Payment gatewaysThree connected, the rest on request

Sign out

Demo mode. Every figure and name here is display data. The screens are the same ones you will see, and the content is what gets built from your own business.

Three gateways connected with a ready adapter, and the rest installed on request

The field names below are the gateways’ own names, not labels of ours — because the first thing that breaks an integration is naming the fields conveniently and then nobody finding them in the gateway’s own panel.

A live key is not enough on its own.

When the configured key is live (sk_live_…) the system refuses to create any link until you acknowledge live mode with your commercial registration number. The reason is that both incidents do happen: a test run firing a real payment, and a live release sending test links.

Connected with a ready adapter

3 gateways · activated with their keys

Moyasar

Not connected
From the Moyasar panel » Keys. The browser key publishable is never used here at all.
Set when the webhook is created. And even with it present we never record an instalment on the notification alone — we ask the gateway for the status again before recording.

Paylink

Not connected
panel Paylink » Settings » API.
Shown once at creation and never shown again.
The domain is what determines the mode, not the shape of the key. Which is why it is chosen explicitly here rather than guessed.
The platform’s own minimum. We enforce it before the call rather than after — a raw 400 from a gateway has no business coming near a customer message.

Tap

Not connected
From the Tap panel » Developers. Sent as a bearer token carrying Bearer.
to verify the HMAC-SHA256 signature over the raw payload. Verify against the raw, not the parsed, or a single differing byte fails a valid signature.

Other gateways and providers in the Saudi market

20 providers · installed on request
  • HyperPay entityId with the COPYandPAY hosted model Installed on request
  • PayTabs profile_id + server_key Installed on request
  • Geidea Basic authentication with a SHA-256 signature over the amount, reference and timestamp Installed on request
  • Urway requestHash = SHA-256 over the full transaction string Installed on request
  • MyFatoorah SendPayment with the LNK option — it returns the link alone, which suits WhatsApp best Installed on request
  • Amazon Payment Services access_code + merchant_identifier + signature Installed on request
  • Telr A merchant identifier and access key with a hosted payment page Installed on request
  • Checkout.com A secret key with ready payment links from the API Installed on request
  • ClickPay An API close to PayTabs with the same credential pair Installed on request
  • EdfaPay A merchant key with a signature over the order fields Installed on request
  • Foloosi A merchant key with a hosted payment link Installed on request
  • Tamara Instalments — a checkout session with an API key and a status webhook Installed on request
  • Tabby Instalments — a payment session with a secret key and later confirmation Installed on request
  • Lean A payment institution licensed by SAMA — account-to-account transfer Installed on request
  • Yuno A gateway orchestrator with a PTSP licence — a layer above the gateways, not a replacement for them Installed on request
  • STC Pay No direct merchant API — available from inside Tap or HyperPay Through another gateway
  • SADAD A national bill system — connected through a bank or a gateway, not directly Through another gateway
  • Salla Pay Payments inside the Salla platform — not callable from outside it Inside the platform
  • Zid Pay Payments inside the Zid platform — not callable from outside it Inside the platform
  • Nearpay Accepting NFC on a phone — a card-present payment, not a link you send Outside the scope of links

How the link reaches the customer

Three steps · no involvement from you after the first
1

You approve the contract

Nothing starts before you press. The contract is prepared automatically and waits for your approval on WhatsApp, exactly as it does today.

2

The system computes the instalment

The amount is read from your instalment schedule computed in code — not from the message text and not from the conversation memory. And the model has no tool that accepts an amount in the first place.

3

The link is sent as its own message

Composed by the code, not by the model, the same way PDF files are sent today. So it never passes through the reply guards, and nobody can alter an amount or a link.

Bank transfer stays exactly as it is.

The gateway is an addition, not a replacement, and whoever prefers a transfer carries on with it. What changed is that a customer saying “I paid” is no longer enough on its own, just as it never was — but when the gateway confirms, it becomes