SYSPRO and GoCardless integration

What moves between them

The main flow runs from GoCardless into SYSPRO. When a payment is collected, GoCardless pushes an event to the registered webhook endpoint; ml-connector verifies the HMAC signature and posts the receipt to SYSPRO's AR module, mapped to the customer account in SYSPRO. Mandates created in GoCardless are polled daily and registered against SYSPRO customer records so payment allocations land on the correct accounts. Subscription and payout events flow the same direction to keep cash reconciliation current.

How ml-connector handles it

ml-connector stores both credential sets encrypted: the GoCardless Bearer token and the SYSPRO session token (or Basic Auth credentials for OData reads). On the GoCardless side, it registers itself as a webhook endpoint and verifies every incoming event by computing HMAC-SHA256(secret, raw_body) and comparing to the Webhook-Signature header; events with invalid signatures are logged and rejected (never marked as processed) so GoCardless retries them. On the SYSPRO side, it posts receipts and mandate links using e.net Business Objects (REST or SOAP, depending on payload size), refreshing the session token when a call returns a timeout, and polls OData for customer account changes to stay in sync. Because GoCardless webhook event IDs are immutable, ml-connector deduplicates by tracking the GoCardless event ID in the audit trail so a retry of the same event does not double-post a receipt. If SYSPRO is unavailable when a webhook arrives, the event is queued in ml-connector and retried at exponential backoff until SYSPRO is healthy.

A real-world example

A mid-sized UK manufacturer uses SYSPRO for AR and inventory, and GoCardless to collect recurring payments from manufacturing customers (weekly, monthly, or quarterly shipment charges). Before the integration, the finance team received GoCardless payment notifications via email, manually logged into the GoCardless dashboard to verify the payment, then manually entered each receipt line into SYSPRO's AR module by customer account. With SYSPRO and GoCardless connected, each payment collected flows into SYSPRO as an AR receipt automatically, and the daily GL posting shows the full day's collections in one batch. The manual email-to-SYSPRO keying step is gone, and the AR aging report is always current by end of business.

What you can do

• •Post GoCardless payment receipts into SYSPRO AR automatically when collections occur, mapped to customer accounts.
• •Register GoCardless mandates and subscriptions against SYSPRO customer records so payment allocations land on the correct accounts.
• •Verify every GoCardless webhook signature (HMAC-SHA256) and reject unsigned events before posting to SYSPRO.
• •Deduplicate GoCardless webhook events by event ID so retries do not double-post receipts in SYSPRO.
• •Queue payment postings when SYSPRO is unavailable and resume with exponential backoff when the connection returns.

Questions

How does ml-connector verify GoCardless webhooks?

GoCardless signs each webhook batch with an HMAC-SHA256 signature in the Webhook-Signature header. ml-connector computes HMAC-SHA256(secret, raw_body) on the received request and compares it to the header; if they match, the batch is processed; if not, it is rejected and GoCardless will retry. This prevents unsigned or tampered events from posting to SYSPRO.

What happens if SYSPRO is unavailable when a payment webhook arrives?

ml-connector queues the event in its local audit trail and returns a 202 Accepted to GoCardless so it does not retry. Once SYSPRO is healthy, ml-connector retries posting the receipt at exponential backoff. If a GoCardless event ID has already been posted, deduplication prevents a duplicate receipt from being created.

Which direction does data move, and can ml-connector write mandates into GoCardless?

The main flow is GoCardless into SYSPRO: payments, mandates, and payout events post into SYSPRO AR. ml-connector does not write into GoCardless; mandates and subscriptions are created and managed in GoCardless and read by polling daily to keep SYSPRO customer accounts in sync.