Payments

Customers can always pay cash on delivery where the market allows it (Markets → your market). To take online payments, enable one or more gateways.

Gateway	Good for	Credentials it asks for
Stripe	Cards worldwide, Apple Pay, Google Pay	Publishable key, Secret key, Webhook signing secret
PayPal	PayPal balance and cards	Client ID, Client secret, Webhook ID
Razorpay	India	Key ID, Key secret, Webhook secret
MyFatoorah	Kuwait, Saudi Arabia, UAE and the Gulf	API token, Country ISO (KWT, SAU, ARE …)
Flutterwave	Africa	Public key, Secret key, Encryption key, Webhook secret hash
bKash	Bangladesh	App key, App secret, Username, Password
Mercado Pago	Latin America: cards, Pix, OXXO, boleto, Mercado Pago wallet	Public key, Access token, Webhook secret
PayTabs	Gulf, Egypt, Jordan: cards, mada, KNET, Apple Pay	Profile ID, Server key, Region
Tabby	Pay in 4 in the UAE, Saudi Arabia and Kuwait (orders only)	Secret key, Merchant code, Region, Webhook secret
Paymob	Egypt, Saudi Arabia, UAE, Oman, Pakistan: cards, wallets, kiosk	Public key, Secret key, API key, HMAC secret, Integration IDs, Region
Midtrans	Indonesia: cards, GoPay, QRIS, ShopeePay, virtual accounts	Client key, Server key

Turn on a gateway

1. Create an account with the gateway and find its API keys (usually under Developers or API). Start with its test / sandbox keys.
2. Admin → Settings → Payment gateways → open the gateway.
3. Set Mode to Test, paste the API credentials, and optionally change the Display name and Logo customers see at checkout.
4. Copy the Webhook URL shown on the card. In the gateway’s dashboard, add a webhook pointing to it (it looks like https://yourdomain.com/api/payments/webhook/stripe) and paste the secret it gives you back into the card.
5. Switch it to Enabled and Save payment settings. The card shows Credentials complete.
6. Place a test order in the customer app with the gateway’s test card.
7. When it works, replace the keys with live ones and set Mode to Live.

Webhooks matter

The webhook is how the gateway tells RapidMart a payment succeeded, even if the customer closes the app mid-payment. Without it, some paid orders can stay “awaiting payment”.

Apple Pay and Google Pay

They’re offered through Stripe when it’s enabled and the customer’s phone supports them. Apple Pay also needs your merchant ID in the customer app’s lib/app_config.dart — see Build for iOS.

Gateway notes

Each gateway is only offered for orders in a currency it can charge, so customers never see one that can’t take their payment.

Mercado Pago

• Credentials: Your integrations → your app → Production credentials (or Test credentials). A TEST-… access token pays on Mercado Pago’s sandbox; set Mode to match.
• Webhook: Your integrations → Webhooks → Configure notifications. Paste the card’s webhook URL, tick Payments, save, then copy the secret signature into Webhook secret.
• Currencies: ARS, BRL, CLP, COP, MXN, PEN, UYU.

PayTabs

• Credentials: merchant dashboard → Developers → Key management: the Profile ID and a server key (not the client key).
• Region is where your PayTabs account lives: ARE, SAU, EGY, OMN, JOR, KWT, IRQ, MAR, QAT or GLOBAL. The wrong region fails with an authentication error.
• Webhook: nothing to set up. RapidMart sends PayTabs its webhook URL with every payment.
• Test and live are separate PayTabs profiles: use your test profile’s keys while testing.

Tabby

• Credentials: from your Tabby integration manager. Use sk_test_… while testing.

• Region: ARE for the UAE and Kuwait, SAU for Saudi Arabia.

• Tabby is a pay-later plan, so it’s offered for orders only: never for a wallet top-up, a parcel or a consultation. If Tabby declines a customer, or the order is outside Tabby’s limits, the customer is asked to pay another way.

• RapidMart captures each approved Tabby payment automatically.

• Webhook: Tabby registers webhooks through its API. Make up a long random Webhook secret, save it, then run this once from any terminal, with your secret key, merchant code and the card’s webhook URL:

  curl -X POST https://api.tabby.ai/api/v1/webhooks -H "Authorization: Bearer YOUR_SECRET_KEY" -H "X-Merchant-Code: YOUR_MERCHANT_CODE" -H "Content-Type: application/json" -d '{"url":"YOUR_WEBHOOK_URL","header":{"title":"X-Auth-Key","value":"YOUR_WEBHOOK_SECRET"}}'

  Saudi accounts use https://api.tabby.sa/api/v1/webhooks.

Paymob

• Credentials: Paymob dashboard → Developers → API keys: the Public key, Secret key, legacy API key and HMAC secret.
• Integration IDs: Developers → Payment integrations. List every method you want offered (card, wallet, kiosk…), separated by commas, e.g. 4811201, 4811202. Test keys need test integration IDs.
• Region is your Paymob account’s country: EGY, SAU, ARE, OMN or PAK.
• Webhook: nothing to set up. RapidMart sends Paymob its webhook URL with every payment; the HMAC secret is how it checks Paymob’s callbacks.

Midtrans

• Credentials: Midtrans dashboard → Settings → Access keys: Client key and Server key. Sandbox keys start with SB- and need Mode set to Test.
• Webhook: Settings → Payment → Notification URL: paste the card’s webhook URL. Midtrans signs each notification with your server key, so there’s no separate secret.
• Currency: IDR. Card, GoPay, QRIS and ShopeePay payments can be refunded to the customer; bank transfers and convenience-store payments are refunded to the customer’s wallet instead.