Secure Pay BD is a simple and secure payment automation tool designed to be used as a payment gateway so that you can accept payments from your customers through your website. This documentation gives you a complete overview of how Secure Pay BD works and how you can integrate the Secure Pay BD API into your website.
Secure Pay BD Payment Gateway enables Merchants to receive money from their customers by temporarily redirecting them to the Secure Pay BD checkout. The gateway connects multiple payment terminals including card systems, mobile financial services, local and international wallets. After the payment is complete, the customer is returned to the merchant's site and seconds later the merchant receives notification about the payment along with the details of the transaction.
This document is intended to be utilized by technical personnel supporting the online merchant's website. Working knowledge of HTML forms or cURL is required. You will probably require test accounts, for which you need to open accounts via contact with Secure Pay BD or they may already have been provided to you.
REST APIs are supported in two environments. Use the Sandbox environment for testing purposes, then move to the live environment for production processing. When testing, generate an order URL with your test credentials to make calls to the Sandbox URIs. When you're set to go live, use the live credentials assigned to your new signature key to generate a live order URL to be used with the live URIs. Your server has to support the cURL system — for HTML form submit, an HTML POST method URL is also provided after the cURL samples below.
Live API End Point (For Create Payment URL)
https://pay.securepaybd.xyz//api/payment/create https://pay.securepaybd.xyz//api/payment/verify | Field Name | Description | Required | Example Values |
|---|---|---|---|
cus_name | Customer Full Name | Yes | John Doe |
cus_email | Email address of the customer | Yes | john@gmail.com |
amount | The total amount payable. Please note that you should skip the trailing zeros in case the amount is a natural number. | Yes | 10 or 10.50 or 10.6 |
success_url | URL to which the customer will be returned when the payment is made successfully. The customer will be returned to the last page on the merchant's website where he should be notified of the successful payment. | Yes | https://yourdomain.com/success.php |
cancel_url | URL to return the customer to your product page or home page. | Yes | https://yourdomain.com/cancel.php |
meta_data | Pass any JSON formatted data | No | JSON formatted |
| Field Name | Description | Required | Example Values |
|---|---|---|---|
transaction_id | Transaction id received as a query parameter from the success URL provided during payment creation. | Yes | OVKPXW165414 |
| Header Name | Value |
|---|---|
Content-Type | application/json |
API-KEY | App key from API credentials |
SECRET-KEY | Secret key from API credentials |
BRAND-KEY | Brand key from Brands |
Four steps from checkout button to confirmed payment.
Integrating Secure Pay BD requires only a server capable of sending an HTTP POST request. The flow is identical for every platform:
| Step | Action | Where |
|---|---|---|
| 1 | Create your API credentials (App key & Secret key) and a Brand. | Secure Pay BD dashboard → API Credentials |
| 2 | POST the order data to the Create Payment endpoint. | Your server |
| 3 | Redirect the customer to the returned payment_url. | Your checkout |
| 4 | Confirm the payment server-side using the Verify API. | Your success page |
success_url with query parameters, but you must always confirm the final state through the Verify API before delivering goods or services.Send a JSON payload to the Create Payment endpoint with your credentials in the headers. Pick your language below.
curl -X POST https://pay.securepaybd.xyz//api/payment/create \ -H "Content-Type: application/json" \ -H "API-KEY: YOUR_API_KEY" \ -H "SECRET-KEY: YOUR_SECRET_KEY" \ -H "BRAND-KEY: YOUR_BRAND_KEY" \ -d '{ "cus_name": "John Doe", "cus_email": "john@gmail.com", "amount": "10", "success_url": "https://yourdomain.com/success", "cancel_url": "https://yourdomain.com/cancel", "meta_data": {"phone": "016****"} }'<?php$curl = curl_init();curl_setopt_array($curl, array( CURLOPT_URL => 'https://pay.securepaybd.xyz//api/payment/create', CURLOPT_RETURNTRANSFER => true, CURLOPT_CUSTOMREQUEST => 'POST', CURLOPT_POSTFIELDS => json_encode([ "cus_name" => "John Doe", "cus_email" => "john@gmail.com", "amount" => "10", "success_url" => "https://yourdomain.com/success", "cancel_url" => "https://yourdomain.com/cancel", "meta_data" => ["phone" => "016****"], ]), CURLOPT_HTTPHEADER => array( 'API-KEY: YOUR_API_KEY', 'Content-Type: application/json', 'SECRET-KEY: YOUR_SECRET_KEY', 'BRAND-KEY: YOUR_BRAND_KEY' ),));$response = curl_exec($curl);curl_close($curl);echo $response;?