ডকুমেন্টেশনDocumentation

Nexora Forward Pay is a WordPress plugin that runs a payment gateway on your own website. Customers send money to your own bKash, Nagad, Rocket or Upay number; when the payment SMS arrives on your own phone, the companion Android app Nexora Pay Connect passes it to your site, and the site matches the payment and completes the order by itself.

The money goes straight from the customer's account to yours. Neither we nor anyone else holds it in between, and your payment records stay on your own server.

• Automatic verification. The customer enters the number they pay from; when the SMS arrives the payment is confirmed by itself.
• bKash, Nagad, Rocket, Upay. Personal, agent and merchant numbers, plus bank transfer (which you approve yourself).
• Your own payment page. With your name, logo and colour, in Bangla or English, made for phones.
• WooCommerce. A confirmed payment marks the order as paid. The plugin also works without WooCommerce.
• Payment links and invoices. Share a link or e-mail an invoice.
• Several brands. One installation, separate names, logos, colours, gateways and API keys.
• Charges and limits. A percentage or fixed charge, and a minimum and maximum amount, per gateway.
• Reports and customers. Daily totals, split by method, CSV export, and a way to block a customer.
• API and webhooks. Create and verify payments from another site or your own code.
• Rules against fraud. Balance check, a transaction ID can be used only once, doubtful SMS are held for review.
• Automatic updates. New versions appear on the WordPress Plugins screen and install in one click.

• The money comes straight to you. There is no account in the middle, so there is no waiting for a payout.
• Less checking by hand. Reading the SMS, finding the order and marking it paid is done by the site.
• Easy for the customer. In the main flow there is no transaction ID to type: they enter their number and send the money.
• Your data stays with you. Payments, customers and SMS data are stored in your own WordPress database.
• No commission to us per transaction. You pay for the licence; any charge of the mobile-banking provider applies under their own rules.

There is no iPhone app: iOS does not let any app read incoming SMS.

Licences are sold on the Nexora Forward website. The tier depends on how many domains you run the plugin on; every tier includes every feature.

• A domain is one site address. With or without www is the same domain; a different sub-domain (for example shop.example.com) is a separate domain.
• Current prices and the available terms (monthly, yearly or lifetime) are shown on the purchase page.
• When your payment is confirmed the licence is created automatically. The License Key, the Secret Key are shown on the order's thank-you page and sent to your e-mail address. The plugin and the app are downloaded from the download section of this page while you are logged in.
• A licence stays locked to the domain it was activated on; Deactivate does not free that domain. To move to another site, send the new domain from Nexora Pay → License → Domain Change Request on the old site. Once the admin approves it, activate the licence on the new site with the same License Key and Secret Key. The first change is free; every later change costs 25% of the current package price.

The plugin ZIP and the APK of the Android app are available only to customers who bought Nexora Forward Pay.

1. Log in to this site with the account you bought the licence with.
2. Come back to this page. The Download plugin ZIP and Download the app (APK) buttons appear below; they always deliver the latest version.
3. If you are not logged in, or no purchase is found for the account, a message asking you to contact the admin is shown instead of the buttons.

Both files are for your own use only; do not pass them on. Your licence e-mail also contains a personal download link for the plugin, which works for up to 3 days.

1. In WordPress admin open Plugins → Add New Plugin → Upload Plugin.
2. Choose the downloaded nexora-forward-pay-x.y.z.zip and press Install Now. Do not unpack the ZIP; upload it as it is.
3. Press Activate Plugin. Nexora Pay appears in the left menu.

On activation the plugin creates a few database tables of its own (payments, gateways, SMS, devices and so on). It does not change any other WordPress table.

1. Open Nexora Pay → License.
2. Copy the License key and the Secret key from the e-mail or the thank-you page and paste them in.
3. Press Activate. When the status says Active you are done; the top corner shows "Licence active".

• The plugin checks the licence with the licence server once a day. If the server cannot be reached, the plugin keeps working for up to 7 days after the last successful check.
• When the licence has expired or is not active, new payments cannot be created and the app stops forwarding SMS. Existing payment records stay as they are; everything resumes when the licence is renewed.
• "Product does not match" means a key of another product (for example Nexora Forward Pro) was entered. Use the key issued for Pay.

