Help Center

Found 100 out of 200

Accepting payments in USD and EUR

In addition to shekels, Allpay supports payments in US dollars (USD) and euros (EUR).

Available payment currencies are shown in the Settings ➙ Permissions section.

By default, only payments in shekels are enabled after registration. To accept payments in USD or EUR, a separate permission must be requested.

Before requesting permission to accept payments in foreign currencies

In many cases, accepting payments in shekels is sufficient for a business. However, if your customers are located in Europe, the US, or other countries, it may be more convenient for them to view prices in USD or EUR.

For this purpose, we offer a special feature — currency display conversion. This means the customer will see the payment amount in, for example, euros, but the actual charge will be made in shekels based on their bank’s exchange rate.

No permission is required to use this feature — it is already available.
‍

More details: How to display the payment amount in USD or EUR.

We recommend using this solution in most cases.

Requesting permission to accept payments in foreign currencies

Go to Settings ➙ Modules and activate the “USD & EUR” module.

To activate it, you’ll need to upload a bank letter with the details of your foreign currency account. The letter must:

Be in English
Include the account number in IBAN format
Include your name (or company name) and Teudat Zehut number (or company number)

Examples of bank letters:‍ Discount, Leumi, Hapoalim.

The confirmation letter can be downloaded from your bank's online account or obtained by visiting the bank in person. Letters that do not meet the above requirements will not be accepted.

The letter will be forwarded to the relevant credit company (Isracard or CAL — depending on how your business is connected to the Allpay system) with a request to approve foreign currency operations for your account.

The average approval time is 2–3 weeks.

Allpay cannot guarantee approval for foreign currency transactions; however, we do everything possible to ensure that all our customers receive the necessary authorization.

When a business website has an English version and clearly displays products or services with prices in USD or EUR, it increases the likelihood of approval.

Once the approval is granted, the module status will change to “Active” and you will receive a notification. Please make sure notifications are enabled under Settings ➙ Notifications.

How to accept payments in foreign currency

When creating a payment link, you will see an option to switch the payment currency.

When creating payments via API, you can pass the values "USD" or "EUR" in the currency parameter.

Commission and withdrawals

We do not charge any additional commission for foreign currency payments — standard rates apply.

However, your bank may charge a fee for receiving currency withdrawals. These withdrawals are made via the SWIFT system and go through a chain of three banks: our bank, your bank’s foreign branch, and your bank in Israel. The total fee per withdrawal can reach up to $40. We cannot influence this fee, but you can ask your bank for better terms.

For this reason, withdrawals are made starting from 100 USD/EUR. Any amount below 100 USD/EUR will be carried over to the next withdrawal.

Receipts

According to the law, official receipts (kabalot and heshbonit mas) must be issued in shekels.

Therefore, for foreign currency payments, the service price in the receipt appears in the payment currency, while the VAT amount and total are shown in shekels based on the current exchange rate. We use exchange rates from Google Finance.

If your customer needs a receipt showing the total amount in the original payment currency (not in shekels), a copy can be downloaded from the EasyCount or Morning dashboard.

Keep reading

Profile

Payment links

Documents

3-D Secure

3DS is a technology that adds a layer of security to online payments by requiring the cardholder to confirm the payment in the bank's app or by entering a one-time SMS code.

It is used to protect against fraudulent transactions, helping businesses reduce risks of chargeback requests.

Connecting and configuring

You can activate 3DS and set the minimum payment amount from which it will be applied in the Settings ➙ Modules ➙ 3DS section.

Keep reading

Security

Customer email notification after payment

After payment, customer receives an email notification about the payment. Make sure this feature is enabled in Settings -> Notifications

An email notification by itself is not a receipt.

If you enable integration with the EasyCount electronic receipt system, the receipt will be created automatically, and a button for downloading it will be added to the notification.

Example of email notification

Keep reading

Documents

Integrations

Test Mode

Test mode allows you to test payments without processing real transactions. This mode is typically used by developers during website development.

For API integrations

Test mode is activated separately for each integration in the Settings --> API Integrations section.

The list of test cards is available in the API documentation.

For payment links

‍Test mode is also available for payment links created in the Allpay dashboard.

You can activate it in the Settings --> Payment Links --> Test Mode.

