Paymob Integration
Attribution: This skill is built on top of the official Paymob LLM knowledge base published at paymob.com/llms.txt. All API knowledge, integration patterns, and flow documentation originate from Paymob's own documentation. Credit and thanks to the Paymob team for making their docs AI-agent-friendly.
Paymob is the dominant payment processor in the MENA region, operating in Egypt, Saudi Arabia, UAE, Kuwait, Oman, Bahrain, Jordan, and Pakistan.
When this skill activates
- User mentions "Paymob" or references Paymob credentials (
PAYMOB_SECRET_KEY, PAYMOB_PUBLIC_KEY, PAYMOB_INTEGRATION_ID)
- User is building payment flows targeting Egypt, Saudi Arabia, UAE, Kuwait, Oman, Bahrain, Jordan, or Pakistan
- User asks about payment intentions, hosted checkout, embedded checkout, HMAC callbacks, or QuickLinks
- User's codebase contains Paymob API calls or SDK initialization
Non-negotiable rules
These rules apply to every Paymob integration regardless of what the user asks:
- HMAC validation is mandatory — never process a payment callback without first verifying the HMAC signature. A callback without valid HMAC must be rejected.
- Backend webhook = source of truth — the server-to-server webhook callback (after HMAC verification) is the only authoritative signal for payment status. Frontend redirects and SDK callbacks are UX signals only — never use them to confirm order fulfillment.
- Amount is always integer cents —
10000 = 100.00 EGP. Never use floats or strings.
- Integration IDs are environment-specific — test integration IDs only work with test credentials; live IDs only work with live credentials. Mixing them causes silent 404s.
- Secret key is server-side only — never include it in client-side code, browser bundles, or mobile app source. Exposure allows unauthorized charges on the merchant account.
Before writing any integration code
Read the relevant reference file for the task at hand:
| Task |
Reference |
| Setting up credentials and environments |
references/authentication.md |
| Creating a payment / building the intention request |
references/create-intention.md |
| Choosing and implementing a checkout flow |
references/payment-flows.md |
| Receiving and validating payment results |
references/webhooks-hmac.md |
| Debugging a failing integration |
references/error-handling.md |
Quick flow selection guide
| Scenario |
Flow |
| Web app, simplest path, max PCI compliance |
Hosted Checkout (redirect) |
| Web app with custom embedded UI |
Pixel (iframe) |
| iOS or Android native app |
Mobile SDK |
| Automated invoicing or WhatsApp commerce |
QuickLink API |
| Manual one-off payment links |
Payment Links (dashboard) |
1---2name: paymob3description: Use when integrating Paymob payment processing — creating payment intentions, handling webhooks with HMAC validation, configuring checkout flows (hosted, embedded pixel, mobile SDK), or generating payment links. Covers MENA-region payment methods: cards (Visa/MC/Amex/MADA/OmanNet), digital wallets (Vodafone Cash, Orange Cash, e& money, stcPay, We Pay, Apple Pay, Google Pay), BNPL (Tabby, Tamara, vaLU, Sympl, Halan), and kiosk/cash.4---56# Paymob Integration78> **Attribution:** This skill is built on top of the official Paymob LLM knowledge base published at [paymob.com/llms.txt](https://paymob.com/llms.txt). All API knowledge, integration patterns, and flow documentation originate from Paymob's own documentation. Credit and thanks to the Paymob team for making their docs AI-agent-friendly.910Paymob is the dominant payment processor in the MENA region, operating in Egypt, Saudi Arabia, UAE, Kuwait, Oman, Bahrain, Jordan, and Pakistan.1112## When this skill activates1314- User mentions "Paymob" or references Paymob credentials (`PAYMOB_SECRET_KEY`, `PAYMOB_PUBLIC_KEY`, `PAYMOB_INTEGRATION_ID`)15- User is building payment flows targeting Egypt, Saudi Arabia, UAE, Kuwait, Oman, Bahrain, Jordan, or Pakistan16- User asks about payment intentions, hosted checkout, embedded checkout, HMAC callbacks, or QuickLinks17- User's codebase contains Paymob API calls or SDK initialization1819## Non-negotiable rules2021These rules apply to every Paymob integration regardless of what the user asks:22231. **HMAC validation is mandatory** — never process a payment callback without first verifying the HMAC signature. A callback without valid HMAC must be rejected.242. **Backend webhook = source of truth** — the server-to-server webhook callback (after HMAC verification) is the only authoritative signal for payment status. Frontend redirects and SDK callbacks are UX signals only — never use them to confirm order fulfillment.253. **Amount is always integer cents** — `10000` = 100.00 EGP. Never use floats or strings.264. **Integration IDs are environment-specific** — test integration IDs only work with test credentials; live IDs only work with live credentials. Mixing them causes silent 404s.275. **Secret key is server-side only** — never include it in client-side code, browser bundles, or mobile app source. Exposure allows unauthorized charges on the merchant account.2829## Before writing any integration code3031Read the relevant reference file for the task at hand:3233| Task | Reference |34|------|-----------|35| Setting up credentials and environments | `references/authentication.md` |36| Creating a payment / building the intention request | `references/create-intention.md` |37| Choosing and implementing a checkout flow | `references/payment-flows.md` |38| Receiving and validating payment results | `references/webhooks-hmac.md` |39| Debugging a failing integration | `references/error-handling.md` |4041## Quick flow selection guide4243| Scenario | Flow |44|----------|------|45| Web app, simplest path, max PCI compliance | Hosted Checkout (redirect) |46| Web app with custom embedded UI | Pixel (iframe) |47| iOS or Android native app | Mobile SDK |48| Automated invoicing or WhatsApp commerce | QuickLink API |49| Manual one-off payment links | Payment Links (dashboard) |
carofi-auto