Configuration

Every setting in Paymob Payment Provider for Egypt, and what each one changes.

Accounting → Configuration → Payment Providers → Paymob

Credentials

All four are restricted to base.group_system. Somebody who can read a transaction cannot read the key that authorises one — those are different jobs and the field-level group enforces it rather than a hidden menu.

State: test or enabled

Odoo's own provider state. Use Test first.

The guard that matters

A live key is refused on a test provider, and a test key on a live one.

Paymob uses one hostname for both environments; only the key distinguishes them. Without this check the mistake is completely silent — you would discover it when a real card was charged during a rehearsal, or when a real customer's money went to the sandbox. Both are expensive and neither announces itself.

The callback URL

In Paymob, set Transaction Processed Callback to:

https://your-odoo-domain/payment/paymob/webhook

Two things to get right:

• HTTPS. Paymob will not post to plain HTTP, and the HMAC secret would be travelling in the open if it did.
• Reachable from the internet. A callback that cannot arrive means payments succeed at Paymob and never appear in Odoo.

Test Connection

Creates a one-piastre intention that is never paid.

That is deliberately a real call rather than a format check: it exercises the secret key, the integration ID and the account state together. A credential that is merely well-formed passes a format check and fails here, which is the whole point of the button.

It costs nothing — the intention is never completed.

Currency

EGP only. The provider hides itself for other currencies rather than appearing at checkout and failing there. Paymob Egypt settles in EGP, so offering it for USD would be offering something that cannot work.

What is not configurable

• Mobile wallets, Apple Pay, BNPL. Each needs its own integration ID and its own testing. Adding the field without the testing would be claiming support we have not earned.
• Saved cards. Not built, so not offered.
• Manual capture. An authorisation is recognised on an inbound callback but cannot be captured from Odoo.