PayPulse developer guide
Two REST endpoints, one Apple Shortcut, and a sandbox to test against before you take real money.
Apple Shortcut setup
- Register your phone in the dashboard and copy the device token.
- iPhone → Shortcuts → Automation → + → Message.
- Trigger on Message Contains →
received Tk. Add senders 16247, 16167, 16268, 16216. - Turn Run Immediately on and Notify When Run off.
- Add Get Contents of URL with the request below.
POST https://randomwebfind.xyz/api/payment/webhook Headers Content-Type: application/json x-device-token: <token from your dashboard> Body (JSON) sms → [Shortcut Input] // the full message text battery → [Battery Level] // optional heartbeat
200 OK with ingested: false —
a non-2xx would raise a failure banner on your phone for ordinary junk mail.
Claiming a payment
Transactions land UNCLAIMED. Your checkout claims one
by transaction ID. The call is idempotent, so polling it is safe.
POST https://randomwebfind.xyz/api/payment/verify
x-api-key: <your store API key>
{ "trxId": "8H45KJ2L9M", "orderId": "ORDER-1001", "amount": 2450 }
Still waiting:
{ "ok": true, "settled": false, "status": "AWAITING_SMS", "pollIntervalMs": 2500 }
Settled:
{ "ok": true, "settled": true, "status": "CLAIMED",
"transaction": { "trxId": "8H45KJ2L9M", "provider": "bkash", "amount": 2450 } }
Stop polling when pollIntervalMs is
null. Other terminal states:
ALREADY_CLAIMED, AMOUNT_MISMATCH,
BLOCKED.
Recognised SMS templates
bKash
short code 16247
You have received Tk 2450.00 from 01712345678. Ref 1. Fee Tk 0.00. Balance Tk 12,480.50. TrxID 8H45KJ2L9M at 10/09/2026 06:55
Nagad
short code 16167
Money Received. Amount: Tk 2450.00 Sender: 01712345678 TxnID: 8H45KJ2L9M Balance: Tk 8,210.75. Nagad
Upay
short code 16268
Upay: You have received Tk 2450.00 from 01712345678. TxnID: 8H45KJ2L9M. Balance: Tk 4,905.00
Rocket
short code 16216
Tk 2450.00 received from A/C 01712345678. Fee Tk 0.0. Balance Tk 9,340.00. TxnId: 8H45KJ2L9M. Rocket/DBBL
Security model
The SMS is the source of truth
A customer-submitted transaction ID never settles anything alone. It becomes a payment only when a real message carrying that ID arrives from the provider's short code on your registered device.
One transaction, one order
A globally unique constraint on trx_id means the same transaction can never settle two orders, even if the Shortcut retries on a flaky connection.
Credits only
Outbound sends and cash-outs are parsed and rejected, so paying a supplier from the same wallet can never approve a cart.
Tenant isolation
Every query is scoped by store_id. A transaction belonging to another merchant is reported as "not found", so stores cannot probe each other.
Hashed tokens
Only SHA-256 hashes of session and reset tokens are stored, so a database dump cannot be replayed as a live login.
Full audit trail
The raw SMS body is retained beside the parsed fields, so a disputed order can be traced back to the exact text your phone received.