Help Center

В разделе Настройка --> Команда можно добавить пользователей. который получат доступ к вашему аккаунту Allpay.

Эта функция в разработке и пока недоступна. О появлении будет объявлено в Телеграм-канале.

Каждый пользователь в системе Allpay имеет уникальный телефон, е-мейл и ник Telegram. Невозможно привязать один и тот же Telegram, email или телефон к разным пользователям.

В настоящее время каждый пользователь раздела Команда получает полный доступ к системе. Разделение прав будет введено позже.

Вход в систему возможен только по подтвержденному контакту.

Добавление пользователей

В настоящее время добавить нового пользователя можно обратившись в поддержку Allpay.

Пришлите имя, контакт и название позиции в команде.

This article explains how to set up webhook notifications for payments.

For payments initiated via the API, Allpay sends a webhook by default in response to the API request. No additional configuration is required.

The setup described below is needed in two cases: if you want to receive webhook notifications for payments created not via the API, but through payment links, or if you need to specify an additional URL for sending webhook notifications as part of your API integration.

What is webhook

Webhook is an automatic event notification sent by the Allpay system to an external URL.

When a payment is successfully completed, Allpay sends a POST request to the specified address. The request contains full payment details, including the buyer's name, the payment description, and the amount.

Developers and integrators use webhooks to:

• automatically trigger actions (e.g. activating an order or sending an email to the customer),
• synchronize data between systems,
• eliminate the need for manual payment status checks.

Even types

Allpay supports webhooks for two events — successful payment and refund.

For subscriptions, the webhook is automatically sent to the specified URL each month after a successful recurring charge.

Where to configure a webhook

A webhook is configured separately for each payment link or API integration:

1. Payment link — in the settings of that specific link. In this case, the webhook will be sent for every payment made via that link.
2. API integration — in the settings of a specific integration under the <span class="u-richtext-element">API Integrations</span> section. This allows you to receive webhooks for all payments processed through that integration — for example, from your site on WordPress, or another platform.

Allpay does not have a centralized webhook setting for all payments. This approach gives you flexible control over notifications across different channels.

Webhook request contents

Allpay sends a POST request to the specified URL. The request body is a JSON object containing parameters related to the event.

Example request

POST /c96zv6ri852dvppncccdg6fxkjnpwojg HTTP/2
Host: hook.eu2.make.com
accept: */*
content-type:application/json
content-length: 453

{
    "name": "Consultation",
    "items": [
        {
            "name": "Consultation",
            "price": 150,
            "qty": 2,
            "vat": "1"
        },
        {
            "name": "Clock",
            "price": 50,
            "qty": 1,
            "vat": "1"
        }
    ],
    "amount": "350",
    "status": 1,
    "client_name": "Tanur Mikrogalov",
    "client_email": "test@email.com",
    "client_tehudat": "123456789",
    "client_phone": "+972 58 569 8877",
    "foreign_card": "0",
    "card_mask": "455743******3431",
    "card_brand": "visa",
    "receipt": "",
    "inst": 1,
    "sign": "83f6fab69f7b237ee2db5d9993b84b5fe89ef722af6206a0ffe64480501f3784"
}

‍

Each payment for which a webhook was sent is marked with a corresponding label. By clicking on this label, you can view the full contents of the request.

add_field parameter

If you add <span class="u-richtext-element">?add_field=any-string</span> to the payment link URL, this parameter will be included in the Webhook request body. Learn more.

Webhook security

Allpay supports two methods for verifying the authenticity of webhook requests:

Verification using the Webhook secret key

This method relies on an HMAC signature based on the SHA256 algorithm.

Signature generation algorithm:

1. Remove the <span class="u-richtext-element">sign</span> parameter from the request.
2. Exclude all parameters with empty values.
3. Sort the remaining keys in alphabetical order.
4. From the sorted list, take the parameter values and join them into a single string using a colon (:) as a separator.
5. Append your Webhook secret key to the end of the string, preceded by a colon.
6. Apply the SHA256 algorithm to the resulting string.
7. Compare the result with the <span class="u-richtext-element">sign</span> parameter received in the request.

