A Verification of Payee response reveals whether a name matches an account — information only the right parties should exchange. So the scheme's API does not rely on API keys alone: it uses mutual TLS, where both the requesting and responding side present a certificate that proves they are a regulated PSP. The certificate type is the QWAC.
What a QWAC is
- QWAC stands for Qualified Website Authentication Certificate, defined under the EU eIDAS regulation.
- It is the same PSD2 certificate already used in open banking to identify regulated payment players.
- It is issued by a Qualified Trust Service Provider (QTSP) and carries the holder's regulatory identity.
What managing it involves
A certificate is not set-and-forget. It has a validity period, must be renewed before it expires, and the other side must be able to check it has not been revoked — all without breaking the 24/7 availability the scheme requires.
- 1 Obtain a QWAC from a qualified trust service provider.
- 2 Present it on every connection and validate the counterparty's certificate in return.
- 3 Track expiry, rotate ahead of time, and check revocation so verification never stalls.
Certificates fail quietly
An expired or unrenewed certificate does not warn your users — it just starts rejecting connections. Proactive rotation is what keeps VoP available.
RoxPay manages the certificate trust model for you — issuance, presentation, validation and renewal — so you get rulebook-compliant, mutually authenticated VoP without operating an eIDAS certificate lifecycle yourself.