From version 1.5.0 the plugin looks for new versions by itself. Updates are available to every site with an active licence.

How an update is verified:

• The update information carries our digital signature and is tied to your domain and licence. If the signature does not verify, the plugin ignores it.
• The file is downloaded only from the licence server, over HTTPS. If the SHA-256 checksum of the downloaded file does not match the signed information, nothing is installed.
• WordPress' own updater puts the files in place. Your settings, gateways, payment records and paired phones are not changed by an update.

If automatic updates do not work, download the new ZIP from your account, upload it with Plugins → Add New Plugin → Upload Plugin and choose "Replace current with uploaded". Keeping a backup of your site before larger changes is a good habit.

A gateway is the number or account your customers send money to. Add one under Nexora Pay → Gateways → Add gateway.

• Number / account number: for mobile banking, 11 digits starting with 01. The SIM of this number must be in the paired phone.
• Charge (%) and Fixed charge: added on top of the amount. For example, enter 1.85 to pass the cash-out cost on to the customer. The customer is shown the total including the charge.
• Minimum and Maximum amount: the gateway is not offered for amounts outside these limits. 0 means no limit.
• Display name, Extra instructions, Order: the name and note the customer sees, and which gateway is listed first.
• Brand: a gateway on "All brands" is offered on every payment page.

Nexora Pay Connect must be installed on the phone that receives your payment SMS. Read these steps carefully; most problems come from skipping one of them.

1. Where to get the APK

The app is delivered as an APK file. Log in with the account that bought the licence and use the "Download the app (APK)" button in the download section of this page. If the button is not there, contact the admin (support@nexoraforward.com). Do not install an APK from any other website, group or person.

2. If Google Play Protect blocks it

Google Play Protect may warn about, or block, an app that is installed from outside the Play Store and asks for SMS access. That is Google's general policy, not something specific to this app. Depending on the phone and region you may see "More details → Install anyway", or the installation may be blocked outright. If it is blocked, use one of these two ways.

3. "Allow restricted settings" (Android 13 and newer)

From Android 13, granting SMS access to an app that was installed from outside the Play Store can show a "Restricted setting" message. Then:

1. Close the message.
2. Open Settings → Apps → Nexora Pay Connect.
3. Tap the three-dot menu (⋮) in the top right corner, choose Allow restricted settings and confirm with your PIN or fingerprint.
4. Go back to the app and grant the permission again.

The menu entry usually appears only after you have tried to grant the permission once and seen the "Restricted setting" message.

4. The SMS permission, and why it is needed

The app asks for one sensitive permission: receive SMS (RECEIVE_SMS). Its only job is to pass a payment SMS to your site the moment it reaches the phone; automatic verification is not possible without it. The app does not read the phone's existing inbox and cannot send SMS. Which messages are forwarded is described under "What the app sends" below.

5. The notification permission

To stay alive the app shows one silent, permanent notification ("Processing messages in the background"). On Android 13 and newer it asks for the notification permission for that; please allow it. The notification makes no sound, and while it is shown the phone is far less likely to shut the app down.

6. Battery and autostart settings

Many phones close background apps to save battery; SMS then arrive late at your site, or not at all. Use the app's Open battery settings button to exclude the app from battery optimisation, then set the following for your phone brand. Menu names differ a little between versions.

7. Never force-stop the app

• After a Force stop, Android no longer delivers SMS to the app until you open it again yourself. "Cleaner" and "booster" apps do the same; exclude the app from them.
• After a restart of the phone the app should start by itself (that is what the autostart permission is for). Open it once after a restart and check that it says "Connected".
• Keep the phone charged and online, and keep date and time on "automatic". The site rejects requests when the phone's clock is more than 5 minutes off.

1. On the site open Nexora Pay → SMS & Devices → Devices and press Show QR code.
2. On the phone open Nexora Pay Connect, tap Scan QR code and scan the code on the screen. If you prefer not to use the camera, copy the text below the code and paste it into the app.
3. When the app says Connected, grant the SMS permission and set the battery settings (see the section above).
4. Tap Send test ping. When the top corner of the site shows "Phone online", the connection works.

