QRPayBD Payments

QRPayBD confirms payments to your personal bKash, Nagad or Upay wallet number by reading the “payment received” SMS on an Android phone that you own. This plugin connects your WordPress site to your own QRPayBD account:

• Your site creates an order at QRPayBD and sends the customer to the QRPayBD-hosted payment page. It shows your wallet number, the exact amount and an order reference.

• The customer sends the exact amount to your number with Send Money in their wallet app. If the app has a Reference field they type the order reference there, and the order can confirm by itself. Otherwise they enter the TrxID from their payment SMS on the payment page.

• QRPayBD checks the reference or TrxID and the amount against the SMS on your phone and marks the order paid.

• QRPayBD sends your site a signed webhook and your order is completed. QRPayBD never holds your money.

What it supports. The message readers for bKash, Nagad and Upay have been verified on real payments. Rocket and banks are planned.

Official merchant APIs of the wallet providers are not supported yet. This is not an official wallet or bank API: messages can be delayed, missed, reworded or forged, so check your wallet balance for large orders.

Personal wallet numbers. Wallet providers may restrict business use of personal accounts in their own terms. You are responsible for reading and following the current terms of your provider.

Before you start. com (free during early access) and the QRPayBD Collector app on the Android phone that receives your payment SMS. com/docs.

Not affiliated. bKash, Nagad, Upay and Rocket are trademarks of their respective owners. This plugin is not affiliated with, endorsed by or sponsored by any of them; they are named only to describe payment services your customers may already use.

WooCommerce (optional)

• Classic payment gateway that also works in the Cart and Checkout Blocks and with the classic checkout shortcode.

• Compatible with High-Performance Order Storage (custom order tables).

• BDT only. The method is hidden at checkout for any other currency.

• The order is placed on hold and completed automatically. An amount mismatch is never auto-completed: the order stays on hold with a clear order note.

• Order screen box with status, reference, TrxID, match method, payment link and a Re-check now button.

• Cancelling the WooCommerce order cancels the pending payment at QRPayBD (best effort).

Elementor (optional, the free version is enough)

• Widget QRPayBD Pay Button in its own “QRPayBD” category. It works without WooCommerce: fixed amount, item text, optional return URL and full style controls.

• The amount is read from the saved page on the server. The browser only sends the page id and widget id, so the price cannot be tampered with.

• Each click creates a private record under QRPayBD Payments (amount, status, reference, TrxID, times).

• The action qrpaybd_payment_completed lets you run your own automation when a payment completes.

Reliability

• Webhooks are verified with HMAC-SHA256 over the raw request body (constant-time comparison).

• QRPayBD has no webhook retry queue, so the plugin also checks unpaid orders every five minutes (Action Scheduler when available, otherwise WP-Cron) for up to 48 hours, and once when the customer returns to your site.

No tracking. The plugin has no analytics, telemetry, update checks or advertising, and it never contacts any server other than the QRPayBD address you configure.

External services

com ). QRPayBD is the payment-confirmation service described above. Whoever operates that server (you, or the provider you use) is the service provider, and its terms and privacy policy apply.

What is sent, and when:

• Creating a payment (a customer chooses the QRPayBD payment method at checkout, or a visitor clicks a QRPayBD Pay Button): the order total in taka, a store order id ( wc-<site hash>-<order number> or el-<page id>-<widget id>-<random> ), and a return URL (the WooCommerce order-received page, or the page holding the button). Your store API key is sent in the Authorization header. The plugin sends no customer name, email address, phone number or address. The customer’s browser is then redirected to the QRPayBD-hosted payment page, where the customer sees your wallet number, the exact amount and the order reference, and enters the TrxID from their payment SMS if needed; that page is operated by the QRPayBD server.

• Checking a payment: the QRPayBD order id and your API key, every five minutes for unpaid orders younger than 48 hours, once when the customer returns to the order-received page, and when an administrator presses “Re-check now”.

• Cancelling a payment: the QRPayBD order id and your API key, when a WooCommerce order is cancelled while its payment is unpaid.

• Test connection (administrators only, on request): a request to /health with no data, and one lookup of a dummy order id with your API key.

Data received: QRPayBD sends signed webhooks to /wp-json/qrpaybd/v1/webhook on your site containing the order ids, amounts, TrxID, match method and payment time. These are stored as order meta (WooCommerce) or in the private “QRPayBD Payments” records (Elementor).

com/terms/

com/privacy/