# Paymob

> Use when integrating Paymob payment processing — creating payment intentions, handling webhooks with HMAC validation, configuring checkout flows (hosted, embedded pixel, mobile SDK), or generating payment links. Covers MENA-region payment methods: cards (Visa/MC/Amex/MADA/OmanNet), digital wallets (Vodafone Cash, Orange Cash, e& money, stcPay, We Pay, Apple Pay, Google Pay), BNPL (Tabby, Tamara,…

- **Type:** Skill
- **Install:** `agentstack add skill-carofi-auto-agent-skills-paymob`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [carofi-auto](https://agentstack.voostack.com/s/carofi-auto)
- **Installs:** 0
- **Category:** [Finance & Payments](https://agentstack.voostack.com/c/finance-and-payments)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [carofi-auto](https://github.com/carofi-auto)
- **Source:** https://github.com/carofi-auto/agent-skills/tree/main/paymob

## Install

```sh
agentstack add skill-carofi-auto-agent-skills-paymob
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Paymob Integration

> **Attribution:** This skill is built on top of the official Paymob LLM knowledge base published at [paymob.com/llms.txt](https://paymob.com/llms.txt). All API knowledge, integration patterns, and flow documentation originate from Paymob's own documentation. Credit and thanks to the Paymob team for making their docs AI-agent-friendly.

Paymob is the dominant payment processor in the MENA region, operating in Egypt, Saudi Arabia, UAE, Kuwait, Oman, Bahrain, Jordan, and Pakistan.

## When this skill activates

- User mentions "Paymob" or references Paymob credentials (`PAYMOB_SECRET_KEY`, `PAYMOB_PUBLIC_KEY`, `PAYMOB_INTEGRATION_ID`)
- User is building payment flows targeting Egypt, Saudi Arabia, UAE, Kuwait, Oman, Bahrain, Jordan, or Pakistan
- User asks about payment intentions, hosted checkout, embedded checkout, HMAC callbacks, or QuickLinks
- User's codebase contains Paymob API calls or SDK initialization

## Non-negotiable rules

These rules apply to every Paymob integration regardless of what the user asks:

1. **HMAC validation is mandatory** — never process a payment callback without first verifying the HMAC signature. A callback without valid HMAC must be rejected.
2. **Backend webhook = source of truth** — the server-to-server webhook callback (after HMAC verification) is the only authoritative signal for payment status. Frontend redirects and SDK callbacks are UX signals only — never use them to confirm order fulfillment.
3. **Amount is always integer cents** — `10000` = 100.00 EGP. Never use floats or strings.
4. **Integration IDs are environment-specific** — test integration IDs only work with test credentials; live IDs only work with live credentials. Mixing them causes silent 404s.
5. **Secret key is server-side only** — never include it in client-side code, browser bundles, or mobile app source. Exposure allows unauthorized charges on the merchant account.

## Before writing any integration code

Read the relevant reference file for the task at hand:

| Task | Reference |
|------|-----------|
| Setting up credentials and environments | `references/authentication.md` |
| Creating a payment / building the intention request | `references/create-intention.md` |
| Choosing and implementing a checkout flow | `references/payment-flows.md` |
| Receiving and validating payment results | `references/webhooks-hmac.md` |
| Debugging a failing integration | `references/error-handling.md` |

## Quick flow selection guide

| Scenario | Flow |
|----------|------|
| Web app, simplest path, max PCI compliance | Hosted Checkout (redirect) |
| Web app with custom embedded UI | Pixel (iframe) |
| iOS or Android native app | Mobile SDK |
| Automated invoicing or WhatsApp commerce | QuickLink API |
| Manual one-off payment links | Payment Links (dashboard) |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [carofi-auto](https://github.com/carofi-auto)
- **Source:** [carofi-auto/agent-skills](https://github.com/carofi-auto/agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-carofi-auto-agent-skills-paymob
- Seller: https://agentstack.voostack.com/s/carofi-auto
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.