• The QR code works once and expires after 10 minutes. Treat it like a password; do not send anyone a screenshot or photo of it. If someone else may have seen it, press Refresh QR code.
• If the site has no active licence, the app does not pair and tells you so.
• If you change or lose the phone, press Disconnect or Remove in the site's Devices list; nothing is accepted from that phone any more.
• The site shows when the phone was last in contact. The app sends a small signal about every 15 minutes; after about 20 minutes without one the phone is shown as "offline".

1. Open WooCommerce → Settings → Payments.
2. Enable Nexora Forward Pay, then press Manage and enter the title and description shown in the checkout.
3. Place a test order, send a small amount and check that the order moves to "Processing" or "Completed" by itself.

• The method is offered in the checkout only while the licence is active and at least one gateway is switched on.
• After placing the order the customer is taken to the payment page; when the payment is confirmed the order is marked as paid and the order note records the method and the transaction ID.
• If the paid amount does not match the order total, the order is put "On hold" so that you can check it yourself.
• WooCommerce High-Performance Order Storage (HPOS) is supported.

1. They choose a method. The payment page lists the gateways you switched on (bKash, Nagad, Rocket, Upay, bank).
2. They enter their own number. The 11-digit number they will pay from.
3. They send the exact amount. The page shows your number, what to do (Send Money, Cash Out or Payment) and the total including any charge. The customer sends exactly that amount from that number.
4. It is confirmed by itself. The page waits. When the SMS reaches your phone the payment is confirmed and the customer is sent back to your site. This usually takes a few seconds to a few minutes.

• A wrong amount: matching by number needs the exact amount, so the payment is not confirmed automatically. With a transaction ID, the SMS amount is accepted when it is equal to or higher than the amount due (you can require "exactly" in the settings). A lower amount is not accepted; you decide what to do with it.
• Bank: the customer submits the reference number; you are notified by e-mail and approve it yourself under Nexora Pay → Payments.
• An opened but unpaid payment page is cancelled after a set time (60 minutes by default).

The Payments screen keeps the full history of every payment. From there you can complete a payment by hand (with a reason), cancel it or mark it as refunded. Marking as refunded only changes the record; you send the money back yourself from your mobile-banking app.

Use the API to take payments from another site, a mobile app or your own code. Keys are created under Nexora Pay → Developers → API Keys; full examples are under Developers → Integrations & Docs.

• When a payment is completed, a JSON POST is sent to your webhook_url. It carries the headers X-NFP-Timestamp and X-NFP-Signature (HMAC-SHA256 with the webhook secret). A failed delivery is retried a few times.
• Even after a webhook, confirm the status with /verify before you deliver goods or services.
• An API key and its webhook secret are shown only once. The site stores only a hash of the key; the secret is stored encrypted. A key can read only the payments it created.

Next to mobile banking, the same payment page can offer cards (Visa, Mastercard, Amex), PayPal and local online gateways. Card numbers never touch your site: the customer pays on the provider's own secure page and comes back to your site afterwards.

1. Open Nexora Pay → Setup → Gateways → Add gateway.
2. Pick Card (Stripe), PayPal, SSLCommerz or aamarPay under Provider. The account type switches to "Online gateway" by itself.
3. Under Online gateway credentials, set Mode: Sandbox (test) for testing, Live for real money. For Stripe the mode is read from the key.
4. Fill Client ID / Store ID and Secret key / Store password from the table above.
5. If your site currency is BDT and you charge PayPal (or any provider) in another currency, enter it under Charge in currency (for example USD) and how many Taka make 1 unit under Exchange rate (for example 122).
6. Set a Display name (for example "Visa / Mastercard"), a logo and, if you like, a Charge (%), then press Save and test connection. A green message means the credentials work.

• No webhook or IPN URL has to be entered in the provider's dashboard. When the customer returns, the plugin asks the provider's API for the result itself, and open online payments from the last 2 days are re-checked regularly in case someone closed the browser half-way.
• The return address is your home page (https://your-site/?nfpay_online=…). If a provider asks for an allowed return URL, give your site's domain.
• A gateway is shown on the payment page only when its credentials work and the payment currency matches the site currency.

