Hosted checkout
Your logo, your colors, your domain allowlist. Customers never have to type a transaction ID into a form you built by hand.
Guarantee Pay
Confirm the payment when the SMS lands.
Hosted checkout for Bangladesh wallets and gateways — flat plans, your brand, your domain.
What a match looks like
bKash You have received Tk 500.00 from 017•••1234. TrxID 8H2K9X. Ref ORD-1001.
- Sender bKash
- Amount ৳500.00
- Reference 8H2K9X
Completed. Webhook queued to your server.
Three steps
From API call to paid order
-
01
Create a charge
Your server posts the amount, return URLs, and a webhook. Redirect the customer to the hosted checkout on your brand.
-
02
Customer pays
They use a wallet, a gateway API, or a payment link. Personal wallets pay the number you configured.
-
03
Confirm once
The companion app forwards trusted SMS, or the gateway callback arrives. When the facts match, the webhook fires.
Methods you can turn on
Wallets, local gateways, and global rails
-
bKash Personal, agent, merchant, tokenized API -
Nagad Personal, agent, merchant, merchant API -
Rocket Personal, agent, merchant -
Upay Personal, agent, merchant -
Telecash Personal, agent, merchant -
Cellfin Personal and merchant -
tap Personal, agent, merchant -
Pathao Pay Personal, merchant, merchant API -
iPay Personal and merchant -
Ok Wallet Personal, agent, merchant -
mCash Personal, agent, merchant -
SSLCommerz Hosted gateway API -
aamarPay Hosted gateway API -
ShurjoPay Hosted gateway API -
EPS Hosted gateway API -
PayStation Hosted gateway API -
Stripe Card checkout -
PayPal Manual confirm -
Payoneer Manual confirm -
Wise Manual confirm -
Binance Personal wallet -
OxaPay Crypto checkout
A method appears on checkout only after you switch it on and add your own number or API keys. Names are the products you connect — not an endorsement.
What the panel actually does
More than an SMS forwarder
Trusted SMS match
The Android app keeps only configured wallet senders. Unknown messages stay in review. Amount and reference must match.
Links and invoices
Send a payment link or an invoice when there is no storefront. Useful for social-commerce, services, and subscriptions.
Webhooks plus verify
Mark an order paid only when status is completed. If a webhook is missed, call verify-payment with the charge id.
Official APIs too
Tokenized bKash, Nagad merchant API, and aggregators such as SSLCommerz sit beside personal wallets. Use both when a method needs it.
Brands, staff, quotas
Separate brands, staff roles, domain and IP allowlists, and a monthly transaction quota you can see before you hit it.
Security, without the certificate wallpaper
Controls you can check, not badges we invented
We do not claim PCI DSS, ISO, or a central-bank license on this page. Those belong to the card networks and licensed operators you connect. What this panel enforces is listed here.
-
Session and login
Auth cookies are HttpOnly, Secure on HTTPS, and SameSite=Lax, with a one-day life. Sessions are bound to the browser fingerprint. Optional email codes and authenticator apps sit on login.
-
API keys stay on the server
Every private call needs mh-guaranteepay-api-key, and the caller must be on your domain or IP allowlist. Do not put the key in a website or an app.
-
Forged receipts fail
A screenshot is not proof. Completion requires a trusted sender plus a matching amount and reference. CSRF tokens rotate after each validated browser POST.
-
Browser hardening
Responses send HSTS on HTTPS, nosniff, frame protection, a content security policy, and a public security.txt. Asset URLs on this page reject javascript: and off-site hosts.
How this differs
Aggregators, SMS tools, and this panel
| Topic | Typical aggregator | SMS-only tools | Guarantee Pay |
|---|---|---|---|
| Where the money lands | Their settlement account, then yours | Your wallet number | Your wallet, or the gateway you connected |
| Price | About 1.5–2.5% per sale | Monthly fee, wallets only | Flat plan. Gateway fees still apply if you use one |
| Proof of payment | Their callback | Forwarded SMS, often after the customer types a TrxID | SMS match or official API, then webhook and verify |
| Paperwork | Trade license and bank account | A handset is enough | A handset for wallets. Licensed rails still need their own KYC |
Plans from this install
Standard from ৳30. Unlimited from ৳50.
Standard includes 1,000 transactions / month. Need more volume? Unlimited plans start at ৳50 with 5 brands.
Free
৳0 Forever
- 1 allowlisted hosts
- 1 brands
- 100 transactions / month
Standard · 3 Brands · 1 Month
৳30 1 month
- 3 allowlisted hosts
- 3 brands
- 1,000 transactions / month
Standard · 3 Brands · 3 Months
৳80 3 months
- 3 allowlisted hosts
- 3 brands
- 1,000 transactions / month
Standard · 3 Brands · 1 Year
৳300 1 year
- 3 allowlisted hosts
- 3 brands
- 1,000 transactions / month
Unlimited · 5 Brands · 1 Month
৳50 1 month
- 5 allowlisted hosts
- 5 brands
- Unlimited transactions / month
Unlimited · 5 Brands · 3 Months
৳130 3 months
- 5 allowlisted hosts
- 5 brands
- Unlimited transactions / month
Unlimited · 5 Brands · 1 Year
৳500 1 year
- 5 allowlisted hosts
- 5 brands
- Unlimited transactions / month
Scale · 10 Brands · 1 Month
৳100 1 month
- 10 allowlisted hosts
- 10 brands
- Unlimited transactions / month
Scale · 10 Brands · 3 Months
৳260 3 months
- 10 allowlisted hosts
- 10 brands
- Unlimited transactions / month
Scale · 10 Brands · 1 Year
৳1,000 1 year
- 10 allowlisted hosts
- 10 brands
- Unlimited transactions / month
Standard (৳30 line) includes 1,000 transactions / month. Unlimited starts at ৳50. Paid plans activate after a verified payment. Upgrade later from the dashboard if you outgrow a quota.
Developers
One charge call. Then a redirect.
Keep the API key on your server. Whitelist the domain or IP before the first live call. Docs cover verify, webhooks, and the Android app.
POST https://payment.yamin.bd/api/create-charge
mh-guaranteepay-api-key: YOUR_API_KEY
{
"full_name": "Rahim Uddin",
"email_mobile": "rahim@example.com",
"amount": "500",
"currency": "BDT",
"metadata": { "order_id": "ORD-1001" },
"redirect_url": "https://shop.example.com/pay/success",
"cancel_url": "https://shop.example.com/pay/cancel",
"webhook_url": "https://shop.example.com/hooks/guaranteepay",
"return_type": "GET"
}Fee calculator
See a percent cut next to a flat plan
Enter a volume and compare. This is arithmetic, not a quote, and it ignores gateway fees on API methods.
Questions people ask the other sites
Do I need a bKash merchant account?
Not for personal or agent wallets. Those payments land on the number you own. Merchant APIs and licensed aggregators still need their own accounts and keys.
Why does a phone have to stay on?
Only that handset receives the wallet SMS. The app forwards trusted senders and ignores the rest. Official API methods do not need the phone.
Can a customer paste a fake TrxID?
A matching SMS from a trusted sender is required for wallet methods. A typed id alone is not enough, and unknown senders stay in review.
Do you hold the money?
No. Personal-wallet payments go to your number. If you connect SSLCommerz, aamarPay, or a card gateway, settlement follows that provider’s rules.
What should I read before going live?
Create a brand, whitelist your server, keep the API key off the browser, and confirm webhooks on an HTTPS endpoint you control. The docs cover the exact fields.