Microsoft Dynamics NAV and GoCardless integration

What moves between them

The primary flow moves from GoCardless into Microsoft Dynamics NAV. When a customer payment succeeds in GoCardless, the webhook event arrives at ml-connector with payment amount, customer reference, and settlement date. ml-connector matches the GoCardless customer to the NAV customer, looks up the unpaid sales invoices, and posts a cash receipt journal line into NAV, mapping the bank account and customer dimension. Optional reverse flow syncs NAV customers and open invoice amounts into GoCardless so mandates stay aligned with current AR balances.

How ml-connector handles it

ml-connector stores the NAV OAuth credentials and GoCardless bearer token encrypted. For NAV it exchanges the stored client credentials for a fresh OAuth bearer token on each session, then queries the customer and sales invoice tables via OData. For GoCardless it subscribes to the payment.paid, mandate.created, and mandate.cancelled webhooks with signature verification enabled; any webhook without a valid HMAC-SHA256 signature is rejected without processing. When a payment notification arrives, ml-connector translates the GoCardless customer ID to the matching NAV customer number, retrieves the oldest unpaid invoices, and posts a batch journal entry. NAV's 3-day webhook subscription renewal is tracked so subscriptions do not lapse. If a journal post fails, the payment is marked as pending and retried on the next sync cycle with exponential backoff. All payments carry a full audit entry showing the GoCardless reference, NAV journal ID, and status.

A real-world example

A mid-sized consulting services firm uses Microsoft Dynamics NAV for accounting and invoices clients monthly. The firm has customers in the UK, EU, and Nordics, and uses GoCardless to collect recurring service fees directly from bank accounts. Before the integration, the accounts team waited for bank settlement notifications, matched them manually to invoices in NAV, and posted cash receipts one by one. With NAV and GoCardless connected, each successful collection appears as a cash receipt in NAV within seconds of the bank debit, customer balances update automatically, and the month-end reconciliation takes hours instead of days.

What you can do

• •Receive real-time payment notifications from GoCardless webhooks and post them as cash receipts into Dynamics NAV journals.
• •Match GoCardless customer IDs to NAV customer numbers and apply payments against open sales invoices automatically.
• •Authenticate both systems securely: OAuth 2.0 for NAV and bearer token for GoCardless, with token refresh and signature verification.
• •Maintain a complete audit trail for every payment showing the GoCardless payment ID, NAV journal entry, and settlement status.
• •Handle webhook subscription renewal for GoCardless and retry failed journal posts with exponential backoff and state tracking.

Questions

How does the integration handle GoCardless webhook signature verification?

GoCardless includes an HMAC-SHA256 signature in the Webhook-Signature header on every event. ml-connector computes the same signature from the raw webhook body and shared secret, compares them in constant time, and rejects any webhook without a valid match. Only verified events are processed; unsigned or forged events are logged but never posted to NAV.

What happens if a payment cannot be matched to a NAV customer or invoice?

If the GoCardless customer ID does not map to any NAV customer, or if no open invoice exists for that customer, ml-connector logs the payment with a detailed exception and queues it for manual review. The payment is not dropped; it is held pending operator intervention to correct the mapping or create the missing invoice.

Does the integration work with both online and on-premises Dynamics NAV?

Yes. The integration supports both Microsoft Dynamics 365 Business Central online via OAuth 2.0 against Microsoft Entra ID, and on-premises NAV instances with OAuth or basic authentication. Each deployment type requires the appropriate endpoint URL and credentials configured per customer.