Help Center

Subscriptions are recurring charges from the customer’s card without the need to re-enter card details. In Hebrew, this is called "Oraat Keva", which literally means "standing instruction".

Activate the subscriptions module in the <span class="u-richtext-element">Settings</span> → <span class="u-richtext-element">Modules</span> section.

Creating a subscription

<span class="u-richtext-counter">1</span> When creating a payment link, clock "More" button to expand settings section and change payment type to “Subscription”.

<span class="u-richtext-counter">2</span> Specify when the subscription should start and end, then click the “Create Link” button.

<span class="u-richtext-counter">3</span> Once the customer subscribes using this link, the subscription will appear on the main screen under the “Subs” (Subscriptions) menu.

Subscription start options

Immediately — the first charge will occur at the moment the subscription is created, and then recur on the same day each month.

‍In N days — the first charge will occur after the specified number of days from the subscription start date, and then continue monthly on that same day.“Date” — the first charge will occur on the selected date. If the selected date is in the past, the subscription cannot be created.

‍Day of month — the first charge will occur on the specified day of the month and repeat monthly on that same day. If the selected day matches the subscription start date, the charge will happen immediately. If the 30th or 31st is selected but the month doesn’t have that date, the charge will occur on the last day of the month (e.g., February 28th).

Date — the first charge will occur on the selected date. If the selected date is in the past, the subscription cannot be created.

If the first charge is deferred, the card is not validated when the subscription is created because no authorization request is sent to the issuing bank. As a result, a subscription may be created with incorrect card details, and the error will only be detected when the first charge is attempted. To validate the card immediately, select the “Immediately” option.

Subscription end options

No end date — charges will continue until the subscription is manually canceled in the dashboard.

Date — charges will continue until the selected date. For example, if the end date is set to August 15, 2030, and charges occur on the 16th of each month, the last charge will take place on July 15, 2030, and there will be no charge in August.

After N charges — the subscription will end after the specified number of charges. For example, to create a one-year subscription, set it to 12.

Subscription statuses

<span class="u-richtext-element" style="background-color: rgba(68, 203, 138, 0.5)">Active</span> — charges are being processed successfully.

<span class="u-richtext-element" style="background-color: rgba(113, 124, 144, 0.2)">Completed</span> — all scheduled charges have been successfully processed.

<span class="u-richtext-element" style="background-color: rgba(242, 201, 76, 0.8)">Cancelled</span> — you manually cancelled the subscription charges.

<span class="u-richtext-element" style="background-color: rgba(221, 94, 94, 0.4)">Failed</span> — a charge attempt failed; the system will make up to 6 more retry attempts.

Tracking subscriptions

Charges from subscriptions appear in two sections:

1. On the main payments screen, alongside other payments;
2. In the “Subs” section, where you can view the full charge schedule for each subscription.

Notifications about subscription charges are sent by email and Telegram — just like regular payments — if the notification option is enabled in <span class="u-richtext-element">Settings</span> ➙ <span class="u-richtext-element">Notifications</span>.

Cancelling a subscription

In the settings of the desired subscription, select “Cancel subscription”. The customer will receive an email notification that their subscription has been cancelled.

It is not possible to resume charges on a cancelled subscription. The customer will need to re-subscribe.

Failed charge

A scheduled subscription charge may fail if the card has insufficient funds, the credit limit is exceeded, the card has expired, or it has been cancelled.

If a charge fails, the system will automatically make up to 6 more attempts — one per day. If all attempts fail, the subscription will remain in “Failed” status, and the charge history will include a note: “Subscription stopped”.

In the subscription management menu, a “Retry charge” option will appear, allowing you to manually initiate a new charge. Before retrying, we recommend checking with the customer to make sure their card is working properly.

If, when setting up a subscription with the first charge set to “Immediately”, the first charge attempt fails, for example because the card has insufficient funds, the subscription will still be created with the “Failed” status. The system will then automatically schedule a retry attempt.

Subscriptions vs installments

Since installment payments work only with Israeli credit cards, some businesses use subscriptions to collect payments from international customers in multiple parts.

It’s important to understand the difference: With installments you are guaranteed to receive the full amount — even if the customer’s card has insufficient balance on future dates. With subscriptions, each charge is a separate transaction, and if the card has no funds at the time of billing, the charge will fail.

