Every released version, what changed in it, and the date it went out. This page is generated from the module’s own changelog, which is the same file shipped inside technovision_paymob and rendered on its Odoo Apps Store listing.
A verification status section on the Apps Store listing, stating plainly that no payment has ever been taken through this module, and separating what is verified over real HTTP from what is verified in shape only and what is not verified at all. The README said so; the listing — which is where a buyer decides — did not.
Documentation shipped with the module: installation, configuration, user guide, FAQ, troubleshooting and security.
Three screenshots on the listing, captured from a running Odoo 18 instance: the provider in test mode, its credentials tab with every key masked, and the payment-method configuration.
18.0.1.0.0
Notes
First release.
Added
Paymob's current Intention API and Unified Checkout, not the older three-step API-key flow.
Website checkout, portal invoices and portal quotations.
The callback decides the outcome, never the browser return. A customer can close the tab, lose signal or edit the return URL; none of that changes what Paymob charged. The return route only chooses which page to show.
HMAC-SHA512 verification over Paymob's documented twenty-field order, compared with hmac.compare_digest. An unverified callback is logged and discarded, and never touches a transaction — the webhook is a public route, so without this "your order is paid" would be something a stranger could assert.
Repeat callbacks ignored rather than reapplied, so Paymob's retries cannot confirm an order twice. Refund callbacks are the deliberate exception, because a second refund is a real event.
Partial and full refunds, left pending until Paymob confirms them: reporting money as returned before it was is worse than waiting.
All four credentials restricted to base.group_system, so an accountant who can see a transaction cannot see the key that authorises one.
A guard refusing a live key on a test provider and vice versa — Paymob uses one hostname for both environments and only the key distinguishes them, which makes the mistake silent and expensive otherwise.
Timeouts on every outbound request. No card number, token or billing payload is ever written to a log.
Test Connection creates a one-piastre intention that is never paid, exercising the secret key, the integration ID and the account state together at no cost — a credential that is merely well-formed passes a format check and fails here.
Deliberately not included
Mobile wallets, Apple Pay and BNPL. Each needs its own integration ID and its own testing.
Saved-card tokenisation. Storing a token is a commitment to its lifecycle and to consent handling, and neither is built.
Manual capture. An authorisation is recognised on an inbound callback but cannot be initiated from Odoo.
Currencies other than EGP. Paymob Egypt settles in EGP; the provider hides itself elsewhere rather than failing at checkout.
Unverified
Acceptance by Paymob, a real Unified Checkout session, and a real settled payment or refund. No live or sandbox call has been made from this module.