A method with no SMS or API is added as a Bank transfer type gateway. The customer sends the money and enters a reference number or uploads a deposit slip, and you check and approve it.

1. Open Setup → Gateways → Add gateway and set Provider = Bank transfer.
2. Enter the account number under Number / account number, and Bank name, Account holder and Branch / routing under Bank details.
3. Under Bank verification, turn on Allow deposit slip (images up to 5 MB) if you want. If your bank sends an SMS for incoming money, fill SMS sender IDs and Last digits of the account in the SMS and matching payments confirm themselves.
4. Unique amount shows each payment a slightly different total, so two deposits of the same price are easy to tell apart.
5. Payments sent with a reference or slip wait under Money → Payments; check them and press Complete.

Verifying bank deposits automatically (for example DBBL, 16216)

Mobile banking is verified by the customer's number. A bank SMS usually does not name the payer, so a bank deposit is matched by the amount, the end of your account number and the time:

1. The SIM in the paired phone must receive your bank account's SMS alerts (DBBL alerts come from 16216).
2. Under the gateway's Bank verification, pick the bank under Preset, or type it under SMS sender IDs (DBBL: 16216).
3. Enter the account number under Last digits of the account in the SMS (the whole number or at least the last 3-4 digits). However the SMS masks it (163***8660), the trailing digits are compared. This is required for DBBL, because Rocket SMS also come from 16216: only an SMS naming your account counts as a bank deposit, anything else is treated as Rocket.
4. Turn on Unique amount with 9 as the Largest offset. When two customers order the same price at the same time, the second is shown a total a few Taka different (for example 6,840 and 6,843), so each deposit can be told apart. Below 1 the offset is in paisa, which is awkward for cash deposits.
5. The payment waits for the Waiting time for the SMS (for example 60 minutes). If the customer deposits within it, the payment completes by itself when the bank SMS arrives.

• A payment completes by itself only when exactly one waiting payment has the credited amount. If several fit, or none, the SMS goes to review under SMS & Devices for you to match by hand.
• When both the SMS and the customer give a reference, they must match. A payment with a slip or reference does not expire; it waits for your decision.

Adding Payoneer

Payoneer has no API connection here; run it as a hand-checked method:

• Provider = Bank transfer, Display name = Payoneer, with the Payoneer logo.
• Put your Payoneer account e-mail or receiving account number in Number / account number.
• Explain how to pay under Extra instructions (for example "Send to this e-mail from Payoneer, then enter the Transaction ID").
• Complete the payment by hand once the money is in Payoneer. As it is usually taken in USD, set a Minimum amount.

Take money from service, order, admission or booking forms without WooCommerce. As soon as the form is submitted the customer goes straight to the Nexora Pay payment page. Supported: Contact Form 7, WPForms, Elementor Pro Form, Gravity Forms, Fluent Forms.

1. Open Nexora Pay → Integrations → Forms & Pay button and press Connect a form.
2. Pick the Form plugin and enter the Form ID:
   • Contact Form 7: the id in [contact-form-7 id="…"] (the number or the 7-character code both work).
   • WPForms, Gravity, Fluent: the form ID.
   • Elementor: the Form Name of the Form widget.
3. Amount: if every submission costs the same, choose Fixed amount and fill Fixed amount (BDT). If the price or package comes from the form, choose From a form field and put that field's name/ID/label in Amount field. "1,500 Tk" and Bangla digits are read too.
4. Fill Name field, E-mail field and Phone field with the form's field names (for example your-name, your-email, your-phone in CF7).
5. Set the Payment description, where to go after paying (After payment go to) and the Brand, tick On and save.
6. Test it once: if the payment page opens after you submit, the connection works.

• The form entry number is stored with the payment (visible under Money → Payments), so you can tell which entry has paid. The form plugin's own entry list does not show "Paid".
• Developers can hook their own steps (e-mail, CRM) into nfp_form_payment_created and nfp_payment_completed.