>const axios = require('axios');let data = JSON.stringify({ cus_name: "John Doe", cus_email: "john@gmail.com", amount: "10", success_url: "https://yourdomain.com/success", cancel_url: "https://yourdomain.com/cancel", meta_data: { phone: "016****" }});let config = { method: 'post', maxBodyLength: Infinity, url: 'https://pay.securepaybd.xyz//api/payment/create', headers: { 'API-KEY': 'YOUR_API_KEY', 'Content-Type': 'application/json', 'SECRET-KEY': 'YOUR_SECRET_KEY', 'BRAND-KEY': 'YOUR_BRAND_KEY' }, data: data};axios.request(config) .then((response) => console.log(response.data)) .catch((error) => console.log(error));import requestsimport jsonurl = "https://pay.securepaybd.xyz//api/payment/create"payload = json.dumps({ "cus_name": "John Doe", "cus_email": "john@gmail.com", "amount": "10", "success_url": "https://yourdomain.com/success", "cancel_url": "https://yourdomain.com/cancel", "meta_data": {"phone": "016****"}})headers = { 'API-KEY': 'YOUR_API_KEY', 'Content-Type': 'application/json', 'SECRET-KEY': 'YOUR_SECRET_KEY', 'BRAND-KEY': 'YOUR_BRAND_KEY'}response = requests.post(url, headers=headers, data=payload)print(response.text)| Field Name | Type | Description |
|---|---|---|
| Success Response | ||
status | bool | TRUE |
message | String | Message for status |
payment_url | String | Payment link where the customer completes the payment |
| Error Response | ||
status | bool | FALSE |
message | String | Message associated with the error response |
yourdomain.com/(success|cancel)?transactionId=******&paymentMethod=***&paymentAmount=**.**&paymentFee=**.**&status=pending|success|failedCall the Verify API from your server with the transaction_id received on your success URL. Only trust a transaction once this call returns COMPLETED.
curl -X POST https://pay.securepaybd.xyz//api/payment/verify \ -H "Content-Type: application/json" \ -H "API-KEY: YOUR_API_KEY" \ -H "SECRET-KEY: YOUR_SECRET_KEY" \ -H "BRAND-KEY: YOUR_BRAND_KEY" \ -d '{"transaction_id":"OVKPXW165414"}'<?php$curl = curl_init();curl_setopt_array($curl, array( CURLOPT_URL => 'https://pay.securepaybd.xyz//api/payment/verify', CURLOPT_RETURNTRANSFER => true, CURLOPT_CUSTOMREQUEST => 'POST', CURLOPT_POSTFIELDS => '{"transaction_id":"OVKPXW165414"}', CURLOPT_HTTPHEADER => array( 'API-KEY: YOUR_API_KEY', 'Content-Type: application/json', 'SECRET-KEY: YOUR_SECRET_KEY', 'BRAND-KEY: YOUR_BRAND_KEY' ),));$response = curl_exec($curl);curl_close($curl);echo $response;?>const axios = require('axios');let data = JSON.stringify({ transaction_id: "OVKPXW165414" });let config = { method: 'post', maxBodyLength: Infinity, url: 'https://pay.securepaybd.xyz//api/payment/verify', headers: { 'API-KEY': 'YOUR_API_KEY', 'Content-Type': 'application/json', 'SECRET-KEY': 'YOUR_SECRET_KEY', 'BRAND-KEY': 'YOUR_BRAND_KEY' }, data: data};axios.request(config) .then((response) => console.log(response.data)) .catch((error) => console.log(error));import requestsimport jsonurl = "https://pay.securepaybd.xyz//api/payment/verify"payload = json.dumps({"transaction_id": "OVKPXW165414"})headers = { 'API-KEY': 'YOUR_API_KEY', 'Content-Type': 'application/json', 'SECRET-KEY': 'YOUR_SECRET_KEY', 'BRAND-KEY': 'YOUR_BRAND_KEY'}response = requests.post(url, headers=headers, data=payload)print(response.text){ "status": "COMPLETED", "cus_name": "John Doe", "cus_email": "john@gmail.com", "amount": "900.000", "transaction_id": "OVKPXW165414", "metadata": {"phone": "015****"}, "payment_method": "bkash"}| Field Name | Type | Description |
|---|---|---|
status | String | COMPLETED, PENDING or ERROR |
cus_name | String | Customer name |
cus_email | String | Customer email |
amount | String | Paid amount |
transaction_id | String | Transaction id generated by the system |
metadata | JSON | Metadata used during payment creation |
payment_method | String | Method used by the customer (e.g. bkash) |
Accept payments on any WordPress site without writing code. Install the plugin, enter your API credentials from the dashboard and start receiving payments via WooCommerce or the standalone checkout form.
Add Secure Pay BD as a payment method to your WHMCS billing installation. Upload the module to modules/gateways/, activate it under Setup → Payments → Payment Gateways and paste your credentials.
Drop-in gateway module for popular SMM panel scripts. Copy the module file into your panel's gateway directory, enable it from the admin payment settings and fill in the API keys.
Building an Android app with Sketchware? Import the ready-made .swb project block, replace the placeholder keys with your own credentials and the checkout flow works out of the box.
The ready-made Android client connects to the same REST API described above — install the app, enter your API credentials once and start accepting payments on the go.