Platforms like Zapier support this type of verification using built-in tools, such as a custom script in Code by Zapier.

Example JavaScript for Zapier

const webhookKey = "YOUR WEBHOOK SECRET KEY";

// Parse the input params from JSON string to an object
const params = JSON.parse(inputData.params || '{}');

// Store the original signature from the request
const requestSignature = params.sign || null;

// Remove the 'sign' parameter before calculating the signature
delete params.sign;

function getApiSignature(params, webhookKey) {
    // Filter out empty values and sort keys alphabetically
    const sortedKeys = Object.keys(params)
        .filter((key) => {
            const value = params[key];
            return value !== null && value !== undefined && String(value).trim() !== '';
        })
        .sort();

    // Collect the values in sorted key order, process nested arrays (like "items")
    const chunks = [];
    sortedKeys.forEach(key => {
        const value = params[key];
        if (Array.isArray(value)) {
            value.forEach(item => {
                if (typeof item === 'object' && item !== null) {
                    Object.keys(item).sort().forEach(subKey => {
                        const val = item[subKey];
                        if (val !== null && val !== undefined && String(val).trim() !== '') {
                            chunks.push(String(val).trim());
                        }
                    });
                }
            });
        } else {
            chunks.push(String(value).trim());
        }
    });

    // Build the string to hash
    const baseString = chunks.join(':') + ':' + webhookKey;

    // Generate SHA256 hash
    const crypto = require('crypto');
    const hash = crypto.createHash('sha256').update(baseString).digest('hex');

    return { baseString, verifiedSignature: hash };
}

// Generate the signature
const result = getApiSignature(params, webhookKey);

// Return the original and calculated values
output = {
    requestSignature: requestSignature,
    baseString: result.baseString,
    verifiedSignature: result.verifiedSignature
};

‍

Demo of webhook verification on Zapier

‍

IP address verification‍

A simpler but less secure method is to check that the request comes from Allpay’s server IP address. You can request the current IP address by contacting our support team.

Webhook delivery and retries

Your server must return an <span class="u-richtext-element">200 OK</span> response to confirm successful receipt of a webhook. If any other status is returned, or the request fails due to a timeout or network error, Allpay will automatically retry delivery.

Allpay performs up to 10 delivery attempts in total. The first retry is made 1 minute after the initial failure. Subsequent retries are sent with progressively increasing intervals, with the final attempt occurring within 24 hours of the original request.

If all delivery attempts fail, the webhook will be marked as failed and no further retries will be made.

Platform developers that need a payment solution can integrate with Allpay.

This model is suitable for platforms that want to add Allpay as a payment method and be listed in the Allpay integrations catalog. It does not include partner payouts and is based on mutual promotion (other partnership models).

This integration will become available to Allpay customers as a ready-made way to connect your platform.

Requirements

To have your platform added to the Allpay integrations catalog, the following conditions must be met:

1. You do not participate in the Allpay partner or referral program.
   This integration is based on mutual promotion.
2. The integration must be approved by Allpay in advance.
   Your platform must be in demand in Israel and already used by real customers.
3. You are ready to support the integration on an ongoing basis.
   You are responsible for maintaining the integration and providing customer support on your side.

How to start

To approve the integration of your platform, contact Allpay support and briefly describe:

• your platform;
• who your customers are;
• how exactly you want to use Allpay payments;
• which integration method you plan to use: manual or automated;
• whether there are already customers who need this integration.

Integration methods

Integration with Allpay can be implemented in two ways:

• manual integration;
• automated integration.

Manual integration

With manual integration, you implement the connection on your side and publish instructions for customers on your website.

The customer will need to:

1. Open the integrations section in the Allpay dashboard.
2. Create API keys.
3. Copy the keys and paste them into the settings of your platform.

Technical involvement from Allpay is usually not required for this type of integration. After implementation, send us information about your platform and a link to the Allpay connection instructions on your website.