Pay button (no form)

Place it on any page, post or Elementor Shortcode widget:

[nexora_pay_button amount="500" label="Pay 500 Tk" description="Consultation fee" success_url="https://your-site/thanks/"]

The amount is digitally signed, so a visitor cannot lower it in the browser. brand and class attributes are available too.

Creating a payment link

1. Open Nexora Pay → Money → Payment Links → New payment link.
2. Enter a Title, Description and Brand. Choose Fixed amount for a set price, or The customer decides (with an optional Minimum / Maximum).
3. Tick Active, press Create payment link, then Copy link. It looks like https://your-site/?nfpay_link=….

Name, e-mail and phone can be filled in through the link: ?nfpay_link=…&name=Rahim&email=a@b.com&phone=017…. Open-amount links also accept &amount=1500. Send the link on Facebook, WhatsApp, e-mail or SMS.

Calendly

1. In Calendly, open the Event type and go to Booking page options → Confirmation page.
2. Choose Redirect to an external site and paste the payment link.
3. Tick Pass event details to your redirected page. The invitee's name and e-mail (invitee_full_name, invitee_email) are then filled in on the payment page.

Amelia, Bookly and other booking plugins

These plugins can take payment through WooCommerce. Turn on their WooCommerce payment option; with the Nexora Pay gateway on in WooCommerce (WooCommerce → Settings → Payments → Nexora Pay) the booking checkout offers bKash, Nagad, cards and the rest. Without WooCommerce, use a payment link on the booking confirmation.

Orders from your Shopify store can be paid to your own bKash / Nagad / Rocket numbers, checked automatically from the SMS, and turn Paid in Shopify by themselves. No WordPress needed: with only a Shopify store, install Nexora Pay Standalone on a subdomain of any PHP hosting.

How it works

Shopify does not run outside code, so Nexora Pay runs on your own hosting (for example pay.your-domain.com). That is your "payment server": it holds your numbers, talks to the phone app and shows the payment page. Shopify and Nexora Pay are linked by a Shopify app's Client ID / Client secret.

1. The customer picks bKash / Nagad / Rocket (Nexora Pay) at the Shopify checkout. The order waits as "Payment pending".
2. The order confirmation e-mail carries a Pay now button.
3. The button opens your Nexora Pay payment page; the amount comes from Shopify.
4. The customer sends the money; the Nexora Pay app on your phone matches the SMS and confirms the payment.
5. Nexora Pay marks the order Paid in Shopify.

What you need

Step 1: Install Nexora Pay Standalone (when you have no WordPress)

The example uses Hostinger; cPanel names are almost the same.

1. Subdomain: hPanel → Websites → Create site → PHP/HTML website → type a subdomain such as pay.your-domain.com → pick the suggestion → Next. (cPanel: Domains → Create a new domain.)
2. Upload: Upload website files → Next → Upload nexora-pay-standalone-x.zip → Create website. Hostinger unpacks the files into the subdomain's root, so the address is https://pay.your-domain.com. (With cPanel's File Manager upload + Extract, the address is https://pay.your-domain.com/nexora-pay.)
3. Database: Websites → (subdomain) → Databases → Management → enter a Database name and Username (e.g. nxpay), a strong Password → Create. The list shows the full names, such as u123456789_nxpay; you need those next. Note the password.
4. Install: open https://pay.your-domain.com/install.php. Enter Database host localhost, the full Database name and Database user (u123456789_nxpay), the Database password, Business name, Time zone Asia/Dhaka, an admin Username, E-mail and Password (8+ characters) → Install Nexora Pay. On "Installed" press Open the admin panel.
5. Log in at https://pay.your-domain.com/admin.php.
6. Licence: Activate licence on the dashboard (or License) → paste the License key and Secret key → Activate. "Licence active" turns green.
7. Gateway: Gateways → Add gateway → Provider (bKash / Nagad / Rocket / Upay), Account type (Personal / Agent / Merchant), number (01XXXXXXXXX), Display name → Add gateway.
8. Phone: SMS & Devices → Connect app shows a QR code; scan it with the Nexora Pay app. "Phone online" appears.
9. For safety delete install.php from the server, and set up SMTP e-mail and the 5-minute cron on the Standalone page.