Life hack: a one-time charge on a future date

A subscription can be used not only for recurring payments but also for a one-time charge scheduled for a future date.

When creating the subscription, select “Date” or “In N days” and specify when the first charge should occur. In the subscription end settings, select “After N charges” and set the value to 1.

The customer enters their card details immediately, but the actual charge is made on the selected date or after the specified number of days. Once this single payment has been completed, the subscription ends automatically, so there is no need to cancel it manually.

This is useful for pre-orders, reservations, or deferred payment for services: you secure the customer and their payment method now and process the payment when needed.

All standard subscription mechanisms still apply: the customer receives a notification when the subscription is created, and if the charge fails on the scheduled date, the system makes six additional attempts—one per day.

A token is an encrypted representation of a customer’s payment card stored in the payment system. The customer enters their card details once, after which they are saved as a token.

Your system can then use this token to process future charges without requiring the customer to enter their card details again. The amount of each charge may vary.

For SaaS services, Allpay’s token API endpoints provide more flexible billing management than the Subscriptions API. Once a card token has been obtained, your system can submit it via the API for each new payment while independently determining the amount, date, and conditions of the charge. This allows you to change pricing plans and implement custom recurring payment scenarios that match your product’s business model.

Therefore, we recommend using the token API endpoints when building billing for SaaS products.

The recommendations below will help you create a simple and intuitive billing management interface.

Consent to future charges

Before the card is saved, the customer must understand the terms of future charges.

Show the price, payment frequency, date of the first charge, and subscription cancellation terms. If the amount may vary, explain how it is calculated.

The customer must explicitly consent to future automatic charges.

Automatic payment retries

If a payment fails, for example due to insufficient funds, set up automatic retry attempts.

We recommend making 5–7 attempts and gradually increasing the interval between them.

Notify the customer about the failed payment and allow them to add funds or update their card before the next attempt.

Manual payment retry

Add a “Retry payment” button so the customer can initiate another charge after resolving the issue.

The button should remain available until the payment is completed successfully or canceled.

Card management

Allow the customer to add a new card, select a primary card, and delete a saved card.

Display only the card brand and the last four digits in the interface.

Attempt to charge the primary card first. If the payment fails, try the backup card. This reduces the risk of service interruption.

Transaction history

Show all successful and failed charges, as well as refunds, in the transaction history.

For each transaction, display the amount, date, and status. For a refund, also show the related original transaction.

Easy subscription cancellation

The subscription cancellation button should be clearly visible and easy to access.

Stop all future charges after cancellation. Do not automatically delete the saved card unless the customer requests it. Provide a separate option to delete the card.

Clear plan information

Show the customer:

• plan name;
• subscription price;
• taxes and fees;
• payment frequency;
• date of the next charge;
• total amount.

The customer should understand what they are paying for, how much they will be charged, and when.

Notifications

Notify the customer about important events:

• an upcoming charge if the amount has changed;
• a successful renewal;
• a failed payment;
• a price change;
• a refund;
• subscription cancellation.

Notifications can be sent by email or through other available channels and can also be displayed in the interface.

To allow customers to choose the quantity on the checkout page, go to <span class="u-richtext-element">Settings</span> ➙ <span class="u-richtext-element">Payment links</span> and enable the <span class="u-richtext-element">Manage quantity</span> option.

After that, when creating a payment link, you can set the minimum and maximum number of units a customer can select, as well as the total quantity available for all customers when paying via this link.

If the minimum number of units is set to 0 (zero), the customer will be able to exclude this item from the payment.

The remaining quantity is shown on the payment link tile. When the stock is depleted (equals zero), the payment link is automatically disabled.

If the total quantity is not set (that is, the customer can select any quantity without limits), an infinity symbol is displayed on the payment link.

Simultaneous purchase of the last item

When multiple customers try to purchase the last remaining items at the same time, the purchase will be successful for the customer who completes the payment first.

For example, if 5 units are left in stock and customer A tries to buy all 5, while at the same time customer B buys 2 units and completes the payment first, customer A will see a message that only 3 units are available.

1. Open this link in Safari: Allpay App
2. Go to your browser's menu and select Share and then Add to Home screen.
3. Save it.

You can change your business type under <span class="u-richtext-element">Settings</span> → <span class="u-richtext-element">Company</span>.

