NobabPay Payment Gateway — API Documentation

1. Overview

NobabPay is a full-featured payment gateway for Bangladesh. Your customers never leave your brand — they are redirected to a secure, white-labelled checkout page, and your server is notified automatically when the payment succeeds.

⚡ How it works — in 4 simple steps

1. Create PaymentYour server calls our API

→

2. Redirect CustomerWe return a payment URL

→

3. Customer PaysbKash, Nagad, Binance, cards...

→

4. Auto-VerifyWebhook + verify API

Every payment is automatically verified against the real transaction (SMS or gateway API). You do not need to check anything manually. When the payment completes you receive a webhook and the customer is redirected back to your success_url.

🔒 Key Features

All major Bangladesh methods — bKash, Nagad, Rocket, Upay, mCash, MyCash, SureCash, Tap, Cellfin, EasyPaisa, OkWallet, bank transfers and Binance Pay (USDT).
Automatic verification — payments are checked in real time; no manual approval needed.
Webhooks & redirects — your server gets notified instantly with the transaction status.
Metadata support — pass your own order/user ID and get it back on verification.
Ready-made plugins — WordPress WooCommerce and WHMCS modules included (see Plugins).

2. Quick Start

You can go from zero to your first live payment in about 10 minutes. Here is the whole flow.

Get your API Key

Create a payment

Call /api/payment/create with the amount, success and cancel URLs. We return a payment_url.

Redirect your customer

Send the customer to payment_url. They pay on our secure checkout page.

Handle the result

Receive the webhook (or verify with the transaction ID) and confirm the order on your side.

✅

Minimum working example: one POST /api/payment/create request, one redirect, and one webhook handler. That's the entire integration.

3. API Reference

All endpoints accept and return JSON. Every request must be made over HTTPS and must include your API key.

🔑 Authentication

Send your API key in the request header:

HEADERAPI-KEY: your_brand_api_key

You can also pass it as a POST parameter named api_key instead of the header. Your key is found at nobabpay.top → Settings → Brands (click the key to copy).

💡

Keep it secret. Never expose your API key in browser-side code (JavaScript). Always call the API from your server.

➕ Create a Payment

POSThttps://pay.nobabpay.top/api/payment/create

Creates a payment and returns the checkout URL you redirect the customer to.

Request parameters (JSON body)

Parameter	Type	Required	Description
`amount`	number	`Yes`	Amount to charge (e.g. `500` or `49.50`). Maximum 1,000,000.
`success_url`	string	`Yes`	URL the customer is redirected to after a successful payment.
`cancel_url`	string	`Yes`	URL the customer is redirected to if they cancel or the payment fails.
`webhook_url`	string	No	Server-to-server notification URL. We POST the payment status here. Highly recommended.
`metadata`	object	No	Any JSON object you want back, e.g. `{"order_id": 1024}`. Returned unchanged in the verify response.
`cus_name`	string	No	Customer name shown on the checkout page (default: `Default Name`).
`cus_email`	string	No	Customer email (default: `default@gmail.com`).

Example request

cURL

curl -X POST https://pay.nobabpay.top/api/payment/create \
  -H "API-KEY: your_brand_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 500,
    "success_url": "https://your-site.com/payment/success",
    "cancel_url": "https://your-site.com/payment/cancel",
    "webhook_url": "https://your-site.com/payment/webhook",
    "metadata": {"order_id": 1024, "user_id": 55},
    "cus_name": "Rahim Uddin",
    "cus_email": "rahim@example.com"
  }'

Success response

200 OK

{
  "status": 1,
  "message": "Payment Link",
  "payment_url": "https://pay.nobabpay.top/api/execute/a1b2c3d4e5f6..."
}

Next step: redirect your customer to payment_url (HTTP 302 / window.location).

⚠️

Never trust the redirect alone. The redirect tells you the customer came back, not that the payment succeeded. Always confirm with the webhook or the Verify API before fulfilling the order.

✅ Verify a Payment

POSThttps://pay.nobabpay.top/api/payment/verify

Checks the current status of a transaction using its ID. Use this in your webhook handler or on the success page before shipping the order.

Request parameters (JSON body)

Parameter	Type	Required	Description
`transaction_id`	string	`Yes`	The transaction ID — the value of `transactionId` from the webhook or redirect, or `transaction_id` from the verify response.

Example request & response

cURL

curl -X POST https://pay.nobabpay.top/api/payment/verify \
  -H "API-KEY: your_brand_api_key" \
  -H "Content-Type: application/json" \
  -d '{"transaction_id": "SXF80K119297"}'

200 OK

{
  "cus_name": "Rahim Uddin",
  "cus_email": "rahim@example.com",
  "amount": "500.000",
  "transaction_id": "SXF80K119297",
  "metadata": {"order_id": 1024, "user_id": 55},
  "payment_method": "bkash",
  "status": "COMPLETED"
}

Status values

Status	Meaning	Action
`COMPLETED`	The payment succeeded.	Fulfil the order.
`PENDING`	The payment is still processing.	Wait — check again later or wait for the webhook.
`ERROR`	No transaction found for this ID, or the transaction failed.	Treat as unpaid; ask the customer to retry.