Step 2: Payment method in Shopify

1. Shopify admin → Settings → Payments → Manual payment methods → + Manual payment method → Create custom payment method.
2. Custom payment method name: bKash / Nagad / Rocket (Nexora Pay). The word Nexora must be in the name (the e-mail button looks for it).
3. Additional details (shown at checkout), e.g. "Pay with bKash, Nagad, Rocket or Upay. After the order a payment page opens and the payment is verified instantly."
4. Payment instructions (shown after the order), e.g. "Press Pay now in the e-mail to complete the payment. The order turns Paid by itself."
5. Press Activate.

Step 3: Create the Shopify app and get the Client ID and Client secret

Since 1 January 2026 Shopify no longer allows new "Develop apps" apps; use the Dev Dashboard.

1. Shopify admin → Settings → Apps → Develop apps → Build apps in Dev Dashboard (or dev.shopify.com/dashboard with the same Shopify login).
2. Create an app → App name: Nexora Pay.
3. App URL: your Nexora Pay address (e.g. https://pay.your-domain.com). Untick Embed app in Shopify admin.
4. Scopes: read_orders,write_orders.
5. Top right Create app → Release.
6. In Apps, the ⋮ next to Nexora Pay → Install app → pick your store → Install. ("This app hasn't been reviewed" is shown; it is your own app.)
7. App → App settings → copy the Client ID and Client secret. Never share the Client secret.

Step 4: Connect Shopify in Nexora Pay

1. Nexora Pay admin → Integrations → Shopify (Standalone: admin.php?page=nexora-pay&tab=forms&sub=shopify).
2. Shop domain: your-store.myshopify.com (shown under the store name in Shopify Settings).
3. Paste the Client ID and Client secret. Leave Legacy access token empty.
4. Tick Shopify connection on → Save and test. "Saved. Connected to "your store" (currency BDT)" means it works. Nexora Pay fetches and renews the 24-hour token itself.

Step 5: Pay now button in the order e-mail

1. Shopify admin → Settings → Notifications → Customer notifications → Order confirmation → Edit code.
2. In Email body (HTML) find (Ctrl+F): <p>{{ email_body }}</p>
3. In Nexora Pay admin → Integrations → Shopify, the "Order e-mail snippet" box holds the code made for your site (your address and secret key already filled in). Press Copy snippet.
4. Paste it on the next line in Shopify without changing anything. The code below only shows the shape; your admin has your real 32-character key where it says SECRET.
5. Press Save. "Notification template saved" appears.

{% comment %} Nexora Pay - Pay now button {% endcomment %}
{% assign nx_gw = payment_gateway_names | join: "," %}{% for t in transactions %}{% assign nx_gw = nx_gw | append: "," | append: t.gateway %}{% endfor %}
{% assign nx_id = order.id | default: id %}
{% if nx_gw contains "Nexora" and financial_status != "paid" %}
<p style="margin:18px 0;"><a href="https://pay.your-domain.com/?nfpay_shopify={{ nx_id }}&k={{ nx_id | append: "|SECRET" | md5 }}" style="display:inline-block;background:#E2136E;color:#fff;padding:12px 22px;border-radius:8px;text-decoration:none;font-weight:bold;">Pay now - bKash / Nagad / Rocket</a></p>
{% endif %}

• The word "Nexora" must be in the step 2 method name; orders paid another way get no button.
• No button once the order is already paid.
• The k= part is a hash of the order number and your secret key, which stays on your server, so nobody can open the payment page for someone else's order. It needs no customer e-mail or phone, so it works without Shopify's "protected customer data" permission.
• If the old code (with nx_mail) is in place, replace it with the new one. Old links keep working for a while.

Step 6: Test order

1. Order a cheap product in your store with bKash / Nagad / Rocket (Nexora Pay).
2. Press Pay now in the confirmation e-mail: your Nexora Pay payment page opens with the amount from Shopify.
3. Pay. When the phone app receives the SMS the payment is Completed and the Shopify order turns Paid.
4. Without e-mail: Shopify Orders → Create order → product and customer → tick Payment due later → Create order, then on the order page use More actions → Resend confirmation to your own e-mail and press Pay now.
5. No TrxID needed: the customer enters the number they pay from; when the SMS arrives the number and amount are matched and the payment completes by itself. The TrxID field is optional.

