The WorkxPay Payment Gateway enables merchants to securely receive payments from their customers. Our PCI-compliant flow ensures that you can accept payments with minimal effort while maintaining the highest level of security.
You can use our RESTful APIs to integrate into any environment (PHP, Node, Python, etc.) or use our pre-built plugins for popular platforms like WordPress.
Base URL: https://payment.workxpay.com/api/
| Field | Description | Constraint |
|---|---|---|
| API-KEY | Your unique brand API key from dashboard | Required |
| amount | Payment amount in decimal (e.g. 10.00) | Required |
| success_url | The URL we redirect to after success | Required |
| cancel_url | The URL we redirect to after cancellation or timeout | Required |
| webhook_url | Server URL that receives the signed payment result | Optional |
You can send custom metadata to track customer information. This will be returned in the response.
| Field | Description |
|---|---|
| Customer's email address | |
| phone | Customer's mobile number |
| order_id | Your internal order reference ID |
Initiate a new payment request and receive a secure payment link.
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => 'https://payment.workxpay.com/api/payment/create',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_POSTFIELDS => json_encode([
'success_url' => 'https://site.com/success',
'cancel_url' => 'https://site.com/cancel',
'amount' => '100',
'webhook_url' => 'https://site.com/webhook'
]),
CURLOPT_HTTPHEADER => [
'API-KEY: YOUR_KEY',
'Content-Type: application/json'
],
]);
$res = curl_exec($curl);
curl_close($curl);
echo $res;
?><?php
$client = new \GuzzleHttp\Client();
$res = $client->post('https://payment.workxpay.com/api/payment/create', [
'headers' => [
'API-KEY' => 'YOUR_KEY',
'Content-Type' => 'application/json',
],
'json' => [
'success_url' => 'https://site.com/success',
'cancel_url' => 'https://site.com/cancel',
'amount' => '100',
]
]);
echo $res->getBody();
?>const axios = require('axios');
const data = {
success_url: 'https://site.com/success',
cancel_url: 'https://site.com/cancel',
amount: 100
};
axios.post('https://payment.workxpay.com/api/payment/create', data, {
headers: {
'API-KEY': 'YOUR_KEY',
'Content-Type': 'application/json'
}
}).then(res => console.log(res.data));import requests
import json
url = "https://payment.workxpay.com/api/payment/create"
payload = json.dumps({
"success_url": "https://site.com/success",
"cancel_url": "https://site.com/cancel",
"amount": 100
})
headers = {
"API-KEY": "YOUR_KEY",
"Content-Type": "application/json"
}
res = requests.post(url, headers=headers, data=payload)
print(res.text)package main
import (
"fmt"
"strings"
"net/http"
"io/ioutil"
)
func main() {
url := "https://payment.workxpay.com/api/payment/create"
payload := strings.NewReader(`{
"success_url": "https://site.com/success",
"cancel_url": "https://site.com/cancel",
"amount": "100"
}`)
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("API-KEY", "YOUR_KEY")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := ioutil.ReadAll(res.Body)
fmt.Println(string(body))
}Verify the status with the transaction ID before you credit the customer. COMPLETED means the mobile payment was confirmed. PENDING means a bank transfer is waiting for your review. ERROR means the payment was not completed.
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => 'https://payment.workxpay.com/api/payment/verify',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_POSTFIELDS => '{"transaction_id":"T123"}',
CURLOPT_HTTPHEADER => [
'API-KEY: YOUR_KEY',
'Content-Type: application/json'
],
]);
$res = curl_exec($curl);
curl_close($curl);
echo $res;
?><?php
$client = new \GuzzleHttp\Client();
$res = $client->post('https://payment.workxpay.com/api/payment/verify', [
'headers' => [
'API-KEY' => 'YOUR_KEY',
'Content-Type' => 'application/json',
],
'json' => [
'transaction_id' => 'T123'
]
]);
echo $res->getBody();
?>const axios = require('axios');
axios.post('https://payment.workxpay.com/api/payment/verify', {
transaction_id: 'T123'
}, {
headers: {
'API-KEY': 'YOUR_KEY',
'Content-Type': 'application/json'
}
}).then(res => console.log(res.data));import requests
import json
url = "https://payment.workxpay.com/api/payment/verify"
payload = json.dumps({"transaction_id": "T123"})
headers = {
"API-KEY": "YOUR_KEY",
"Content-Type": "application/json"
}
res = requests.post(url, headers=headers, data=payload)
print(res.text)package main
import (
"fmt"
"strings"
"net/http"
"io/ioutil"
)
func main() {
url := "https://payment.workxpay.com/api/payment/verify"
payload := strings.NewReader(`{"transaction_id":"T123"}`)
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("API-KEY", "YOUR_KEY")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := ioutil.ReadAll(res.Body)
fmt.Println(string(body))
}Webhooks allow your application to receive real-time notifications when a payment status changes. Configure your Webhook URL in your merchant dashboard. Our system will automatically send a signed POST request to your URL when a transaction is completed or failed.
Every callback includes X-WorkxPay-Timestamp and X-WorkxPay-Signature. The signature is HMAC-SHA256 of timestamp.body, using your brand API key. Reject the callback if the signature does not match or the timestamp is older than 5 minutes, then confirm the transaction with the verify API before crediting the customer.
| Field | Type | Description |
|---|---|---|
| paymentMethod | String | The method used for payment (e.g. bkash, nagad) |
| transactionId | String | The unique transaction ID (TrxID) |
| paymentAmount | Decimal | The total amount paid by the customer |
| paymentFee | Decimal | The gateway processing fee deducted |
| status | String | The payment status (e.g. completed, failed, pending) |
{ "paymentMethod": "bkash", "transactionId": "7FE3A8BC", "paymentAmount": "500.00", "paymentFee": "0.00", "status": "completed"}PHP check: read the raw body, then hash_equals(hash_hmac('sha256', $timestamp . '.' . $rawBody, $apiKey), $signature).
To ensure a secure and smooth payment experience for your users, please follow these guidelines when integrating WorkxPay:
Never expose your API-KEY in frontend code (like Javascript running in the browser) or public repositories. Always initiate payment requests from your secure backend server.
Do not rely solely on the success URL redirect to fulfill an order, as users might close the browser early. Always use the Verify Payment API or configure Webhooks to securely confirm the transaction status before delivering services or goods.
Pass a unique order_id in your metadata to easily match our transaction records with your database records if manual reconciliation is ever needed.