4. Payment Flow (Step by Step)

This is the complete journey of one payment, from creation to confirmation. Understand this once and the whole API becomes obvious.

🔎 Complete sequence

Your WebsiteOrder page

→

Create APIPOST /api/payment/create

→

NobabPay Checkoutpayment_url

→

Customer PaysbKash / Nagad / Binance...

Webhook POSTpayment_status to your server

→

You VerifyPOST /api/payment/verify

→

Fulfil OrderMark paid, ship product

→

Redirect Backsuccess_url / cancel_url

The customer places an order on your site and chooses Pay with NobabPay.
Your server calls /api/payment/create with the amount and your URLs.
NobabPay returns payment_url. You redirect the customer there.
The customer pays using any of the available methods. Payments are auto-verified in real time.
NobabPay sends a webhook (server-to-server) to your webhook_url with the result.
Your server calls /api/payment/verify with the transaction ID to confirm (recommended).
You fulfil the order, then redirect the customer to success_url (or cancel_url).

💡

Timing: the webhook usually arrives within a few seconds of payment. The customer redirect can arrive before or after the webhook — always treat the webhook (or a successful verify call) as the source of truth.

5. Webhook & Redirects

NobabPay notifies your server automatically. Here is exactly what is sent and how to use it safely.

🔔 Webhook notification

When a payment status changes, NobabPay sends a POST request (form-encoded) to your webhook_url:

Parameter	Description
`paymentMethod`	The payment method used (e.g. `bkash`, `nagad`, `binance`).
`transactionId`	Unique NobabPay transaction ID — use this with the Verify API.
`paymentAmount`	The amount paid.
`paymentFee`	The gateway fee deducted.
`status`	`pending` \| `completed` \| `failed`

🔒

Security: always call /api/payment/verify with transactionId and only fulfil the order when the returned status is COMPLETED. Never trust the webhook body alone.

🔗 Customer redirect

After the payment, the customer is redirected to your success_url (on success) or cancel_url (on cancel/failure), with these query parameters appended:

GEThttps://your-site.com/payment/success?paymentMethod=bkash&transactionId=SXF80K119297&paymentAmount=500&paymentFee=0&status=completed

Parameter	Description
`status`	`pending`, `completed` or `failed`
`transactionId`	The NobabPay transaction ID.
`paymentMethod`	The method the customer used.
`paymentAmount`	Amount paid.
`paymentFee`	Gateway fee.

Use the redirect page only to show a nice confirmation screen. Fulfil the order based on the webhook or verify API result.

6. Code Examples

Copy-paste ready examples in PHP, Python and JavaScript. Replace YOUR_API_KEY and your URLs, and you are done.

💾 PHP (cURL)

PHP — create a payment

<?php
// 1. Create the payment
function nobabpay_create_payment($amount, $metadata) {
    $payload = [
        'amount'      => $amount,
        'success_url' => 'https://your-site.com/payment/success',
        'cancel_url'  => 'https://your-site.com/payment/cancel',
        'webhook_url' => 'https://your-site.com/payment/webhook',
        'metadata'    => $metadata,
    ];

    $ch = curl_init('https://pay.nobabpay.top/api/payment/create');
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => json_encode($payload),
        CURLOPT_HTTPHEADER     => [
            'API-KEY: YOUR_API_KEY',
            'Content-Type: application/json',
        ],
    ]);
    $response = curl_exec($ch);
    curl_close($ch);

    return json_decode($response, true);
}

// 2. Redirect the customer
$result = nobabpay_create_payment(500, ['order_id' => 1024]);
header('Location: ' . $result['payment_url']);
exit;

💾 PHP — webhook handler (recommended pattern)

PHP — /payment/webhook

<?php
// Receive the webhook from NobabPay
$transaction_id = $_POST['transactionId'] ?? '';

// Always verify with the API before trusting the webhook
$ch = curl_init('https://pay.nobabpay.top/api/payment/verify');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode(['transaction_id' => $transaction_id]),
    CURLOPT_HTTPHEADER     => ['API-KEY: YOUR_API_KEY', 'Content-Type: application/json'],
]);
$verified = json_decode(curl_exec($ch), true);
curl_close($ch);

if (!empty($verified['status']) && $verified['status'] === 'COMPLETED') {
    $meta = json_decode($verified['metadata'] ?? '{}', true);
    // Mark order $meta['order_id'] as paid with $verified['transaction_id']
}

http_response_code(200);
echo 'OK';

💾 Python (requests)

Python

import requests, json

API = "https://pay.nobabpay.top/api"
HEADERS = {"API-KEY": "YOUR_API_KEY", "Content-Type": "application/json"}