Troubleshooting

• One Nexora Pay = one Shopify store. Every merchant runs their own Nexora Pay (own licence, numbers and phone) with their own Client ID / secret; nothing is shared.
• Do not connect one store to two Nexora Pay installs; switch "Shopify connection on" off in the old one.
• Every attempt to mark an order paid, successful or not, is written to Security → Activity log.

1. In WordPress, create a key under Nexora Pay → Developers → API Keys (Label: "WHMCS"). Copy the API key (nfp_live_…) and Webhook secret (whsec_…) now; they are not shown again.
2. Under Integrations → Other platforms → WHMCS gateway module, press Download to get whmcs-nexorapay.zip.
3. Unzip it and put both files at the same paths in your WHMCS root: modules/gateways/nexorapay.php and modules/gateways/callback/nexorapay.php.
4. In WHMCS admin, turn on Nexora Pay under Setup → Payments → Payment Gateways → All Payment Gateways.
5. Enter the Nexora Pay site URL (your WordPress site), the API key and the Webhook secret, and save.

From then on, Pay now on an invoice takes the customer to the Nexora Pay payment page, and a confirmed payment marks the invoice Paid in WHMCS. The module sends its own callback address (…/modules/gateways/callback/nexorapay.php), so nothing has to be entered in WordPress.

1. As with WHMCS, create a key under Developers → API Keys and copy the API key and Webhook secret.
2. Download the aMember plugin file nexorapay.php from Integrations → Other platforms and put it at amember/application/default/plugins/payment/nexorapay.php.
3. In aMember admin, enable Nexora Pay among the payment plugins under Setup/Configuration → Plugins.
4. Enter the Nexora Pay site URL, API key and Webhook secret in the plugin settings and save.

• BDT and USD are supported. Each payment is one-off (not recurring/auto-renew). This connection is still BETA.
• The plugin sends its own IPN address; access is granted only after the signature (X-NFP-Signature) and the amount check out.

Nexora Pay works even when your site is not WordPress. Nexora Pay Standalone is the same Nexora Forward Pay without WordPress: it runs in one folder on your own hosting (self-hosted), with its own database and its own admin panel. Same licence, same Android app (APK), same payment page, same API. Use it with a custom PHP site, Laravel, CodeIgniter, a plain PHP script, Shopify, WHMCS or aMember.

You need

• PHP 7.4 or newer (curl, openssl, mbstring, mysqli; zip for one-click updates). Normal cPanel hosting has all of these.
• One empty MySQL / MariaDB database.
• HTTPS (SSL): the phone app only connects to https addresses.
• The Android phone that receives the payment SMS.

Set-up, step by step (10 minutes)

1. Get the Standalone ZIP and the APK from the download section of this page (logged in with the account you bought with).
2. cPanel → File Manager: upload the ZIP to public_html and extract it. Rename the nexora-pay folder to pay if you like; the address becomes https://your-site.com/pay. A sub-domain (e.g. pay.your-site.com) works too.
3. cPanel → MySQL Databases: create a database and a user, and give the user ALL PRIVILEGES on it.
4. Open https://your-site.com/pay/install.php, enter the database details, your business name and an admin username / password → Install.
5. Log in at https://your-site.com/pay/admin.php. You get the full Nexora Pay panel, as in WordPress.
6. License: enter the License Key and Secret Key from your purchase e-mail and activate. The licence is bound to this domain.
7. Gateways: add your bKash / Nagad / Rocket / Upay numbers (personal, agent or merchant).
8. SMS & Devices → Connect app: install the APK on the phone and scan the QR code from the app. When the phone shows online, it is connected.
9. Standalone: set up SMTP (your hosting mail or Gmail) and press Send test; in cPanel → Cron Jobs add, every 5 minutes: php /home/USER/public_html/pay/cron.php.
10. Delete install.php from the server.

