SagePay card payments not being logged


I have set up SagePay integration and it used to work fine. Now, when people try and pay an invoice the payment is taken successfully and both I and the client receive an email directly from SagePay, but the payment is not logged to the invoice in QF like it should be (and used to be!)

Any idea what’s up?


Last night we received some notifications to the SagePay processing URL on our side. SagePay have a fondness of constantly changing their IP addresses, as a security measure we block anything from unknown IPs, occasionally a legitimate transaction will get blocked. It seems that is what has happened here.

Please add the payment manually in this instance and we will review this today.

Hi Glenn,

Many thanks for looking into this.

Just a polite question: this seems to happen reasonably regularly. How do other providers handle it? It’s just that I use some booking systems that also integrate with my SagePay account, and they don’t experience the same issue. I don’t mean to sound rude - just interested!

Also, I was wondering how other providers are able to integrate SagePay without the need for encryption keys and passwords? Again, another system I use simply requires the vendor name and it all works fine!

Thanks again,


I couldn’t say exactly what other systems do to authenticate the callback, they may be recording the customers IP and validating this on the callback rather than validating the SagePay’s referring IPs.

We have not made any significant changes to this integration since 2011 when it was originally developed. At the time we followed the published guidelines and hard coded the IP range provided by SagePay. Over the years these IPs have become unreliable as SagePay have changed their infrastructure. That’s why we have now taken the decision to remove them entirely, so this problem should not persist.

I have personally spoken to the SagePay technical department on numerous occasions. The technical support is shockingly bad, even now they are not recognising the IP addresses I know they have made genuine calls to us on.

There are several different integration methods offered by SagePay we use the HTML forms method, other methods may provide a simpler means of authentication. Right now we only have a small number of users integrated with SagePay, certainly if these numbers increase we will look at a complete rebuild of our intergration, although to be honest with the resent change I don’t think you will have any further issues.

Thanks! I’ll let you know if there are any further problems with it, but it sounds as if it will be ok from now on.

Thanks again,