Paystack Flutterwave Paga Google Pay Apple Pay Webhook Security

Paystack Setup

Paystack is Nigeria's leading payment platform, supporting card payments, bank transfers, and USSD.

Step 1: Create Paystack Account

  1. Go to paystack.com
  2. Click "Sign up" and fill in your business details
  3. Verify your email address
  4. Complete KYC verification

Step 2: Get API Keys

  1. Log in to Paystack Dashboard
  2. Go to Settings → Developer
  3. You'll see:
    • Public Key: pk_live_xxxxx (share this with frontend)
    • Secret Key: sk_live_xxxxx (keep this secret!)
  4. Copy both keys

Step 3: Setup Webhook

  1. In Dashboard, go to Settings → Webhooks
  2. Enter your webhook URL: https://yoursite.com/webhook/paystack
  3. Select events to monitor:
    • charge.success
    • charge.failed
    • transfer.success
    • transfer.failed
  4. Save the webhook

Step 4: Enter in OAP Admin

  1. Go to Admin Dashboard → Payment Gateways
  2. Under Paystack section:
    • Enable Paystack checkbox
    • Paste Public Key
    • Paste Secret Key
    • Enter Webhook URL
  3. Click "Test Connection"
  4. Save settings
💡 Tip: Use Test Keys first (pk_test_xxx / sk_test_xxx) for testing, then switch to Live Keys when ready for production.

Flutterwave Setup

Flutterwave enables payments across Africa with multiple payment methods and currencies.

Step 1: Create Flutterwave Account

  1. Go to flutterwave.com
  2. Click "Sign up" and select "Business"
  3. Fill in your business information
  4. Verify email and phone number
  5. Complete business verification

Step 2: Get API Keys

  1. Log in to Flutterwave Dashboard
  2. Go to Settings → API
  3. You'll find:
    • Public Key: FLWPUBK_xxxxx (for frontend)
    • Secret Key: FLWSECK_xxxxx (keep secret!)

Step 3: Setup Webhook

  1. Go to Settings → Webhooks
  2. Add webhook URL: https://yoursite.com/webhook/flutterwave
  3. Select events:
    • charge.completed
    • charge.failed
    • transfer.completed
  4. Copy and save the webhook secret (FLWWEBHOOK_xxxxx)

Step 4: Enter in OAP Admin

  1. Go to Admin Dashboard → Payment Gateways
  2. Under Flutterwave section:
    • Enable Flutterwave checkbox
    • Paste Public Key
    • Paste Secret Key
    • Enter Webhook URL
    • Enter Webhook Secret
  3. Click "Test Connection"
  4. Save settings
💡 Tip: Flutterwave supports 140+ African payment methods. Great for multi-country expansion.

Paga Setup

Paga provides direct mobile money integration and bank transfers across West Africa.

Step 1: Create Paga Account

  1. Go to mypaga.com
  2. Click "Register Business"
  3. Enter your business details and bank account
  4. Submit for verification (takes 24-48 hours)

Step 2: Get API Credentials

  1. Go to Paga Developer Portal
  2. You'll receive:
    • Principal: Your business ID (provided after approval)
    • Credentials: Your API password (set in security settings)
  3. Copy both values securely

Step 3: Setup Webhook

  1. In Developer Portal, go to "Integration Settings"
  2. Set webhook URL: https://yoursite.com/webhook/paga
  3. Enable event notifications for:
    • Payment completed
    • Payment failed
    • Transfer completed

Step 4: Enter in OAP Admin

  1. Go to Admin Dashboard → Payment Gateways
  2. Under Paga section:
    • Enable Paga checkbox
    • Enter Principal ID
    • Enter API Credentials (password)
    • Enter Webhook URL
  3. Click "Test Connection"
  4. Save settings
💡 Tip: Paga directly integrates with mobile money networks, enabling USSD and mobile wallet payments.

Google Pay Setup

Google Pay enables fast, secure payments for web and mobile users with saved payment methods.