Connect your website

1. Developers → API Keys → Create key: copy the key and the webhook secret (shown once).
2. Download the PHP SDK under Developers → Integrations & Docs, put it on your site and fill in config.php with the Standalone folder address (e.g. https://your-site.com/pay), the key and the secret.
3. At checkout create a payment and send the customer to the payment page; on the return page and in the webhook confirm with isPaid() before marking the order paid (code in "PHP SDK" below).

• No code: create a link under Payment Links and put it on any "Pay now" button.
• Shopify: Integrations → Shopify. Full step-by-step guide: Shopify stores.
• WHMCS / aMember: put the Standalone API address in the module's "site URL" field (shown under Standalone → System check, e.g. https://your-site.com/pay/api/nfpay/v1).
• Other languages (Node, Python, .NET, mobile apps): POST to /checkout and /verify on the same API address with the header X-NFP-API-KEY.

Addresses

Updates and security

• When a new version is out: License → Updates → Install update now. It is downloaded from the licence server, its checksum is verified, and the previous version is kept in an nfp-backup-… folder. Data and settings stay as they are.
• config.php holds the database password and NFP_SA_SALT (saved secrets are encrypted with it). Back it up and never change the salt.
• Forgot the password: on the server run php reset-password.php username newpassword.
• Apache / LiteSpeed use the included .htaccess. On nginx see nginx.conf.sample in the ZIP.

To take payments from Laravel, CodeIgniter, your own PHP site or any other platform, use NexoraPay.php (PHP 7.4+, no dependencies), found under Integrations → Other platforms. From other languages (Node, Python, mobile apps) call the REST API directly; see "API and webhooks" above.

require 'NexoraPay.php';
$pay = new NexoraPay('https://your-site.com', 'nfp_live_…', 'whsec_…'); // WordPress site, or the Standalone folder (https://your-site.com/pay)

// 1. Create a payment and send the customer to it
$res = $pay->create([
  'amount' => 1500, 'full_name' => 'Rahim', 'email' => 'rahim@example.com', 'phone' => '017…',
  'description' => 'Order #1001', 'metadata' => ['order_id' => 1001],
  'redirect_url' => 'https://shop.example.com/paid', 'cancel_url' => 'https://shop.example.com/cart',
  'webhook_url' => 'https://shop.example.com/nexora-webhook.php',
]);
header('Location: ' . $res['payment_url']);

// 2. In the webhook file
$body = file_get_contents('php://input');
if ($pay->validWebhook($body, $_SERVER['HTTP_X_NFP_TIMESTAMP'], $_SERVER['HTTP_X_NFP_SIGNATURE'])) {
  $data = json_decode($body, true);
  $p = $pay->verify($data['invoice_id']);
  if ($p['status'] === 'COMPLETED') { /* mark the order paid */ }
}

• After paying, the customer returns to redirect_url with ?invoice_id=…. Never deliver on the return alone; confirm COMPLETED with verify().
• A failed webhook is retried after 4, 16, 64 and 256 minutes. Use Developers → Webhooks → Send a test webhook to try it.

Where it goes: everything goes only to your own site, over HTTPS, signed with the phone's key. The app sends nothing to Nexora Forward or to any other third-party server.

Rules for using it

• Use the app only with your own SIM and your own phone. Installing it on someone else's phone without their knowledge is forbidden and illegal.
• Receive money only to accounts that you own and are allowed to use for business.
• Keep the phone secure: use a screen lock, do not install unknown apps, do not hand the phone to others. Whoever holds the phone may also be able to reach your mobile-banking account.
• Keep only mobile-banking senders on the allow-list. If you add other senders, their messages are sent to your site too.
• Use a licence on as many domains as it was bought for, and no more.
• Protect your WordPress admin account with a strong password and, where possible, two-step login; what an administrator can see includes the SMS text.

Details: Privacy Policy and Terms & Conditions.

If you cannot solve it, write to us: support@nexoraforward.com. To get help quickly, tell us:

• the site address, the plugin version and the app version;
• the phone's brand, model and Android version;
• what you did and what happened, with a screenshot if possible.