After review and approval, your platform will be added to the Allpay integrations catalog.

Automated integration

Automated integration allows the platform to be connected without manually copying API keys. The user clicks the connection button in the Allpay dashboard, confirms the connection on your platform side, and the API keys are transferred automatically.

Before implementation, Allpay provides your platform with:

<span class="u-richtext-element">partner_id</span> — the individual integration ID;

<span class="u-richtext-element">secret_key</span> — the secret key for signing and verifying server requests.

<span class="u-richtext-counter">1</span>Redirect from Allpay to your platform page

The user opens the <span class="u-richtext-element">Settings</span> → <span class="u-richtext-element">Integrations</span> → <span class="u-richtext-element">Your platform</span> section in the Allpay dashboard and clicks the connection button.

Allpay generates a one-time token for linking the accounts and redirects the user to the confirmation page on your platform side, for example:

https://your-platform.com/connect?token=TOKEN

Where <span class="u-richtext-element">TOKEN</span> is the one-time token created by Allpay.

The standard token lifetime is 1 hour.

<span class="u-richtext-counter">2</span>Confirmation on your platform side

On your side, the user confirms the connection under their account.

After confirmation, your platform redirects the user back to the universal Allpay endpoint:

https://allpay.to/services/endpoints/exchange.php?act=connect&partner_id=PARTNER_ID&token=TOKEN&external_uid=USER_ID

Where:

<span class="u-richtext-element">act=connect</span> — the integration connection action;

<span class="u-richtext-element">partner_id</span> — the individual integration ID;

<span class="u-richtext-element">token</span> — the one-time token created by Allpay;

<span class="u-richtext-element">external_uid</span> — the internal user ID on your platform.

<span class="u-richtext-counter">3</span>Creating and sending API keys to your platform

After verifying the token, Allpay links the Allpay user with the user on your platform, creates or finds the API keys <span class="u-richtext-element">api_login</span> and <span class="u-richtext-element">api_key</span>, and then sends them to your endpoint.

Example endpoint on your platform side:

POST https://your-platform.com/allpay/partner/exchange

Request body:

{
  "external_uid": "USER_ID",
  "api_login": "API_LOGIN",
  "api_key": "API_KEY",
  "sign": "SIGNATURE"
}

Where:

<span class="u-richtext-element">external_uid</span> — the user ID on your platform;

<span class="u-richtext-element">api_login</span> — the Allpay user's API login;

<span class="u-richtext-element">api_key</span> — the Allpay user's API key;

<span class="u-richtext-element">sign</span> — the request signature.

<span class="u-richtext-counter">4</span>Request signature

The server request with the API keys is signed using HMAC SHA-256.

Signature format:

hash_hmac('sha256', $payload_json, $secret_key);

Where:

<span class="u-richtext-element">payload_json</span> — the JSON request body;

<span class="u-richtext-element">secret_key</span> — the individual secret key.

<span class="u-richtext-counter">5</span>Response from your platform

After successfully receiving and saving the keys, your platform must return a successful response, for example:

{
  "ok": true
}

After this, Allpay marks the integration as active.

Disconnecting the integration

If the user disconnects the integration on your platform side, you must delete the saved API keys on your side.

In addition, your platform must send a POST request to Allpay to disconnect the integration:

POST https://allpay.to/services/endpoints/exchange.php?act=disconnect&partner_id=PARTNER_ID

Request body:

{
  "external_uid": "USER_ID",
  "sign": "SIGNATURE"
}

Where:

<span class="u-richtext-element">external_uid</span> — the user ID on your platform;

<span class="u-richtext-element">sign</span> — the request signature.

The disconnect request is also signed using <span class="u-richtext-element">secret_key</span>.

If the user disconnects the integration from the Allpay dashboard, Allpay can send a disconnect notification to your platform endpoint. To receive this notification, provide an endpoint on your side.