Once activated, all payment links will operate in test mode. Test cards are provided on the payment page.

Test receipts

To generate test receipts in test mode, you need to enter the API keys from the test account of the corresponding service (e.g., Morning or EasyCount) in the module settings.

Keep reading

Integrations

Payment links

API

VAT for payments from abroad

VAT 0% may apply to sales to foreign residents.

According to the law, a foreign resident is defined as an individual who permanently resides outside of Israel or a legal entity registered abroad.

When processing a payment, there is no reliable technical way to determine whether the payer is a foreign resident. Geolocation is unreliable, as an Israeli resident may be abroad at the time of payment.

Since the business is in direct contact with the customer to whom it sells goods or services and reports to the tax authorities, the business is responsible for correctly issuing the tax invoice.

Automatic application of VAT 0%

If a business wants VAT 0% to be automatically applied in invoices, a relatively good method is to rely on the country in which the payer’s card was issued (with the caveat that this method also has exceptions).

Therefore, Allpay provides a function to generate invoices with VAT 0% for payments made with foreign cards. However, for technical reasons, the system can only determine whether a payment was made with a foreign card after the transaction is completed.

Since the tax invoice (heshbonit mas/kabala) is generated after the actual payment, the system will indicate VAT 0% in the invoice, and the service cost will be equal to the final amount.

Example:

Payment with Israeli card:

Service — 100 NIS

VAT — 17 NIS

Total — 117 NIS

Payment with foreign card:‍

Service — 117 NIS

VAT — 0 NIS

Total — 117 NIS

We recommend in payment link settings set VAT mode → included in price and display prices with VAT already included. This will appear more natural to international customers.

VAT collection for foreign cards

If a business does not want to rely on determining foreign residency based on the card’s country, it is necessary to activate the checkbox Charge VAT on foreign cards in Settings → Company. This will apply VAT to foreign cards the same way as to Israeli cards.

Keep reading

Documents

Webhooks

Webhook is an automatic event notification sent by the Allpay system to an external URL.

When a payment is successfully completed, Allpay sends a POST request to the specified address. The request contains full payment details, including the buyer's name, the payment description, and the amount.

Developers and integrators use webhooks to:

automatically trigger actions (e.g. activating an order or sending an email to the customer),
synchronize data between systems,
eliminate the need for manual payment status checks.

Even types

Currently, Allpay supports a webhook for one event only — successful payment.

For subscriptions, the webhook is automatically sent to the specified URL each month after a successful recurring charge.

Where to configure a webhook

A webhook is configured separately for each payment link or API integration:

Payment link — in the settings of that specific link. In this case, the webhook will be sent for every payment made via that link.
API integration — in the settings of a specific integration under the API Integrations section. This allows you to receive webhooks for all payments processed through that integration — for example, from your site on WordPress, or another platform.

Allpay does not have a centralized webhook setting for all payments. This approach gives you flexible control over notifications across different channels.

Webhook request contents

Allpay sends a POST request to the specified URL. The request body is a JSON object containing parameters related to the event.

Example request

POST /tjefkki4vvsvfyhrmudkr571bvjxw5g7 HTTP/2
Host: hook.eu2.make.com
accept: */*
content-type:application/json
content-length: 653

{
    "name": "Test payment",
    "items": "[{\"name\":\"Test payment\",\"price\":10,\"qty\":1}]",
    "amount": "10",
    "status": 1,
    "client_name": "Tanur Mikrogalov",
    "client_email": "test@allpay.co.il",
    "client_tehudat": "",
    "client_phone": "",
    "foreign_card": "0",
    "card_mask": "407517******9285",
    "card_brand": "visa",
    "receipt": "https:\/\/www.allpay.co.il\/receipt.pdf",
    "sign": "2367eefa04752fae489fc233670fce599be9083af8c9a581d4c7684ec33c0114"
}

‍

Each payment for which a webhook was sent is marked with a corresponding label. By clicking on this label, you can view the full contents of the request.

Webhook security

Allpay supports two methods for verifying the authenticity of webhook requests:

Verification using the Webhook secret key

This method relies on an HMAC signature based on the SHA256 algorithm.

