Payment gateways and recording payments
Oct 15, 2026
What you can use
WHBMP has 13 online gateways. Each one sends the client to the gateway's payment page (Braintree shows a card form on your own site), marks the invoice paid only when the gateway confirms the payment, once, for the amount the invoice owed, and refunds through the gateway when you choose Original gateway on a refund.
| Gateway | You enter | Webhook address | Test (sandbox) | Good to know |
|---|---|---|---|---|
| Stripe | Secret key, Webhook signing secret | Add it in Stripe | Test keys (sk_test_) |
Cards; any currency |
| PayPal (built in) | Client ID, Client secret, Webhook ID | Add it in your PayPal app | Tick the sandbox box | Orders v2; the Webhook ID is needed to confirm payments the client does not return from |
| Razorpay | Key ID, Key secret, Webhook secret | Add it in Razorpay Webhooks (events payment_link.paid, refund.processed, payment.dispute.created) |
Test keys (rzp_test_) |
Payment Links |
| Mollie | API key | Nothing to add: Mollie is told it with every payment | Test key (test_) |
Cards, iDEAL, Bancontact and more |
| Paystack | Secret key | Paste it in Settings > API Keys & Webhooks | Test key (sk_test_) |
The secret key also signs the webhook |
| Flutterwave | Secret key, Secret hash | Add it in Settings > Webhooks and set the same Secret hash | Test key | A payment is only booked after Flutterwave itself confirms it |
| Square | Access token, Location ID, Webhook signature key | Add it as a webhook subscription (events payment.updated, refund.updated, dispute.created) |
Tick the sandbox box | Payment links |
| Adyen | API key, Merchant account, Live URL prefix (live only), Webhook HMAC key | Required: add a Standard webhook (JSON) | Tick the test box | Pay by Link; payments are booked from the webhook |
| Braintree | Public key, Private key, Merchant account ID (optional) | Not needed | Tick the sandbox box | Card form on your own site; charged and booked at once |
| Authorize.Net | API Login ID, Transaction key, Signature key | Required: add it in Account > Webhooks | Tick the sandbox box | Accept Hosted; bills in the merchant account's currency |
| Alipay | App ID, Application private key, Alipay public key | Nothing to add: sent with every payment | Tick the sandbox box | Chinese yuan (CNY) invoices only |
| PayU | Merchant key, Merchant salt | Nothing to add: sent with every payment | Tick the test box | Indian rupee (INR) invoices only |
| Mercado Pago | Access token, Webhook secret (optional) | Sent with every payment; add it under Webhooks only to use the secret | TEST- token |
Latin American currencies |
The address to give a gateway, when one is needed, is shown on its card with a Copy button. It must be reachable from the internet, so it does not work on localhost without a tunnel (the return from the gateway's page still settles the payment on a local test site, except for Adyen and Authorize.Net, which wait for the webhook).
Set up a gateway
- Open Settings > Payment Gateways and expand the gateway.
- Enter its keys (you get them in the gateway's own dashboard) and tick its sandbox or test box when you use test keys. Keys are stored encrypted. Leave a secret box empty to keep the one already saved.
- Switch it on and Save. A key typed into the wrong box is refused at once where the gateway can tell.
- Click Test Connection. It checks the saved details with the gateway and shows its own error if they are refused.
- Pay a small test invoice with the gateway's test card before you go live.
If the application key in .env changes, stored credentials can no longer be decrypted and you must enter them again.
What happens when a client pays
- The amount is always worked out on your server from what the invoice still owes, in the invoice's currency. The client cannot change it.
- If the client closes the gateway's page, nothing is charged and the invoice stays unpaid.
- The payment is recorded once, with the gateway's reference. If the gateway reports it twice, nothing is booked twice.
- A payment that does not match what was asked for (another amount or currency) is not booked. It is written to System Logs > Payment Gateway Logs so you can check it in the gateway's dashboard.
- Refunds, and disputes where the gateway sends them, made in the gateway's dashboard are recorded too when the gateway has a webhook (Braintree has none; Alipay and PayU report only payments).
Saved cards and PayPal accounts can also be charged automatically on the due date. See Automatic payments.
Set up Bank Transfer
- Open Settings > Payment Gateways.
- Under Bank Transfer enter your Payment Instructions: bank name, account number, IBAN or SWIFT, and a reference to quote. The text is shown to the client the moment they choose Bank Transfer.
- Save and make it the default if you want.
The page has an Active tab and an Other Gateways tab. Set Default chooses which method clients get unless they choose another. General Settings can let clients choose a gateway for each invoice.
Record a payment
For Bank Transfer, cash, or anything paid outside WHBMP:
- Open the invoice.
- Click Add Payment and enter the amount, the date, the method and a transaction reference.
- Save.
WHBMP then:
- creates a payment transaction,
- moves the invoice to Partially paid or Paid,
- gives the invoice its paid number if you use sequential paid numbering,
- fires the
invoice.paidwebhook, - creates the service if the product is set to "as soon as the first payment is received",
- sends the payment confirmation email.
You can also use Billings > Transactions to add a transaction and Payments to see all payments.
Install a gateway plugin
Most gateways are plugins. Open Plugins > Add New, install the gateway and it appears on the Payment Gateways page. Stripe and PayPal come with WHBMP.