Security requirements

For automated integration, the following requirements must be met:

1. HTTPS only
   All requests between Allpay and your platform must be sent only over HTTPS.
2. Secure key storage
   The received <span class="u-richtext-element">api_login</span> and <span class="u-richtext-element">api_key</span> must be stored securely on your side.
3. Server request signatures
   Server requests must be signed using <span class="u-richtext-element">secret_key</span>.

<span id="info">Information for the integrations catalog</span>

After the technical part is completed and the integration is working, send us the following information to add your platform to the Allpay integrations catalog:

• platform logo in SVG format;
• short platform description of up to 200 characters;
• extended platform description of up to 360 characters;
• technical support contacts for the integration: email and WhatsApp or Telegram;
• information on whether your integration supports installments, recurring payments, and refunds;
• link to the Allpay connection instructions on your website.

Allpay branding guidelines

Use the correct brand spelling:

correct: Allpay;

incorrect: AllPay, All Pay, allpay.

Use the official Allpay logo.

Chargeback comes from the English words «charge» (debit) and «back» (return), which literally means «return of funds back». This term refers to the procedure by which a bank refunds money to the payer after funds were mistakenly or fraudulently withdrawn from their account.

It is a consumer protection mechanism that allows the cancellation of credit or debit transactions and the return of funds if the customer did not authorize the purchase, did not receive the goods or services, or if billing errors occurred.

Participants in a chargeback

The chargeback process involves:

• Customer: Initiates the chargeback through the issuing bank (the bank that issued the card).
• Issuing bank: Conducts the investigation and, if necessary, refunds the money to the customer. In Israel, the issuing banks can be Isracard, CAL, MAX and few others.
• Merchant (seller): Must provide evidence of the legitimacy of the transaction. If the chargeback is justified, the merchant refunds the money to the bank.

Possible reasons for a chargeback

• The customer requested a refund because they did not recognize a charge in the bank statement or forgot about an actual payment.
• The goods or services were not provided by the merchant.
• Fraudulent charges were made on the card without the customer’s knowledge (the card was stolen or compromised).

Chargeback procedure

After the customer files a request, the issuing bank opens a case, determines the reason for the chargeback, and decides whether to return the money to the customer or leave it with the merchant. As part of the investigation, the bank will contact the merchant and request proof of service delivery.

In Israel, according to the Payment Services Law of 2020, if a transaction is considered an «insufficient documentation transaction» (i.e., made without the physical presence of the card, which applies to all online payments), the customer receives a full refund if they contact the issuing bank within 30 days of receiving the charge notification.

Thus, the law provides significant protection for the consumer but can also lead to fraud and cancellations of legitimate transactions where the customer actually received the agreed service. Therefore, merchants are advised to collect and keep evidence of goods or services provided to the customer, especially for large amounts (e.g., contracts, receipts, emails, delivery confirmations).

If the bank establishes that the funds were withdrawn from the customer’s card illegally, they will be returned to the customer and deducted from the merchant’s balance.

Risks for merchants

Frequent chargebacks can have serious consequences for merchants. The main risk is financial loss due to refunds to customers. However, that is not the only risk:

• Fines and fees: Banks may impose fines for each chargeback, increasing financial pressure on the business.
• Deterioration of banking relationships: Frequent chargebacks can damage relationships with acquiring banks. This can lead to higher fees, worse cooperation terms, or even termination of the contract.
• Risk of being blacklisted: A high chargeback rate can result in being added to blacklists of payment systems, making it difficult to work with new acquirers and other financial institutions.
• Loss of reputation: Frequent chargebacks can damage the merchant’s reputation, creating distrust among customers and partners.

Tips for prevention

To minimize chargeback risks, merchants should take the following measures:

• Use secure payment methods: Activate 3DS for payments — a two-factor authentication method where the bank asks the customer to confirm the payment via the banking app or by entering an SMS code.
• Improve communication with customers: Quick and transparent communication helps avoid misunderstandings. It is important to respond to customer inquiries promptly and provide full information about goods and services.
• Collect and store evidence: Systematically keep all documents confirming the provision of services or delivery of goods. This will help protect the business in case of a chargeback.
• Clear refund policy: A transparent and easy-to-understand return policy can reduce the number of chargebacks, as customers will know how to return a product or cancel a service.

