Stripe, PayPal, Razorpay, Paystack, Flutterwave, Mollie

Credentials, webhook setup and test steps for the six card and wallet gateways.

All webhook URLs have the form https://your-domain.com/payments/{gateway}/webhook. The value of {gateway} is shown in each section.

Stripe#

Used for: cards and wallets via Stripe Checkout (customers are sent to Stripe's hosted payment page and return to your store).

You need a Stripe account. Credentials (Stripe Dashboard > Developers > API keys): Publishable key, Secret key, and Webhook signing secret.

Test mode: use the keys that start with pk_test_ / sk_test_ (toggle Test mode in the Stripe dashboard). Use Stripe's test card 4242 4242 4242 4242 with any future date and CVC.

Webhook: Stripe Dashboard > Developers > Webhooks > Add endpoint:

• URL: https://your-domain.com/payments/stripe/webhook
• Events: checkout.session.completed, checkout.session.async_payment_succeeded, checkout.session.async_payment_failed, checkout.session.expired
• Copy the endpoint's Signing secret (whsec_...) into Sellora's Webhook signing secret.

The Stripe payment session stays valid for the unpaid-order expiry set in Settings > Checkout (between 31 minutes and 24 hours). Refunds: supported from the order page.

PayPal#

Credentials (developer.paypal.com > Apps & Credentials): Client ID, Secret, and the Sandbox mode switch. Optional: Webhook ID (enables webhook signature verification).

Test mode: switch Sandbox mode on and use sandbox app credentials and sandbox buyer accounts.

Webhook: in your PayPal app add a webhook:

• URL: https://your-domain.com/payments/paypal/webhook
• Events: CHECKOUT.ORDER.APPROVED, PAYMENT.CAPTURE.COMPLETED, PAYMENT.CAPTURE.DENIED
• Copy the Webhook ID PayPal shows into Sellora's Webhook ID field.

Sandbox and live use different credentials: when you go live, enter the live Client ID and Secret and switch Sandbox mode off. Refunds: supported.

Razorpay#

Credentials (Razorpay Dashboard > Settings > API keys): Key ID and Key secret; plus Webhook secret for the webhook.

Test mode: Razorpay test keys (rzp_test_...) from the dashboard in Test Mode.

Webhook: Dashboard > Settings > Webhooks:

• URL: https://your-domain.com/payments/razorpay/webhook
• Events: payment.captured, order.paid, payment.authorized
• Set a secret and copy it into Sellora's Webhook secret.

Razorpay's payment pop-up opens on your checkout page. Refunds: supported.

Paystack#

Credentials (Paystack Dashboard > Settings > API Keys & Webhooks): Public key and Secret key. Currencies: NGN, GHS, ZAR, USD, KES (according to your Paystack account).

Test mode: use the test keys (pk_test_, sk_test_).

Webhook: set Live/Test Webhook URL to https://your-domain.com/payments/paystack/webhook. Paystack signs webhooks with your secret key. Refunds: supported.

Flutterwave#

Credentials (Flutterwave Dashboard > Settings > API): Public key, Secret key, Encryption key, and the Webhook secret hash.

Test mode: use the test-mode keys.

Webhook: Settings > Webhooks:

• URL: https://your-domain.com/payments/flutterwave/webhook
• Secret hash: choose any secret string and enter the same value in Sellora's Webhook secret hash.

Flutterwave's webhook event names are the least certain part of this integration: verify in sandbox that a paid test order is confirmed by the customer's return and by the webhook. Refunds: supported.

Mollie#

Credentials (Mollie Dashboard > Developers > API keys): API key.

Test mode: use the test API key (test_...) to simulate payments.

Webhook: no setup at Mollie. Sellora sends the webhook URL with every payment (https://your-domain.com/payments/mollie/webhook) - but only when your site is on a real public domain (not localhost or *.test). Refunds: supported.

Test checklist (per gateway)#

• [ ] Gateway enabled, credentials entered, sandbox / test mode on.
• [ ] A paid test order becomes Paid, a transaction is listed, the customer e-mail is sent.
• [ ] Cancelling at the provider returns the customer to your store with an unpaid order and a message.
• [ ] The webhook reaches your server (check storage/logs/payments-*.log and the provider's webhook delivery log).
• [ ] A refund from the order page works (for the gateways that support refunds).
• [ ] Live credentials entered, sandbox off, one small real purchase tested.