Step 1: Create Google Business Account

  1. Go to Google Pay Console
  2. Sign in with your Google Business account
  3. Click "Create new app" or select existing

Step 2: Get Merchant ID

  1. In Google Pay Console, go to Settings
  2. Find your Merchant ID (usually a 16-19 digit number)
  3. Copy and save the merchant ID
  4. Set your merchant name (e.g., "On Air Proof")

Step 3: Configure Payment Gateway

  1. In Google Pay Console, go to Payment gateway settings
  2. Select your payment processor (Paystack or Flutterwave integration)
  3. Enter the processor's merchant account details
  4. Enable "Direct integration" if using API

Step 4: Enter in OAP Admin

  1. Go to Admin Dashboard → Payment Gateways
  2. Under Google Pay section:
    • Enable Google Pay checkbox
    • Enter Merchant ID
    • Enter Merchant Name
  3. Click "Validate"
  4. Save settings
💡 Tip: Google Pay requires a backend payment processor (Paystack/Flutterwave). It acts as a payment method selector and accelerator.

Apple Pay Setup

Apple Pay enables secure payments for iOS and macOS users with tokenized payment data.

Step 1: Enroll in Apple Developer Program

  1. Go to developer.apple.com
  2. Enroll in Apple Developer Program ($99/year)
  3. Complete identity verification

Step 2: Create Merchant ID

  1. Go to Certificates, Identifiers & Profiles
  2. Click "Identifiers" → "+" button
  3. Select "Merchant IDs" and click "Continue"
  4. Enter description (e.g., "OAP Merchant") and ID (e.g., merchant.com.onairproof)
  5. Register the merchant ID

Step 3: Create Certificate

  1. In Certificates & Profiles, select your Merchant ID
  2. Click "Create Certificate" under "Apple Pay Payment Processing Certificate"
  3. Follow the CSR (Certificate Signing Request) process
  4. Download the certificate and save as .pem file
  5. Note the certificate path on your server

Step 4: Configure Merchant Domain

  1. Still in Merchant ID settings, click "Edit"
  2. Click "Add Domain"
  3. Enter your domain: yoursite.com
  4. Verify domain ownership (Apple will provide verification steps)
  5. Save the domain

Step 5: Enter in OAP Admin

  1. Go to Admin Dashboard → Payment Gateways
  2. Under Apple Pay section:
    • Enable Apple Pay checkbox
    • Enter Merchant ID (merchant.com.xxx)
    • Enter Certificate Path (/path/to/cert.pem)
    • Enter Webhook URL (if using Apple Pay API)
  3. Click "Validate"
  4. Save settings
⚠️ Important: Apple Pay requires your domain to be verified. Certificate must be kept secure on your server and never shared.

Webhook Security & Setup

What are Webhooks?

Webhooks are HTTP callbacks that payment providers send to your server when payment events occur (successful payment, failed transaction, refund, etc.).

Webhook URLs by Provider

Provider Webhook URL Pattern Events
Paystack /webhook/paystack charge.success, charge.failed, transfer.success
Flutterwave /webhook/flutterwave charge.completed, charge.failed, transfer.completed
Paga /webhook/paga payment.completed, payment.failed, transfer.completed
Apple Pay /webhook/apple-pay payment.authorized, payment.declined, charge.completed

Webhook Security Best Practices

  • Always verify webhook signatures — Each provider sends a signature header. Verify it matches your secret key to prevent fraud
  • Use HTTPS only — Webhooks must be on secure HTTPS URLs, never HTTP
  • Whitelist IP addresses — Each provider has specific IPs that send webhooks. Whitelist them in your firewall
  • Log all webhooks — Keep detailed logs of webhook requests for debugging
  • Idempotency — Process webhooks idempotently (same webhook twice = same result)
  • Respond quickly — Acknowledge webhooks within 2 seconds to prevent retries
  • Retry logic — Providers retry failed webhooks. Implement exponential backoff in your handler

Testing Webhooks Locally

For local development, use webhook tunneling tools:

  • ngrok — Expose local server to public internet
  • LocalTunnel — Similar to ngrok
  • Provider's sandbox mode — All providers have test environments

Example with ngrok:


# Terminal 1: Start ngrok
ngrok http 8000

# Terminal 2: Start Laravel dev server
php artisan serve

# Update webhook URL in provider dashboard
# https://xxxxx.ngrok.io/webhook/paystack
💬 Chat with us!