Fees

The average fee charged for handling a chargeback is 50 ILS.

Display in the interface and documents

If a chargeback was requested for a payment, a new transaction with a negative amount and the label <span class="u-richtext-element" style="background-color: rgba(221, 94, 94, 0.4)">chargeback</span> will appear on the payments screen.

A refund document will also be created: a credit invoice and/or a receipt with a negative amount — depending on the business type and the type of the previously issued document.

If the business disputed the chargeback and the dispute was resolved in favor of the business, the funds will be returned. In this case, a new transaction with a positive amount and the label <span class="u-richtext-element" style="background-color: rgba(68, 203, 138, 0.5)">chargeback reverse</span> will appear on the payments screen.

A new income document will also be created: a receipt or a tax invoice/receipt — depending on the business type and document settings.

To allow customers to choose the quantity on the checkout page, go to <span class="u-richtext-element">Settings</span> ➙ <span class="u-richtext-element">Payment links</span> and enable the <span class="u-richtext-element">Manage quantity</span> option.

After that, when creating a payment link, you can set the minimum and maximum number of units a customer can select, as well as the total quantity available for all customers when paying via this link.

If the minimum number of units is set to 0 (zero), the customer will be able to exclude this item from the payment.

The remaining quantity is shown on the payment link tile. When the stock is depleted (equals zero), the payment link is automatically disabled.

If the total quantity is not set (that is, the customer can select any quantity without limits), an infinity symbol is displayed on the payment link.

Simultaneous purchase of the last item

When multiple customers try to purchase the last remaining items at the same time, the purchase will be successful for the customer who completes the payment first.

For example, if 5 units are left in stock and customer A tries to buy all 5, while at the same time customer B buys 2 units and completes the payment first, customer A will see a message that only 3 units are available.

The payment page supports languages: Arabic, English, French, German, Hebrew, Italian, Russian and Spanish.

The language is detected automatically based on the customer’s browser language, so each customer sees the payment page in their own language. If the browser language is not supported or cannot be detected, English will be set by default.

To manually control the language of the payment page, in the <span class="u-richtext-element">More</span> section of the payment link settings, change the <span class="u-richtext-element">Auto-detect (browser language)</span> option to the language you need.

The customer will then see the payment page in that language, regardless of their browser settings. The language switcher will still remain available on the checkout page.

The payment email notification is sent to the customer in the same language that was selected on the payment page at the time the payment was made. For example, if the payment page was opened in Hebrew, the email notification will also be sent in Hebrew. Example of a payment email notification.

Translation of additional fields

If you add custom fields to the payment page, their labels can be translated into all four languages. This makes the payment page convenient for a multilingual audience. For more details, see the article about additional fields.

Language control via API

For payments initiated from your website (i.e., not through payment links created in Allpay), the payment page language can be controlled via the API according to the documentation.

By default, automatic detection based on the browser settings applies.

After payment, customer receives an email notification about the payment. Make sure this feature is enabled in <span class="u-richtext-element">Settings</span> -> <span class="u-richtext-element">Notifications</span>

An email notification by itself is not a receipt.

The notification is sent in the same language that was selected on the payment page at the time the payment was made. For example, if the payment page was opened in English, the customer will receive the notification in English as well.

If you enable integration with EasyCount or Morning digital invoicing systems, the receipt will be created automatically, and a button for downloading it will be added to the notification.

Example of email notification

In Allpay, the plan is billed monthly. After registration, you get a 7-day trial period. All paid modules are charged to the internal balance, and once a month the outstanding amount is charged to the linked card.

Subscription fee and processing fees

The subscription fee and payment processing fees are different charges.

The subscription fee is charged to your card once a month. Payment processing fees are charged separately for each successful payment and are deducted from your payout.

