FAQ
The questions asked most often about Paymob Payment Provider for Egypt, answered.
Has a real payment ever gone through this?
No. There are no Paymob merchant credentials on our development account, so nothing has reached Paymob's sandbox or production — not one intention, not one callback.
What is verified, over real HTTP against Paymob's documented payload shapes: HMAC-SHA512 verification over the documented twenty-field order, including tampering, wrong secrets and field-order sensitivity; state derivation from Paymob's boolean combinations; duplicate and late callbacks; refunds; timeouts; connection errors; and the live-key guard.
We would rather say so here than have you find out after paying. Run a sandbox payment before you take a real one.
Which Paymob API does it use?
The current Intention API with Unified Checkout, not the older three-step API-key flow.
A customer paid but Odoo shows nothing
The callback is not arriving. Check:
- Transaction Processed Callback is set in Paymob to https://your-odoo-domain/payment/paymob/webhook.
- Odoo is reachable from the internet over HTTPS.
- Nothing between Paymob and Odoo is rewriting the request body — the HMAC is computed over what Paymob sent.
The customer's browser returning to your site confirms nothing, by design.
Why does the browser return not confirm the payment?
Because a customer can close the tab, lose signal, or edit the return URL by hand, and none of that changes what Paymob charged. The signed server-to-server callback is the only thing that moves a transaction to done.
Can a forged callback mark an order paid?
No. The webhook is a public route, so every callback is verified with HMAC-SHA512 against your HMAC secret and compared in constant time. A mismatch is logged and discarded, and never touches a transaction.
Paymob retried a callback. Was the order confirmed twice?
No. A repeat callback for a transaction already in its final state is ignored rather than reapplied. A refund callback is the deliberate exception, because a second refund is a real event rather than a duplicate.
Does it support mobile wallets or Apple Pay?
Not yet. Each needs its own integration ID and its own testing, and we do not claim a payment method we have not tested.
Can customers save a card?
No. Paymob supports card tokens, but storing one is a commitment to its lifecycle and to consent handling. Neither is built here, so it is not advertised.
Can I take payments in USD?
No. EGP only — that is what Paymob Egypt settles in. The provider hides itself for other currencies rather than appearing at checkout and failing there.
Why is my refund stuck at pending?
It is waiting for Paymob to confirm it by callback. Marking it done sooner would report money as returned to the customer before it actually was, and somebody would reconcile against that figure.
I saved a live key and it was refused
On a test provider, that is the guard working. Paymob uses one hostname for both environments and only the key distinguishes them, so without the check you would find out when a real card was charged during a rehearsal.
Which Odoo versions?
18.0 only. A 19.0 port is not claimed until it has been tested there.
Are you affiliated with Paymob?
No. Paymob is a trademark of its respective owner.