VAT

When changing your status from Osek Patur to Osek Murshe” VAT is added to payments.

For all previously created payment links, 18% VAT will be automatically applied in the “VAT included” mode. The final payment amount will remain unchanged.

This also applies to payments under active subscriptions.

When changing from Osek murshe to Osek patur, VAT will be removed from payment links:

• if the link used the “VAT included” mode, the final payment amount will remain unchanged;
• if the “VAT added” mode was selected, meaning VAT was added on top of the specified amount, the final payment amount will be reduced by the VAT amount.

Documents

For an “esek murshe,” a tax invoice receipt — heshbonit mas/kabala (חשבונית מס/קבלה) — will be issued instead of a standard receipt (קבלה).

If you use an integration with an external accounting service, such as Morning or EasyCount, remember to update the business type in that service as well. Otherwise, the document for the payment may not be created.

3DS is a technology that adds a layer of security to online payments by requiring the cardholder to confirm the payment in the bank's app or by entering a one-time SMS code.

It is used to protect against fraudulent transactions, helping businesses reduce risks of chargeback requests.

Connecting and configuring

You can activate 3DS and set the minimum payment amount from which it will be applied in the <span class="u-richtext-element">Settings</span> ➙ <span class="u-richtext-element">Payment modules</span> ➙ <span class="u-richtext-element">3DS</span>

Frictionless 3DS

Sometimes 3DS authentication takes place in the background and does not require the customer to enter an SMS code or approve the payment in their banking app. During the authentication, the payment page collects technical information about the customer’s device and browser, including the IP address, browser type, language, time zone, screen settings, and other details.

This information is sent to the issuing bank as part of the 3DS process and evaluated together with the card details, payment amount, location, and transaction history. If the bank is confident that the payment is being made by the legitimate cardholder, it authenticates the transaction without requiring any additional action.

To the customer, it looks like a regular payment, but it is still protected by 3DS. If the bank requires further verification, the customer will be asked to confirm the payment using a code or their banking app.

Commission

An additional fee is charged for each payment processed with 3DS, according to the pricing.

The fee is applied even if the payment is unsuccessful — for example, when the cardholder confirms the payment via 3DS, but the bank declines the transaction.

After a successful payment, you can redirect the customer to an external URL or customize the Allpay success page shown to the customer.

Setup

In the payment link settings, expand <span class="u-richtext-element">More</span> section and enable the “Custom success page” block. There you can select one of the following options:

1. ‍Redirect to URL
   ‍Immediately after payment, the customer will be redirected to the specified URL.
2. ‍Custom message and button
   ‍You can set your own heading and text to be displayed to the customer after payment. You can also add a button and specify the URL the customer will be redirected to after clicking it.

API payments

This setting does not apply to payments received via API (from external websites). For those, please refer to the API documentation.

‍

This article explains how to set up webhook notifications for payments.

For payments initiated via the API, Allpay sends a webhook by default in response to the API request. No additional configuration is required.

The setup described below is needed in two cases: if you want to receive webhook notifications for payments created not via the API, but through payment links, or if you need to specify an additional URL for sending webhook notifications as part of your API integration.

What is webhook

Webhook is an automatic event notification sent by the Allpay system to an external URL.

When a payment is successfully completed, Allpay sends a POST request to the specified address. The request contains full payment details, including the buyer's name, the payment description, and the amount.

Developers and integrators use webhooks to:

• automatically trigger actions (e.g. activating an order or sending an email to the customer),
• synchronize data between systems,
• eliminate the need for manual payment status checks.

Even types

Allpay supports webhooks for two events — successful payment and refund.

For subscriptions, the webhook is automatically sent to the specified URL each month after a successful recurring charge.

Where to configure a webhook

A webhook is configured separately for each payment link or API integration:

1. Payment link — in the settings of that specific link. In this case, the webhook will be sent for every payment made via that link.
2. API integration — in the settings of a specific integration under the <span class="u-richtext-element">API Integrations</span> section. This allows you to receive webhooks for all payments processed through that integration — for example, from your site on WordPress, or another platform.

Allpay does not have a centralized webhook setting for all payments. This approach gives you flexible control over notifications across different channels.

Webhook request contents

Allpay sends a POST request to the specified URL. The request body is a JSON object containing parameters related to the event.

