algorithm:

1. Wompi: SHA-256 Checksum Validation

Wompi concatenates key event parameters with your private Event Secret:

$$\text{Hash} = \text{SHA256}(\text{transaction.id} + \text{status} + \text{amount_in_cents} + \text{timestamp} + \text{events_secret})$$

Comparing the calculated hash against signature.checksum guarantees authenticity.

2. Mercado Pago: Timestamped HMAC-SHA256 (`x-signature`)

Mercado Pago passes an x-signature header with two components: ts (UNIX timestamp) and v1 (HMAC-SHA256 digest). Enforcing a 5-minute tolerance window prevents replay attacks while utilizing a dedicated secret independent of API tokens.

4. Production Implementation: Decoupled Payment Gateway Adapter in TypeScript

To avoid strict vendor lock-in, Clean Architecture dictates abstracting payment providers behind a unified Payment Gateway Adapter:

import crypto from 'crypto';
import axios from 'axios';

// 1. Universal Payment Contract
export interface CreatePaymentIntentParams {
  orderId: string;
  amountInCents: number;
  currency: 'COP' | 'USD';
  customerEmail: string;
  redirectUrl: string;
  description: string;
}

export interface PaymentIntentResult {
  paymentId: string;
  checkoutUrl: string;
  gateway: 'WOMPI' | 'MERCADOPAGO';
}

export interface PaymentGatewayAdapter {
  createPaymentIntent(params: CreatePaymentIntentParams): Promise<PaymentIntentResult>;
  verifyWebhookSignature(headers: Record<string, string>, body: any): boolean;
}

// 2. Wompi Gateway Adapter
export class WompiAdapter implements PaymentGatewayAdapter {
  private publicKey: string;
  private privateKey: string;
  private eventsSecret: string;

  constructor() {
    this.publicKey    = process.env.WOMPI_PUBLIC_KEY || '';
    this.privateKey   = process.env.WOMPI_PRIVATE_KEY || '';
    this.eventsSecret = process.env.WOMPI_EVENTS_SECRET || '';
  }

  async createPaymentIntent(params: CreatePaymentIntentParams): Promise<PaymentIntentResult> {
    // Generate integrity signature for Wompi Checkout
    const rawSignature = `${params.orderId}${params.amountInCents}${params.currency}${process.env.WOMPI_INTEGRITY_SECRET}`;
    const signature = crypto.createHash('sha256').update(rawSignature).digest('hex');

    const checkoutUrl = `https://checkout.wompi.co/p/?public-key=${this.publicKey}&currency=${params.currency}&amount-in-cents=${params.amountInCents}&reference=${params.orderId}&signature:integrity=${signature}&redirect-url=${encodeURIComponent(params.redirectUrl)}`;

    return {
      paymentId: params.orderId,
      checkoutUrl,
      gateway: 'WOMPI',
    };
  }

  verifyWebhookSignature(headers: Record<string, string>, body: any): boolean {
    const transaction = body?.data?.transaction;
    if (!transaction || !body?.signature?.checksum) return false;

    // Concatenate parameters strictly in protocol order
    const concatenated = `${transaction.id}${transaction.status}${transaction.amount_in_cents}${body.timestamp}${this.eventsSecret}`;
    const calculatedChecksum = crypto.createHash('sha256').update(concatenated).digest('hex');

    return crypto.timingSafeEqual(
      Buffer.from(calculatedChecksum),
      Buffer.from(body.signature.checksum)
    );
  }
}

// 3. Mercado Pago Gateway Adapter
export class MercadoPagoAdapter implements PaymentGatewayAdapter {
  private accessToken: string;
  private webhookSecret: string;

  constructor() {
    this.accessToken   = process.env.MERCADOPAGO_ACCESS_TOKEN || '';
    this.webhookSecret = process.env.MERCADOPAGO_WEBHOOK_SECRET || '';
  }

  async createPaymentIntent(params: CreatePaymentIntentParams): Promise<PaymentIntentResult> {
    const response = await axios.post(
      'https://api.mercadopago.com/checkout/preferences',
      {
        items: [
          {
            title: params.description,
            quantity: 1,
            unit_price: params.amountInCents / 100, // Mercado Pago operates in major currency units
            currency_id: params.currency,
          },
        ],
        external_reference: params.orderId,
        payer: { email: params.customerEmail },
        back_urls: {
          success: params.redirectUrl,
          failure: params.redirectUrl,
          pending: params.redirectUrl,
        },
        auto_return: 'approved',
      },
      {
        headers: { Authorization: `Bearer ${this.accessToken}` },
      }
    );

