Not every business lives on a website. Many of the fastest-growing services in Pakistan run inside a mobile app, a Telegram, WhatsApp or Discord bot or a piece of desktop software. ZurvaPay supports all of them with the same API and the same hosted checkout.
- Supported platforms
- How platform approval works
- The golden rule: payments start on your server
- A typical bot or app flow
- What to register
- Mistakes to avoid
- FAQ
Supported platforms
- Websites
- Mobile apps (Android and iOS)
- Telegram bots
- WhatsApp bots
- Discord bots
- Desktop and other software
How platform approval works
During KYC you choose one platform where you will use ZurvaPay and enter its details: the app package name or bundle ID, the bot username, the WhatsApp business number or the software name. For apps and bots you also give the domain of the server that creates payments and receives payment confirmation. Payments are accepted only from the platform you registered, and requests from any other website, app or bot are blocked.
The golden rule: payments start on your server
Your app or bot must never contain your secret key. Instead, the app or bot asks your server to create the payment, your server calls the ZurvaPay API and returns the checkout link to the user. This keeps your keys private even if someone decompiles your app.
A typical bot or app flow
- The user taps pay in your bot or app.
- Your server creates a pending order and calls the initiate endpoint.
- Your bot sends the checkout link to the user, who pays in the browser.
- ZurvaPay notifies your server with a signed IPN.
- Your server verifies it, updates the order once and tells the user, for example with a message in the chat or a push in your app.
The technical details are the same as in the API integration guide.
What to register
- Mobile app: the package name, for example
com.yourcompany.app. - Telegram bot: the bot username, which ends with bot.
- WhatsApp bot: the WhatsApp business number.
- Discord bot: the bot name or ID.
- Software: the software name.
- Server domain: the domain that talks to ZurvaPay, for example
api.yourshop.com.
Mistakes to avoid
- Embedding the secret key in the app or bot code.
- Confirming a payment because the user says they paid.
- Registering a server domain that is different from the one you actually use.
- Forgetting to answer the notification with HTTP 200.
Frequently asked questions
Can one account serve a website and an app?
Each approval is tied to one platform. Use sub-merchants to register additional websites, apps or bots under your verified account.
Do my users need to leave the app to pay?
They pay on the hosted checkout page opened from your app or bot, which is fast and mobile friendly.
Is it safe to store my keys in the bot?
Keep keys on your server and have the bot call your server. Never ship the secret key inside a bot or app.
Add payments to your app or bot
Open a ZurvaPay merchant account or contact us and we will help you get started.
Related guides
Start accepting payments with ZurvaPay
Open a merchant account, connect your website with one API and get notified the moment a customer pays.