# Create payment
r = requests.post(f"{API}/payment/create", json={
    "amount": 500,
    "success_url": "https://your-site.com/payment/success",
    "cancel_url": "https://your-site.com/payment/cancel",
    "webhook_url": "https://your-site.com/payment/webhook",
    "metadata": {"order_id": 1024},
}, headers=HEADERS)
payment = r.json()
# redirect customer: payment["payment_url"]

# Verify payment
r = requests.post(f{API}/payment/verify", json={
    "transaction_id": "SXF80K119297"
}, headers=HEADERS)
print(r.json())

💾 JavaScript (Node.js / fetch)

JavaScript

const API = 'https://pay.nobabpay.top/api';
const HEADERS = { 'API-KEY': 'YOUR_API_KEY', 'Content-Type': 'application/json' };

// Create payment
const res = await fetch(`${API}/payment/create`, {
  method: 'POST',
  headers: HEADERS,
  body: JSON.stringify({
    amount: 500,
    success_url: 'https://your-site.com/payment/success',
    cancel_url: 'https://your-site.com/payment/cancel',
    webhook_url: 'https://your-site.com/payment/webhook',
    metadata: { order_id: 1024 },
  }),
});
const { payment_url } = await res.json();
// redirect customer to payment_url

// Verify payment
const v = await fetch(`${API}/payment/verify`, {
  method: 'POST',
  headers: HEADERS,
  body: JSON.stringify({ transaction_id: 'SXF80K119297' }),
});
console.log(await v.json());

💡

Server-side only. Never call these endpoints from browser JavaScript with your API key — use a small backend endpoint instead, or use the ready-made plugins.

7. Error Handling

Every error is returned as JSON with a status of 0 and a human-readable message.

⚠️ Error format & common errors

Error response

{ "status": 0, "message": "Invalid API Request" }

Message	Cause	Fix
`Invalid API Request`	API key missing, wrong, or the request could not be authenticated.	Check your key in Settings → Brands and the `API-KEY` header.
`Invalid Parameters`	`amount`, `success_url` or `cancel_url` is missing/invalid.	Send all required fields.
`Metadata must be in JSON format`	`metadata` was sent as a string instead of an object.	Send it as a real JSON object.
`Maximum amount 1000000`	The amount exceeds the limit.	Split the payment or lower the amount.
HTTP `400` / `404`	Bad endpoint or invalid request path.	Use the exact URLs from this documentation.

⚠️

Best practice: log the full response on every failure. On the webhook, always respond with HTTP 200 quickly — otherwise NobabPay retries the notification.

8. Ready-Made Integrations

No coding needed — install these and accept payments in minutes.

WooCommerce (WordPress)

Full payment gateway plugin with auto-verification via webhook. Download nobabpay-wordpress.zip from the links below.

WHMCS

Invoice payment module for hosting businesses. Download nobabpay-whmcs.zip and upload modules/gateways/ to your WHMCS root.

Mobile App (SMS Auto-Verify)

The Nobab Pay Android app forwards your bKash/Nagad/Rocket payment SMS for instant auto-verification.

⬇️ Downloads

nobabpay-wordpress.zip — WooCommerce plugin
nobabpay-whmcs.zip — WHMCS module
NobabPay.apk — Mobile App

WooCommerce setup: Plugins → Add New → Upload the zip → Activate → WooCommerce → Settings → Payments → NobabPay → Enable and paste your API key.

WHMCS setup: Upload the modules/ folder to your WHMCS root → Setup → Payments → Payment Gateways → NobabPay → Activate and paste your API key.

9. Frequently Asked Questions

Quick answers to the questions developers ask most.

Which payment methods are supported?

bKash, Nagad, Rocket, Upay, mCash, MyCash, SureCash, Tap, Cellfin, EasyPaisa, OkWallet, bank transfer and Binance Pay (USDT). All payments are auto-verified.

How do I know a payment really succeeded?

Call POST /api/payment/verify with the transaction ID. Only a status of COMPLETED means the money arrived. The webhook and the customer redirect alone are not enough.

What is metadata used for?

It is your own data (order ID, user ID, cart reference...) passed to the create call and returned unchanged by the verify call. It is the easiest way to link a payment to your order.

Can I accept payments in USD or USDT?

Yes. Binance Pay accepts USDT. The currency conversion rate is configured in your merchant panel (Settings → Wallets → per-method Dollar Rate).

What happens if my webhook fails or times out?

NobabPay retries the webhook. Always respond with HTTP 200 as soon as possible and do the order fulfilment afterwards.

Is my API key safe?

Yes, as long as you keep it server-side. Never embed it in web pages or mobile apps. Rotate it in Settings → Brands if it is ever exposed.

Do you provide support?

Yes — contact us at admin@nobabpay.top or through the nobabpay.top merchant dashboard.