Accepting Card and Wallet Payments on Your Menu

Why this exists

Most of the "digital menu" pitch in Egypt stops at a guest reading a menu and sending an order over WhatsApp. That gets an order to your kitchen. It doesn't get money into your account before the food goes out, which is the actual friction for anyone running delivery, a kiosk, or a business that's been burned once too often by a cash order that never shows up. menu-MENA's answer is a Paymob integration built on Paymob's classic Accept flow, the same handshake Paymob's own SDKs use: authenticate with an API key, register an order, mint a payment key, then hand the guest a hosted page to pay on.

It's real infrastructure sitting behind the Payments item in your admin sidebar: the checkout route, the credential storage, the webhook verification, all built and live, not a feature waiting on a roadmap.

How a payment actually happens

The flow starts exactly where every menu-MENA order starts: a guest builds a cart on your public menu and sends it as a WhatsApp order. Nothing about that changes.

What's new is what you can do with that order once it lands on your Orders board. If Paymob is connected, a payment icon shows up next to any order that isn't already marked paid. Tap it and menu-MENA:

1. Reads the order's total from what's actually stored on the order, not from anything a request could hand it a different number for.
2. Registers that amount with Paymob under your merchant account.
3. Copies a payment link straight to your clipboard.

You paste that link back into the same WhatsApp thread the order came from. The guest taps it, lands on Paymob's own hosted page, and pays by card or wallet. Your storefront never renders a card field and never touches card data.

The order's payment status updates to "pending" the moment you generate a link, then flips to Paid, Failed, or Refunded once Paymob's webhook reports back. You don't refresh anything to see it change.

Setting it up

Everything lives on the Payments page under Settings, and only the owner account can open it. A manager who tries gets redirected straight back to the dashboard, the same way staff permissions get enforced everywhere else, and this specific gate is checked on the server too, not just hidden from the menu.

You'll need four things off your Paymob dashboard: an API key, an integration ID, an iframe ID, and an HMAC secret. Type them into the matching fields and save. Leave one out at first and menu-MENA still stores what you gave it, but the "enabled" switch stays off until all four are present. There's no half-configured checkout that can accidentally go live.

A "Test connection" button checks that your API key actually works before you commit to anything further. It's deliberately an auth-only check: it doesn't register a dummy order with Paymob on every click, because that would leave junk test orders sitting in your Paymob dashboard every time you poke the button. A test mode toggle sits right next to it, for running the whole flow against Paymob's sandbox before a single real payment goes through.

The page also prints a callback URL, one per restaurant, that you paste into your integration's settings on Paymob's side. That's the address Paymob calls to tell menu-MENA a payment actually went through.

What keeps it honest

A few details worth knowing if you're the type who asks "but what if":

• Every callback from Paymob is checked against your HMAC secret before menu-MENA trusts a single field in it. An unsigned or wrongly signed callback gets a flat rejection and changes nothing.
• The currency charged comes from your own theme settings, not from the order itself, so a tampered order can't quietly switch what currency gets billed.
• If Paymob reports an amount that doesn't match what was requested, the payment gets flagged instead of marked paid. A partial capture or a partial refund never gets rounded up into a false "paid" on your board.
• A payment link stays reusable for about 45 minutes before menu-MENA mints a fresh one, so tapping the icon twice on the same order doesn't register two orders with Paymob.

None of that is visible day to day. It just means the numbers on your Orders board match what actually landed in your Paymob account.

Is this the right fit for you

If your restaurant already runs on cash-on-delivery and a phone call to confirm, this closes a real gap: WhatsApp orders that used to end in "cash when it arrives" can now end in a link that settles before the order leaves the kitchen. If you run entirely in-person with cash at the table, you'll probably never open this page, and that's fine too. It stays off until you turn it on, and nothing about your menu or your ordering flow changes for a restaurant that never touches Payments settings.