PayNOC is a production-grade payment orchestration platform you deploy on your own infrastructure. Merchants receive money directly into their own accounts — we never hold funds, never take custody, never touch settlement.
curl -X POST https://paynoc.bd/api/public/v1/invoices \
-H "Authorization: Bearer sk_live_..." \
-H "Idempotency-Key: 8f14e45f..." \
-d '{
"amount": 2500,
"currency": "BDT",
"customer_email": "user@example.com",
"redirect_url": "https://shop.com/thanks",
"webhook_url": "https://shop.com/hooks"
}'
→ 201 Created
{
"id": "inv_9f2AkQ",
"status": "pending",
"checkout_url": "https://pay.merchant.com/inv_9f2AkQ",
"expires_at": "2026-07-01T12:15:00Z"
}Why PayNOC
Every module is production-grade. No mock APIs, no placeholders, no fake logic.
Every taka lands directly in the merchant's own bKash, Nagad, Stripe, PayPal, or bank account. PayNOC never touches the money.
Mobile wallets, cards, bank rails, and crypto — merchants configure priority, fees, currency scoping and daily caps per method.
Idempotent endpoints, HMAC-signed webhooks, OpenAPI 3 spec, Postman collection, and full test-mode parity.
Official WordPress, WHMCS and Shopify plugins with one-key configuration. New plugins auto-publish to the docs.
TOTP 2FA, per-key IP whitelists, rate limits, audit trails, row-level security, and signed request logs on every endpoint.
Ship on your own infra with Docker or Coolify. No SaaS pricing, no rate ceilings, no data residency surprises.
How it works
PayNOC orchestrates checkout, verification, and reconciliation — funds settle in the merchant's own account, not ours.
KYC, brand settings, and gateway credentials — the merchant configures which providers to accept.
Your app POSTs to /v1/invoices. PayNOC returns a signed checkout URL you redirect the buyer to.
The buyer pays through the merchant's own gateway. Funds move directly — PayNOC never touches settlement.
An HMAC-signed webhook fires within seconds. Retry queues, idempotency, and event log ensure zero loss.
For developers
Everything is REST + JSON. Test-mode keys, idempotent POSTs, HMAC-signed webhooks with automatic retries, a Postman collection, and drop-in plugins for the platforms you already run.
import crypto from "node:crypto";
app.post("/hooks/paynoc", (req, res) => {
const sig = req.header("x-paynoc-signature");
const ts = req.header("x-paynoc-timestamp");
const raw = req.rawBody;
const expected = crypto
.createHmac("sha256", process.env.PAYNOC_WEBHOOK_SECRET)
.update(`${ts}.${raw}`)
.digest("hex");
if (!sig?.includes(expected)) return res.sendStatus(401);
const event = JSON.parse(raw);
handle(event);
res.sendStatus(200);
});Onboard as a merchant, configure your gateways, and start accepting payments directly into your own accounts — in production, today.