    return {
      paymentId: response.data.id,
      checkoutUrl: response.data.init_point,
      gateway: 'MERCADOPAGO',
    };
  }

  verifyWebhookSignature(headers: Record<string, string>, body: any): boolean {
    const signatureHeader = headers['x-signature'];
    const requestId       = headers['x-request-id'];
    const entityId        = body?.data?.id;

    if (!signatureHeader || !requestId || !entityId) return false;

    let ts = '';
    let v1 = '';
    signatureHeader.split(',').forEach((part) => {
      const [key, val] = part.trim().split('=');
      if (key === 'ts') ts = val;
      if (key === 'v1') v1 = val;
    });

    if (!ts || !v1) return false;

    const manifest = `id:${entityId};request-id:${requestId};ts:${ts};`;
    const calculated = crypto.createHmac('sha256', this.webhookSecret).update(manifest).digest('hex');

    return crypto.timingSafeEqual(Buffer.from(calculated), Buffer.from(v1));
  }
}

5. Architectural Decision Matrix: Wompi vs. Mercado Pago

Choose Wompi if:

Your user base is primarily based in Colombia: Bancolombia accounts for over 18 million banking users. The integrated Nequi push notifications and Bancolombia App QR flows offer the lowest checkout friction in the domestic market.
You want automated daily clearing: For merchants with Bancolombia corporate accounts, Wompi clears funds automatically every night with zero bank transfer fees.
You build local B2B SaaS subscriptions: Wompi’s tokenization and customer recurring charging APIs are lightweight, stable, and well documented.

Choose Mercado Pago if:

You operate in Hospitality and Tourism: Mercado Pago allows you to accept local cards and payment methods from tourists across Mexico, Brazil, Chile, Argentina, and Peru without requiring multiple regional subsidiaries.
You rely on Booking Engines and CMS Platforms: A massive ecosystem of community and official extensions (such as our VikBooking Mercado Pago Plugin for $7 USD) enables deployment in minutes.
You want to offer Interest-Free Installments: Mercado Pago negotiates zero-interest promotion agreements directly with issuing banks, boosting average order values.

6. Payment Gateway Engineering & Advisory with DoneAPI

Integrating payment gateways reliably—with zero reconciliation leakage and maximum card authorization rates—requires deep mastery of both cryptographic webhook verification and regional tax withholdings.

At DoneAPI, we help digital startups, scale-ups, and hospitality brands across LATAM to:

Custom Payment Adapters & Smart Routing: Engineering dynamic gateways that route transactions across Wompi, Mercado Pago, or Bold to guarantee 99.9% checkout uptime.
Official VikBooking Mercado Pago Plugin ($7 USD): Automate hotel reservations in WordPress with instant webhook confirmation and accounting ledger synchronization with zero recurring SaaS fees.
Cryptographic Webhook Hardening: Bulletproof notification endpoints against replay attacks and spoofing attempts.
E-Commerce Utility Micro-APIs: Offload auxiliary complexity with our banking holiday calendars, WhatsApp tracking shorteners, and business verification APIs.

💬 Looking to integrate payment processors in Colombia, connect Wompi or Mercado Pago, or acquire the VikBooking plugin ($7 USD)?
Connect directly with our FinTech integration engineers on WhatsApp.

Integrate Colombian Payment Gateways with Senior DoneAPI Support

Boost checkout conversions with PSE, Nequi, and credit cards, and automate settlements with idempotent code.

Speak with a FinTech Engineer on WhatsApp

7. Conclusion

The Colombian payments ecosystem provides mature and competitive options. Wompi excels in domestic conversions via Bancolombia and Nequi, while Mercado Pago offers unmatched multi-country reach for hospitality and regional digital platforms.

By designing your architecture around decoupled gateway adapters and strict cryptographic webhook validation, you safeguard your platform’s revenue, eliminate fraud risks, and provide Colombian shoppers with an instantaneous, frictionless payment experience.