Signature generation algorithm:

Remove the sign parameter from the request.
Exclude all parameters with empty values.
Sort the remaining keys in alphabetical order.
From the sorted list, take the parameter values and join them into a single string using a colon (:) as a separator.
Append your Webhook secret key to the end of the string, preceded by a colon.
Apply the SHA256 algorithm to the resulting string.
Compare the result with the sign parameter received in the request.

Platforms like Zapier support this type of verification using built-in tools, such as a custom script in Code by Zapier.

Example JavaScript for Zapier

const webhookKey = "YOUR WEBHOOK SECRET KEY";

// Parse the input params from JSON string to an object
const params = JSON.parse(inputData.params || '{}');

// Store the original signature from the request
const requestSignature = params.sign || null;

// Remove the 'sign' parameter before calculating the signature
delete params.sign;

function getApiSignature(params, webhookKey) {
    // Filter out empty values and sort keys alphabetically
    const sortedKeys = Object.keys(params)
        .filter((key) => {
            const value = params[key];
            return value !== null && value !== undefined && String(value).trim() !== '';
        })
        .sort();

    // Collect the values in sorted key order, process nested arrays (like "items")
    const chunks = [];
    sortedKeys.forEach(key => {
        const value = params[key];
        if (Array.isArray(value)) {
            value.forEach(item => {
                if (typeof item === 'object' && item !== null) {
                    Object.keys(item).sort().forEach(subKey => {
                        const val = item[subKey];
                        if (val !== null && val !== undefined && String(val).trim() !== '') {
                            chunks.push(String(val).trim());
                        }
                    });
                }
            });
        } else {
            chunks.push(String(value).trim());
        }
    });

    // Build the string to hash
    const baseString = chunks.join(':') + ':' + webhookKey;

    // Generate SHA256 hash
    const crypto = require('crypto');
    const hash = crypto.createHash('sha256').update(baseString).digest('hex');

    return { baseString, verifiedSignature: hash };
}

// Generate the signature
const result = getApiSignature(params, webhookKey);

// Return the original and calculated values
output = {
    requestSignature: requestSignature,
    baseString: result.baseString,
    verifiedSignature: result.verifiedSignature
};

‍

Demo of webhook verification on Zapier

‍

IP address verification‍

A simpler but less secure method is to check that the request comes from Allpay’s server IP address. You can request the current IP address by contacting our support team.

Retries and webhook deactivation

Your service must return a 200 HTTP status code to confirm successful receipt of the webhook. If any other status code is returned, the system will attempt to resend the webhook up to three more times. After that, the request will be considered failed and will not be retried.

If Allpay repeatedly encounters delivery errors when attempting to send webhook requests, the corresponding webhook will be automatically deactivated to prevent further attempts.

Keep reading

API

Integrations

Requirements for your website or business page

To accept online payments, you must have a website or a business page on a social network that provides information about your business.

Website Requirements

1 The website content must clearly explain what you sell.

2 Your website must include the following business contact details:

Phone number (or WhatsApp),
Email address
Physical address (city, street, and house number)

If your business does not have a physical address, provide the one listed in your business registration certificate (Ishur Osek Patur/Murshe).

3 Include a Privacy Policy and Terms of Service for selling products or providing services in English or Hebrew.

Privacy Policy template: ENG, HEB

Terms template (product sales): ENG, HEB

Terms template (service provision): ENG‍

These templates are examples. Allpay does not provide legal advice!

The website can be in any language and domain zone, but the Privacy Policy and Terms of Service must be in English or Hebrew.

4 If your business requires licensing, display the relevant licenses and certificates on your website.

Social network page requirements

1 The content must clearly indicate that the social network page is used for business purposes and specify the services or products offered.

2 The page must include easily visible contact details:

Phone number
Email address
Physical address (city, street, and house number).

If requirements are not met

Failure to meet these requirements may result in your request to process payments being denied.

Allpay, like any payment service in Israel, depends on an external regulator for issuing permissions. We do our best to help our clients obtain approval, but this is only possible with your cooperation.

Keep reading

Where to download the payment system commission receipt

In Allpay, there are two types of expenses:

commission on payments
subscription fee

Commission

The commission is deducted from each withdrawal. On the 11th of each month, a link to the commission receipt for all payments from the previous month appears in the Withdrawals tab.