Take payment and issue the licence in one step
From checkout to delivered
The steps between payment and access, with nothing done by hand in between.
Three gateways
POK, Stripe and PayPal are set up per install. They can run side by side at checkout, and your buyer picks the one they like.
Signed webhooks
Each order carries its own HMAC token in the callback address, checked in a timing-safe way. A forged callback cannot issue a licence.
Automatic fulfilment
A confirmed payment issues the key, sends the email and unlocks the protected download. No one on your team has to step in.
Reconciling ledger
Every sale lands in the sales ledger. So your revenue report matches what the gateway really paid out, with no spreadsheet in between.
Fulfilled exactly once
Gateways retry their callbacks. Fulfilment matches the order and completes once, so a retry never issues a second licence or counts revenue twice.
Hosted payment pages
Buyers pay on the gateway's own secure page. Card details never reach PABAA: the gateway handles them and sends back a reference.
How POK payments fulfil an order
A buyer picks POK, Stripe or PayPal at checkout and pays on that gateway's page. When the payment is confirmed, the system issues the licence key, sends the email and unlocks the download. Nobody on your team has to step in.
Why each webhook is signed per order
A callback that only carries an order number could be forged by anyone who guesses one. The result would be a free licence. So each callback address carries a token made from that order and a secret kept on the server. Here is how webhooks work in general.
The check is timing-safe. An unsigned or mismatched call is refused before any fulfilment runs.
Safe when a gateway retries
Gateways often send the same callback more than once. Fulfilment matches on the order reference and completes once. A retried callback will not issue a second licence or count the revenue twice.
Set up in the dashboard
Gateway keys are entered in the dashboard and stored per install. Adding or switching a provider needs no code and no redeploy. Any business that sells online can take payments this way, from software vendors to an online meditation academy. You can see every payment and mail connection in one place.
Key takeaways
- POK payments run beside Stripe and PayPal at checkout.
- A paid order issues its licence on its own.
- Signed webhooks refuse forged callbacks.
- A retried callback never fulfils an order twice.
Frequently asked questions
Can I run more than one gateway?
Yes. Turn on POK, Stripe and PayPal together. They appear side by side at checkout and the buyer chooses.
How do POK payments keep orders safe?
Each callback carries a token signed for that one order. A call without a valid token is refused before anything is fulfilled.
Is it hard to set up POK payments?
No. Enter your gateway keys in the dashboard. The gateway shows at checkout with no code and no deployment.
What happens if a webhook arrives twice?
Fulfilment completes once. The second call is spotted and ignored, so there is no second licence and no double revenue.
Start selling this week
Set up a gateway, publish your catalog, and the first paid order issues its own licence.