CardRaabta Payment Gateway For JazzCash Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Accept JazzCash Mobile Wallet and online debit/credit card payments in your WooCommerce store. Customers pay directly through JazzCash hosted checkout in PKR. Customers enter card or wallet details on JazzCash and approve wallet payments on their phone. This is an independent integration by Malik Arslan (https://malikarslan.com), not an official or endorsed JazzCash, WordPress or WooCommerce product.
Features:
- Separate Sandbox and Live merchant credentials and approved HTTPS payment URLs.
- Separate card and mobile-wallet methods on classic checkout and Checkout Blocks, with HPOS order storage support.
- Default 72-hour transaction expiry calculated in Asia/Karachi.
- HMAC-SHA256 request signing and mandatory signature verification for responses.
- Order, reference, timestamp and amount validation; duplicate notification protection.
- SOAP 1.1 IPN endpoint and WSDL for merchant provisioning with JazzCash.
- Encrypted settings, permission-protected administration and minimal debug logging.
You need an approved JazzCash payment-gateway merchant account, dedicated payment credentials and the page-redirection endpoint provided by JazzCash. Sandbox and Live functionality are included without a plugin fee or activation license. JazzCash may charge service fees under your merchant agreement.
Requires WooCommerce 8.3+, PKR currency, HTTPS, PHP OpenSSL/iconv/DOM and MySQL/MariaDB connection-scoped named locks. Gateway responses must be signed. Use on a staging store and complete your merchant acceptance testing before taking real payments.
External services
JazzCash payment processing
This plugin relies on JazzCash, an external payment service, to process debit/credit card and Mobile Wallet payments. A store owner must obtain an approved merchant account, configure dedicated credentials and enable the chosen payment method. Both Sandbox and Live integrations are included; JazzCash service charges and merchant terms apply separately.
When and why data is sent: only when a customer chooses a JazzCash method, opens the order payment page and presses “Continue to JazzCash”, their browser POSTs a signed payment request to the merchant-configured JazzCash hosted payment URL. The purpose is to authenticate the merchant, identify the order and process the selected payment. Activation, ordinary browsing and saving settings do not send payment data to JazzCash.
Where data is sent: Sandbox requests go to https://sandbox.jazzcash.com.pk/ and Live requests go to https://payments.jazzcash.com.pk/. The exact page-redirection path is supplied by JazzCash for the merchant. Other hosts, insecure HTTP endpoints and unexpected ports are rejected.
Data sent: merchant ID and dedicated payment password; transaction type/version/language; unique transaction reference; order ID as bill reference, description and merchant-defined field; amount in paisa and PKR currency; creation and expiry timestamps; return URL; and SecureHash signature. Wallet requests also include the bank/product identifiers TBANK/RETL; card requests include the registration flag. The Integrity Salt is never sent. The plugin does not send billing name, email, telephone or postal address, and does not collect card numbers, wallet numbers, CNIC, OTP or MPIN. JazzCash receives browser/IP information and collects the payment details directly on its own hosted page.
Return and IPN: JazzCash sends payment references, response codes, timestamps and authentication fields to this store’s public Return URL or SOAP IPN URL. Signed callbacks are verified before updating the related WooCommerce order. The store replies to a valid SOAP notification with a signed acknowledgement containing a response code and padded response message. Invalid notifications receive a generic error. Payment-attempt metadata, status and transaction references are retained with the WooCommerce order. Optional logs contain fixed event codes and order IDs, using WooCommerce log retention. Full payloads and credentials are not logged.
Service and policies (official JazzCash links):
* Payment gateway service: https://www.jazzcash.com.pk/business/accept-payments/payment-gateway
* Terms and conditions: https://www.jazzcash.com.pk/tc/
* Online payment gateway merchant terms (PDF; includes Online Payment Gateway Service Commercial Terms): https://www.jazzcash.com.pk/assets/uploads/2026/04/Overall-Banking-Service-Agreement-BNPL-QR-PGW-MP-standard-format-with-all-service-order-forms.pdf
* Customer privacy notice (PDF): https://www.jazzcash.com.pk/assets/documents/JazzCash-Privacy-Notice-sep-2026.pdf
Your signed merchant agreement may contain additional obligations. Update your store privacy policy and retention practices accordingly. Suggested customer-facing text is added to WordPress’s privacy-policy guide. The plugin does not certify PCI, privacy-law or other legal compliance.
No other external services
This plugin adds no telemetry, advertising, tracking pixels, externally hosted JavaScript or custom updater. WordPress and WooCommerce are local dependencies. GitHub and documentation links are references for users/developers; the plugin does not fetch code or data from them.
The strings http://schemas.xmlsoap.org/soap/envelope/, http://schemas.xmlsoap.org/wsdl/, http://schemas.xmlsoap.org/wsdl/soap/, http://www.w3.org/2001/XMLSchema and http://tempuri.org/ in PHP/WSDL are XML namespace or SOAP-action identifiers, not external service requests. They must retain their protocol-defined spelling, including http. XML parsing disables network access with LIBXML_NONET and rejects DTD/entity declarations. The WSDL is a bundled local template, with this store’s HTTPS IPN address substituted when served.
Hosted-form credential behavior
JazzCash’s documented page-redirection protocol includes pp_Password in the browser’s hidden form. Customers can inspect that value. Use only dedicated payment credentials approved for this integration, never your account-login password. The Integrity Salt remains server-side. See README.md for credential rotation and limitations.
Screenshots
No screenshots provided
