Troubleshooting

What goes wrong with Paymob Payment Provider for Egypt, how to recognise it, and what to do.

Test Connection fails

It creates a real one-piastre intention, so it fails on real problems rather than on formatting.

"A live key cannot be saved on a test provider"

Working as intended, and worth understanding rather than working around.

Paymob uses one hostname for both environments — only the key says which you are talking to. Without this guard the mistake is silent: real cards charged during a rehearsal, or a real customer's payment sent to the sandbox.

Use test keys with the provider in Test state, and live keys when it is Enabled.

Payments succeed at Paymob and never appear in Odoo

The callback is not arriving. In order:

• Is the callback URL set in Paymob? https://your-odoo-domain/payment/paymob/webhook
• Is Odoo reachable from the internet over HTTPS? Paymob will not post to plain HTTP, and a private address is not reachable at all.
• Is a proxy rewriting the body? The HMAC is computed over what Paymob sent. Anything that re-serialises JSON or changes the charset breaks every genuine callback.

Do not disable signature verification to get past this. The webhook is a public route; without the signature, "this order is paid" becomes something any stranger on the internet can assert.

Callbacks arrive and are rejected

Wrong HMAC Secret is the usual cause. It is Settings → Account Info → HMAC in Paymob — not the secret key and not the public key.

If the secret is right, look for a proxy modifying the request body.

The transaction is stuck at pending

Either the callback has not arrived (above), or it is an authorisation awaiting capture. Manual capture cannot be initiated from Odoo — an authorisation is recognised on an inbound callback but not started here.

The provider does not appear at checkout

• The currency is not EGP. It hides itself deliberately rather than failing at checkout.
• The provider is not enabled, or is restricted to a company or website the customer is not on.

A refund is pending and stays pending

It waits for Paymob to confirm by callback. If that never arrives, the callback path is the problem — the same three checks as above.

It is not marked done at submission on purpose: reporting money as returned before it was would mislead whoever reconciles.

A customer says they were charged twice

Check the transactions against Paymob's own dashboard using the identifiers on each row. Duplicate callbacks are ignored rather than reapplied, so a double charge is a Paymob-side event rather than something this module can create by replaying a retry.

Nothing about the payment is in the server log

By design. No card number, token or billing payload is ever written to a log at any level. Use the transaction records, which carry Paymob's identifiers and are access-controlled.