Trial period and billing date

After registration, every client gets a 7-day trial period. At the end of the trial period, the system will charge the first payment for the next billing period.

The date of the first charge becomes the fixed monthly billing date for the plan. It does not change in the future.

For example, if you registered on March 10, the trial period will end on March 17. On that day, the system will charge the first payment for the next billing period. The following charges will take place on the 17th of each month.

How the internal balance works

All paid services and modules that you activate during the month are charged to the internal Allpay balance in <span class="u-richtext-element">Settings</span> → <span class="u-richtext-element">Plan</span> → <span class="u-richtext-element">Billing</span>.

In the standard scenario, you do not need to top up the balance in advance. On the monthly billing date, the balance is charged for the next billing period. Immediately after that, the system charges this amount to the linked card, and the balance returns to zero.

If the card charge fails, the outstanding amount remains on the balance, and the balance stays negative until the debt is paid.

If a new module with a subscription fee is activated in the middle of a billing period, its cost is calculated proportionally to the time remaining until the next billing date.

If a module with a paid activation fee but no subscription fee is activated in the middle of a billing period, the activation fee is charged to the balance when the module is connected.

In some cases, the balance can be topped up in advance by bank transfer through support. This is usually used by companies that do not have a corporate card.

Canceling your Allpay subscription

You can cancel your subscription at any time. To do this, click “Disable all” in <span class="u-richtext-element">Settings</span> → <span class="u-richtext-element">Plan</span>.

After cancellation, the service will continue to work and payments will continue to be processed until the end of the paid period. After that, the service will be disabled, and no new debt will be charged for the next billing period.

The “Disable all” button disables all paid services at once:

• the main payment processing service;
• the Subscriptions module;
• the Shopify module, if it was active;
• other paid modules, if they were active.

If you want to disable only one module, you need to do this in <span class="u-richtext-element">Settings</span> → <span class="u-richtext-element">Payment modules</span>.

After the service is disabled, your account and payment history are saved. If needed, you will still be able to log in to your account and view previous transactions. The service can always be activated again to resume accepting payments.

If there is an outstanding debt on the balance when the service is reactivated, it will be paid immediately after the service is activated or a new card is linked.

Failed charges

If the system cannot charge the card, an error message will appear in the Allpay interface. An email is also sent for each failed charge.

The system makes four charge attempts in total:

Attempt 1 — the first failed charge.

Attempt 2 — 2 days after the first attempt.

Attempt 3 — 10 days after the first attempt.

Attempt 4 — one month after the first attempt.

Until the final charge attempt, the service continues to work as usual. If the debt is not paid after the fourth attempt, payment processing will be suspended.

The unpaid debt will remain on the internal balance. It must be paid before you can continue using the service.

Four charge attempts during the month give you enough time to fix the card issue without losing the ability to accept payments.

You can view the charge attempt history in <span class="u-richtext-element">Settings</span> → <span class="u-richtext-element">Plan</span> → <span class="u-richtext-element">Payment methods</span>.

How to pay an outstanding debt

To pay an outstanding debt, add a valid card in <span class="u-richtext-element">Settings</span> → <span class="u-richtext-element">Plan</span> → <span class="u-richtext-element">Payment methods</span>, or open the menu of an already linked card by clicking the three dots and select “Try again”.

Before trying again, make sure the reason for the failed charge has been fixed. For example, check that the card has enough funds, is not blocked, and is allowed for online payments.

Payment methods

The card you added during registration becomes the main payment method for the plan.

In <span class="u-richtext-element">Settings</span> → <span class="u-richtext-element">Plan</span> → <span class="u-richtext-element">Payment methods</span>, you can:

• delete a card;
• add a backup card;
• set another card as the main payment method;
• manually retry a charge if there was a card payment error.

If several cards are added, the system first tries to charge the card marked as the main one. If the charge from the main card fails, the system automatically tries to charge the backup card.

The backup card is used only if the charge from the main card fails.

For example, you can add a new card and set it as the main payment method. In this case, the previous card will become the backup card.