Paymora Payment Gateway – Complete Integration Guide

This documentation explains everything required to integrate Paymora Payment Gateway into any website, software, or mobile app, using any programming language.

1. Prerequisites

• Public HTTPS backend server
• Database (orders, payments, balance)
• Webhook endpoint reachable from internet
• Secure storage for secrets

2. Credentials Provided by Paymora

• client_id
• webhook_secret
• webhook_url (your backend)
• Authorized domain

3. Hosted Payment Page

Redirect user to the following URL to start payment:

https://pay.winx99.space/gateway/pay.php

Required Parameters

• client_id
• order_id (unique, backend-generated)
• amount (final payable amount)
• success_url (UI only)
• fail_url (UI only)

4. Payment Lifecycle (CRITICAL)

1. Create order in database
2. Calculate final payable amount
3. Save payable_amount
4. Generate unique order_id
5. Redirect user to Paymora
6. User completes payment
7. Paymora sends webhook
8. Verify webhook signature
9. Read paid amount from webhook
10. Save txn_id
11. Mark order as paid
12. Credit user balance

5. Webhook Payload

{
  "txn_id": "TXN2609YsH01Hs54Y6d587F8D73a1JYuvC",
  "order_id": "ORDER_123456",
  "amount": 1500,
  "status": "approved"
}

6. Webhook Security (MANDATORY)

• Read RAW request body
• Verify HMAC SHA256 signature
• Header: X-Genext-Signature
• Reject invalid signatures
• Implement idempotency

7. Client Webhook Processing Logic

1. Receive webhook
2. Read RAW payload
3. Verify signature
4. Reject if invalid
5. Parse JSON
6. Process only approved status
7. Find order using order_id
8. Check already paid
9. Match webhook amount with DB
10. Save txn_id and paid_amount
11. Credit balance
12. Lock record
13. Return HTTP 200 OK

8. Discount Handling

• Apply discount BEFORE payment
• Send discounted amount to Paymora
• Webhook amount already reflects discount

9. What NOT To Do

10. Supported Platforms

PHP, Node.js, Python, Java, .NET, Go, WordPress, Shopify (custom), React, Angular, Vue, Android, iOS, +all Languags.

11. AI PROMPT (DETAILED & FINAL)

You are a senior payment gateway integration engineer and security expert.

I want to integrate Paymora Payment Gateway into my system.

Payment URL:
https://pay.winx99.space/gateway/pay.php

Webhook:
POST https://mydomain.com/webhook/paymora

Webhook Payload:
{
  "txn_id": "string",
  "order_id": "string",
  "amount": number,
  "status": "approved | declined | expired"
}

Security Rules:
- Verify HMAC SHA256 signature using webhook_secret
- Header: X-Genext-Signature
- Use RAW payload
- Process ONLY approved payments
- Implement idempotency
- Never trust redirect URLs
- Never trust frontend amount

Flow Requirements:
1. Create order
2. Calculate final amount
3. Save payable_amount
4. Redirect user to Paymora
5. Receive webhook
6. Verify signature
7. Match amount
8. Save txn_id
9. Save paid_amount
10. Credit balance
11. Lock record

Explain end-to-end integration.
Provide code examples.
Highlight common mistakes.
Do not simplify security.