পেমেন্ট গেটওয়ে

A payment gateway is the way a client pays an invoice. AIOBilling ships nine of them as free plugins: PayPal and Stripe for the world, bKash, Nagad and SSLCommerz for Bangladesh, Razorpay for India, Paystack for Africa, and a bank transfer and a manual mobile wallet that need no gateway account at all. This chapter explains what they all share: the page where you switch them on, the settings every gateway has, the callback address, how a payment is recorded and where to look when one goes wrong. Each gateway has its own chapter with every setting, what the provider needs from you, a test routine and troubleshooting; the table below links to them. For plugins in general see Plugins and themes.

The gateways at a glance

The Payment Gateways page

Open Setup → Payment Gateways. It has two tabs: Manage Existing Gateways lists the gateways that are on, in the order clients see them, and All Payment Gateways lists every gateway on disk.

• Activate switches a gateway on and opens its settings.
• Deactivate switches it off. If it was the default method, the default is cleared.
• The up and down arrows move a gateway in the list. That is the order on the checkout and on the invoice.
• Default Payment Method is chosen first for new clients and new orders.
• Configure opens the settings form. It ends with the Callback URL of that gateway.

A gateway shows on an invoice only if it takes the invoice's currency (bKash and Nagad take BDT only, Paystack takes NGN, GHS, ZAR, KES and USD). Bank Transfer is switched on by the installer, and is the default method until you choose another.

The callback address

Every gateway has one address of the form https://billing.example.com/callback/<code>, where the code is the plugin's code (paypal, stripe, bkash, nagad, sslcommerz, rocket, razorpay, paystack, banktransfer). The settings page shows it read-only at the end; in a sub-folder install the folder is part of the address, so copy it from the page and never type it. The address is public: the provider's server or the client's returning browser calls it. Where a provider asks for a notification, IPN or webhook address (Stripe, Razorpay, Paystack, SSLCommerz) you paste it there; PayPal, bKash and Nagad are given the address with each payment. The offline gateways have no callback.

The answer to a call from a provider is plain text: OK ... with the code 200 when it was handled, ERROR ... with the code 400 when it was not.

Settings every gateway has

Secret fields (passwords, keys, secrets) are shown empty with (unchanged); leave one empty to keep the saved value.

How a payment is recorded

Online gateways send the client away to pay, then confirm the payment two ways: the browser coming back and, for most, a server-to-server notice. In both cases the plugin asks the gateway whether the payment is real (a signed message, a verify call or a validation call), checks that the amount and the currency fit, and then adds a transaction and marks the invoice paid. A payment that arrives twice is recorded once.

The offline gateways (Bank Transfer and Mobile Wallet) show instructions. The client may press I have paid and give a reference; the invoice turns Payment Pending, the reference is added to the invoice's admin notes, you get a bell notice and an e-mail, and you add the payment yourself with Add Payment when the money arrives.

Refunds: on the invoice's Refund tab, Refund through the payment gateway works for Stripe, Razorpay and Paystack. For the others record the refund with Offline refund (record only) after you have paid the money back at the provider. See Invoices and payments.

Where to look when a payment is missing

• Billing → Gateway Log keeps what each callback sent and how the plugin answered, with a result word such as paid, bad signature, currency mismatch or unknown order. Filter by gateway; View shows the full data.
• Utilities → Module Log shows every call to a gateway with the request (keys hidden) and the answer. The callback itself is in it too.
• If a client has paid and the logs show nothing, the provider could not reach your callback address: check HTTPS, a firewall, and that the address is the one shown on the settings page.
• You can always record a payment yourself with Add Payment on the invoice.

More in Troubleshooting.

Fraud Guard

Fraud Guard is a plugin too, but it checks orders, not payments. See Fraud Guard.