Paytm, SSLCommerz, Instamojo, iyzico
Credentials and test steps for the four regional gateways.
Sandbox testing is required - these four most of all
These gateways were built from provider documentation and simulated responses only. The parts the author is least certain about, and which you should check first in the provider's sandbox, are the iyzico request signature, the Paytm checksum and endpoints, the SSLCommerz transaction-query fields and the Instamojo legacy API. No refunds are sent to the provider for these four: refund through the provider's dashboard (Sellora still records the refund on the order).
Paytm#
Currency: INR only. Credentials (Paytm Business dashboard > Developer > API keys): Merchant ID, Merchant key, Website (WEBSTAGING for test, DEFAULT for live) and the Sandbox mode switch.
Test: turn Sandbox mode on and use Paytm's staging credentials and test wallet/cards.
Callback/webhook: https://your-domain.com/payments/paytm/webhook. The customer is sent to Paytm through a small signed hand-off page that is valid for 20 minutes.
SSLCommerz#
Currencies: BDT, USD, EUR, GBP, AUD, CAD, CHF, SGD, INR, MYR, SAR, AED, QAR. Credentials: Store ID, Store password, Sandbox mode switch.
Test: sandbox store credentials from the SSLCommerz sandbox registration, with Sandbox mode on.
IPN URL: https://your-domain.com/payments/sslcommerz/webhook is sent with every payment automatically (it only works on a real public domain; not localhost or *.test). The customer's return is processed safely even though SSLCommerz sends it as a POST from another site.
Payments flagged with a risk level are accepted but noted in the order's admin note so you can review them.
Instamojo#
Currency: INR only. Credentials: API key, Auth token and the Sandbox mode switch; optionally the Private salt (webhook MAC) to verify webhooks.
Test: Instamojo's test environment credentials (test.instamojo.com) with Sandbox mode on.
Webhook: the URL https://your-domain.com/payments/instamojo/webhook is sent with each payment automatically (public domains only). Sellora uses Instamojo's older v1.1 API, which matches the API key + auth token pair.
iyzico#
Currencies: TRY, EUR, USD, GBP. Credentials: API key, Secret key and the Sandbox mode switch.
Test: use iyzico sandbox keys (sandbox-api.iyzipay.com) and iyzico's test cards, with Sandbox mode on.
Notes: the customer's return is verified with iyzico before the order is marked paid. A placeholder national identity number is sent to iyzico because Sellora does not collect one; if your iyzico agreement requires real values, discuss this with iyzico before going live.
Test checklist#
Use the same checklist as the international gateways, skipping the refund step: refunds for these four are manual.