Paymob Payment Provider for Egypt
by TechnoVision · Odoo App
Built on Paymob current Intention API and Unified Checkout. A customer can close the tab, lose signal or edit the return URL, and none of it changes what Paymob charged - the transaction state comes from a signed server-to-server callback and nowhere else.
One-off licence per Odoo instance. The store bills in its own base currency, so checkout may differ by a few cents. That is the add-on price. Installation and support are optional and priced separately.
On the Odoo Apps Store for Odoo 18.0
Security Center
Live82
Score
1.2k
Events / 24h
3
Alerts
Export volume · 14 days
Unusual export detected
res.partner · 4,812 rows · outside business hours
Illustrative UI. Product screenshots to be dropped into this frame.
What it does
A customer can close the tab, lose signal, or edit the return URL by hand. None of that changes what Paymob charged. The return route only chooses which page to show them; the state comes from the signed callback. Treating a redirect as proof of payment is how an order gets confirmed that nobody paid for.
HMAC-SHA512 over Paymob documented twenty-field order, compared in constant time so a forged signature timing reveals nothing. A mismatch is logged and discarded and never touches a transaction. The webhook is a public route - without this, your order is paid would be something a stranger could assert.
Paymob retries. A repeat callback for a transaction already in its final state is ignored rather than reapplied. Refund callbacks are the deliberate exception, because a second refund is a real event rather than a duplicate.
Paymob uses one hostname for both environments and only the key distinguishes them, so this mistake is otherwise completely silent - real cards charged during a rehearsal, or a real customer money sent to the sandbox. The guard exists because you would find out at the worst possible time.
Not marked done at submission. Reporting money as returned to a customer before it actually was puts a false figure in front of whoever reconciles.
All four keys are system-administrator only, enforced by field-level groups. An accountant who can see a transaction cannot see the key that authorises one. No card number, token or billing payload is ever written to a log.
Pricing & Services
The add-on licence is the product. Installation and a support plan are separate, optional, and neither is added to anything unless you choose it. The licence is bought into your own account, so you own it outright whether or not you ever buy a service from us.
The module, bought from the Odoo Apps Store into your own account.
$39
one-off, per Odoo instance · paid to the Odoo Apps Store
Four credentials, a callback URL Paymob can reach, and a sandbox payment before a real one.
$399
one-off · paid to TechnoVision
Twelve months of updates and help with the module, on top of what every licence already includes.
$240
per 12 months · paid to TechnoVision
A support plan adds to what you already have. It never replaces it: defect fixes and help with the module stay free for every licence holder, plan or no plan.
Supported: Odoo 18, Community and Enterprise. Licensed per Odoo instance, with no user limit and no expiry. Prices exclude any tax that applies where you are, and we tell you before you pay if any is due.
Demo
Recorded from a running Odoo 18 with real records. No slides, no mock-ups, and nothing sped up.
Screenshots
3 captures of the shipped product: the provider, in test mode, payment methods, transactions.

The provider, in test mode

Payment methods

Transactions
How it works
Secret key, public key, HMAC secret and card integration ID, all from the Paymob dashboard.
Odoo shows you the exact URL. Without it, payments succeed at Paymob and never appear in Odoo.
It creates a one-piastre intention that is never paid - which exercises the secret key, the integration ID and the account state together, and costs nothing. A credential that is merely well-formed passes a format check and fails here.
Test mode, test keys. The guard will not let a live key anywhere near it.
FAQ
No. There are no Paymob merchant credentials on our development account, so nothing has reached their sandbox or production - not one intention, not one callback. Verified over real HTTP against Paymob documented payload shapes: HMAC verification including tampering, wrong secrets and field-order sensitivity; state derivation; duplicate and late callbacks; refunds; timeouts; connection errors; the live-key guard. Run a sandbox payment before you take a real one.
The current Intention API with Unified Checkout, not the older three-step API-key flow.
The callback is not arriving. Check the Transaction Processed Callback is set in Paymob, that Odoo is reachable over HTTPS, and that no proxy is rewriting the request body - the HMAC is computed over exactly what Paymob sent.
Not yet. Each needs its own integration ID and its own testing, and we do not claim a payment method we have not tested.
No. Paymob supports card tokens, but storing one is a commitment to its lifecycle and to consent handling, and neither is built here - so it is not advertised.
No. Paymob Egypt settles in EGP, so the provider hides itself for other currencies rather than appearing at checkout and failing there.
The module itself, for one Odoo instance, with no user limit and no expiry; every 18.0 release of the module, including security fixes; the module documentation, in the module and on this site; and defect fixes and help with configuration, at no extra cost and with no support plan required. It is a one-off licence for one Odoo instance, with no user limit and no expiry. It does not include installation on your instance, and configuration against your data; changes to the module for your own requirements; migration of the module or your data to another Odoo series; and work on your Odoo, your server, your network, or on other vendors’ modules.
No, and it is not hidden in the price either. Installation and configuration is a separate, optional service at $399 one-off. It covers remote installation on your instance; credential and endpoint configuration for the external service; and compatibility verification against your Odoo version and edition. If you or your partner install Odoo modules already, buy the licence on its own and skip it — most buyers of a module this size do.
Odoo 18, on Community and Enterprise. We do not claim a series until there is a branch for it, its tests pass on that series, and somebody has run it there — so the list on this page is what is actually supported rather than what is planned.
Twelve months of module updates, including security fixes; configuration support by email; priority handling: your ticket is looked at before unpaid enquiries; and help reproducing and reporting a defect, and a fix or a workaround. It runs for twelve months at $240 and is bounded by stated limits rather than by the word "reasonable": Up to 10 support requests in the twelve months; up to 4 hours of remote assistance in total; one Odoo minor-version upgrade of the module, within the same series; response within 2 business days, Sunday to Thursday, Cairo time; and covers the module. It does not cover your Odoo, your server, your network, or work on other modules.. The plan runs for 12 months from the day it starts and then stops. It renews only if you ask us to renew it — nothing renews automatically and no card is stored. It does not cover your Odoo, your server, your network, your backups, or other vendors’ modules; custom development or changes to how the module behaves; migration to another Odoo series — 18.0 to 19.0 is a project, not a ticket; on-site attendance, and work outside the hours below; and anything an external vendor charges for.
No, and this is the line worth being clear about. Defect fixes, at no charge, for the life of the 18.0 series; help when the module does not behave as its description says it does; answers to configuration questions about the module itself; and security fixes, released to everyone whether or not they hold a support plan — all of that comes with the licence, for every buyer, at no extra cost and whether or not a plan is ever bought. A paid plan adds updates, priority over unpaid enquiries and an allowance of assistance hours on top. It never takes anything away.
No, in any of the three options. A change to how a module behaves, a migration between Odoo series, and connecting a system we do not publish a connector for are each their own piece of work, quoted on their own. They are listed as exclusions on the cards rather than left to be discovered: they are the three things buyers most often assume are covered.
Use the buttons in the Pricing & Services section above. Both have a price, so the button takes you to a short form, shows you the total and what it covers before you commit, and creates a numbered order we reply to. No card details are taken on this site, and nothing is added to anything unless you choose it.
Install from Odoo Apps, or talk to us about a guided rollout across multiple companies.