Example request

POST /c96zv6ri852dvppncccdg6fxkjnpwojg HTTP/2
Host: hook.eu2.make.com
accept: */*
content-type:application/json
content-length: 453

{
    "name": "Consultation",
    "items": [
        {
            "name": "Consultation",
            "price": 150,
            "qty": 2,
            "vat": "1"
        },
        {
            "name": "Clock",
            "price": 50,
            "qty": 1,
            "vat": "1"
        }
    ],
    "amount": "350",
    "status": 1,
    "client_name": "Tanur Mikrogalov",
    "client_email": "test@email.com",
    "client_tehudat": "123456789",
    "client_phone": "+972 58 569 8877",
    "foreign_card": "0",
    "card_mask": "455743******3431",
    "card_brand": "visa",
    "receipt": "",
    "inst": 1,
    "sign": "83f6fab69f7b237ee2db5d9993b84b5fe89ef722af6206a0ffe64480501f3784"
}

‍

Each payment for which a webhook was sent is marked with a corresponding label. By clicking on this label, you can view the full contents of the request.

add_field parameter

If you add <span class="u-richtext-element">?add_field=any-string</span> to the payment link URL, this parameter will be included in the Webhook request body. Learn more.

Webhook security

Allpay supports two methods for verifying the authenticity of webhook requests:

Verification using the Webhook secret key

This method relies on an HMAC signature based on the SHA256 algorithm.

Signature generation algorithm:

1. Remove the <span class="u-richtext-element">sign</span> parameter from the request.
2. Exclude all parameters with empty values.
3. Sort the remaining keys in alphabetical order.
4. From the sorted list, take the parameter values and join them into a single string using a colon (:) as a separator.
5. Append your Webhook secret key to the end of the string, preceded by a colon.
6. Apply the SHA256 algorithm to the resulting string.
7. Compare the result with the <span class="u-richtext-element">sign</span> parameter received in the request.

Platforms like Zapier support this type of verification using built-in tools, such as a custom script in Code by Zapier.

Example JavaScript for Zapier

const webhookKey = "YOUR WEBHOOK SECRET KEY";

// Parse the input params from JSON string to an object
const params = JSON.parse(inputData.params || '{}');

// Store the original signature from the request
const requestSignature = params.sign || null;

// Remove the 'sign' parameter before calculating the signature
delete params.sign;

function getApiSignature(params, webhookKey) {
    // Filter out empty values and sort keys alphabetically
    const sortedKeys = Object.keys(params)
        .filter((key) => {
            const value = params[key];
            return value !== null && value !== undefined && String(value).trim() !== '';
        })
        .sort();

    // Collect the values in sorted key order, process nested arrays (like "items")
    const chunks = [];
    sortedKeys.forEach(key => {
        const value = params[key];
        if (Array.isArray(value)) {
            value.forEach(item => {
                if (typeof item === 'object' && item !== null) {
                    Object.keys(item).sort().forEach(subKey => {
                        const val = item[subKey];
                        if (val !== null && val !== undefined && String(val).trim() !== '') {
                            chunks.push(String(val).trim());
                        }
                    });
                }
            });
        } else {
            chunks.push(String(value).trim());
        }
    });

    // Build the string to hash
    const baseString = chunks.join(':') + ':' + webhookKey;

    // Generate SHA256 hash
    const crypto = require('crypto');
    const hash = crypto.createHash('sha256').update(baseString).digest('hex');

    return { baseString, verifiedSignature: hash };
}

// Generate the signature
const result = getApiSignature(params, webhookKey);

// Return the original and calculated values
output = {
    requestSignature: requestSignature,
    baseString: result.baseString,
    verifiedSignature: result.verifiedSignature
};

‍

Demo of webhook verification on Zapier

‍

IP address verification‍

A simpler but less secure method is to check that the request comes from Allpay’s server IP address. You can request the current IP address by contacting our support team.

Webhook delivery and retries

Your server must return an <span class="u-richtext-element">200 OK</span> response to confirm successful receipt of a webhook. If any other status is returned, or the request fails due to a timeout or network error, Allpay will automatically retry delivery.

Allpay performs up to 10 delivery attempts in total. The first retry is made 1 minute after the initial failure. Subsequent retries are sent with progressively increasing intervals, with the final attempt occurring within 24 hours of the original request.

If all delivery attempts fail, the webhook will be marked as failed and no further retries will be made.