ShaplaPay Payment Gateway with bKash for FluentCart

This is an independent plugin by ShaplaPay. It is not affiliated with, endorsed by, or an official product of bKash Limited or the FluentCart team.

This plugin lets a FluentCart store in Bangladesh accept payments through bKash, the country’s largest mobile financial service. When a customer chooses bKash at checkout, they are sent to the secure bKash hosted page, pay with their wallet, and are brought back to the store with the order marked as paid.

How a payment runs

1. The customer places an order and picks bKash on the FluentCart checkout.
2. The plugin opens a payment session with the bKash API and sends the customer to the bKash hosted page.
3. The customer enters their bKash wallet number, the OTP sent to their phone, and their wallet PIN.
4. bKash sends the customer back to the store. The plugin then confirms the payment server side with the bKash Execute and Query APIs and marks the order paid.

The browser return is never trusted on its own: an order is only marked paid after the bKash API reports the transaction as Completed, and the paid amount is checked against the order total.

Features

• Two connection modes, switchable in the gateway settings:
  • API mode – full automatic checkout through the bKash Payment Gateway credentials
  • Manual mode – for stores without bKash API credentials: the checkout shows your bKash wallet number and per-order payment instructions, the customer sends the money from their own bKash app, and you confirm each transfer in the FluentCart order screen, like a cash on delivery order
• bKash tokenized checkout (mode 0011), so guests can pay and no prior bKash agreement is needed
• Sandbox and live credentials, picked automatically from the FluentCart store Order Mode
• Credentials stored encrypted, the same way FluentCart stores Stripe and PayPal keys
• Credentials are verified with bKash before the gateway can be switched on
• Query API fallback when the execute call times out, plus a second check when the customer lands back on the receipt page
• Refunds from the FluentCart order screen through the bKash refund API
• bKash transaction ID written to the order activity log, with the transaction ID and a masked payer wallet number (for example 017****1234) stored on the transaction. Masking is also applied when old rows and the merchant wallet number are shown in the reports screen
• Subscription carts are handled like cash on delivery: the subscription moves to manual billing and each renewal is paid by the customer as a one-time bKash payment

Requirements

WordPress will not activate this plugin unless FluentCart (free) is installed (Requires Plugins):

• WordPress 6.7 or later (FluentCart’s own minimum)
• PHP 7.4 or later
• FluentCart (fluent-cart) 1.6 or newer, active on the same site
• Store currency set to BDT, the only currency bKash accepts
• A bKash merchant account with Payment Gateway credentials (App Key, App Secret, Username and Password) issued during bKash onboarding, needed for API mode only
• HTTPS on the store for live payments, because bKash returns the customer to a callback URL on your site

Manual wallet transfer mode needs no bKash API credentials at all, only your bKash wallet number.

Third-party service and data

This plugin uses the bKash Payment Gateway API, a third-party service operated by bKash Limited in Bangladesh.

During API checkout, the customer enters their bKash wallet number, OTP and PIN on bKash’s own hosted payment page. This plugin never receives or stores the customer’s OTP or PIN. Your server communicates with bKash server to server to create, execute, verify and refund payments.

Transaction details that bKash returns are stored in the FluentCart order records and the order activity log so the merchant can reconcile the payment. This is limited to the bKash payment ID and transaction ID, the amount and currency, the masked payer wallet number (for example 017****1234) where bKash provides it, the settlement time, and refund transaction IDs. The full raw API response is deliberately not stored, so anything bKash adds to its responses later cannot silently end up in your database. In manual wallet transfer mode, the wallet number, amount and order reference shown to the customer are stored, together with the transaction ID the customer submits.

bKash’s own terms and privacy notice govern the information bKash processes:

• bKash Terms and Conditions
• bKash Payment Gateway Terms and Conditions
• bKash Privacy Notice
• bKash Developer Documentation

This is an independent integration by ShaplaPay. It is not developed, endorsed or maintained by bKash Limited or by the FluentCart team.