payguard/bagisto-payguard

PayGuard payment gateway for Bagisto — adds bKash and Nagad checkout for Bangladesh merchants

1.0.0 2026-07-30 16:32 UTC

Requires

• php: ^8.1
• bagisto/shop: ^2.0

MIT

• PayGuard

• ecommerce
• payment
• laravel
• bangladesh
• bkash
• bagisto
• nagad
• payguard

Published on Packagist.org on 2026-07-30 16:36 UTC

README

Accept bKash and Nagad payments in your Bagisto store, powered by PayGuard — the payment gateway built for Bangladesh merchants.

Features

• ✅ bKash and Nagad as separate checkout payment options
• ✅ Full redirect flow: order → PayGuard → bKash/Nagad → return
• ✅ HMAC-SHA256 signed webhook — reliable server-to-server confirmation
• ✅ Auto invoice creation on payment.success webhook
• ✅ Transaction ID stored and displayed in the admin order view
• ✅ Per-method PayGuard connection IDs
• ✅ Zero code changes needed after install — fully admin-configurable

Requirements

Requirement	Version
PHP	^8.1
Bagisto	^2.0
PayGuard account	app.sourcemonkey.online

Installation

composer require payguard/bagisto-payguard
php artisan optimize:clear

Laravel auto-discovery registers the service provider automatically — no manual bootstrap/providers.php edits needed.

Configuration

Step 1 — PayGuard Dashboard

Log into app.sourcemonkey.online and collect:

Item	Where to find it
API Key	API & Webhooks → Generate Key
Webhook Secret	Connections → Edit → Webhook Secret
bKash Connection ID	Connections → bKash row → ID column
Nagad Connection ID	Connections → Nagad row → ID column

Set your store's webhook URL in PayGuard to:

https://yourdomain.com/api/payguard/webhook

Step 2 — Bagisto Admin Panel

Go to Admin → Configuration → Sales → PayGuard Settings:

Field	Value
API Key	From PayGuard dashboard
API Base URL	https://app.sourcemonkey.online/api/v1
Webhook Secret	From PayGuard dashboard

Then configure each method under PayGuard - bKash and PayGuard - Nagad:

Field	Value
Status	Yes
Title	bKash (or Nagad) — shown to customers at checkout
Connection ID	Your bKash (or Nagad) connection ID from PayGuard

How It Works

Customer clicks "Place Order"
    → PayGuardController::redirect()
        → Bagisto order created
        → PayGuard transaction opened  (POST /api/v1/transactions)
        → bKash/Nagad initiated        (POST /api/v1/bkash/initiate/{id})
        → Customer redirected to bKash/Nagad checkout page

Customer completes payment on bKash/Nagad
    → Browser returns to /payguard/callback/{provider}
        → Transaction ID saved to order_payments.additional
        → Invoice created (best-effort)
        → Customer redirected to order success page

PayGuard server calls your webhook
    → POST /api/payguard/webhook
        → HMAC-SHA256 signature verified
        → Transaction ID saved to order
        → Order marked paid + invoice created  ← authoritative source of truth

The webhook is the source of truth. Invoice creation happens here regardless of whether the customer's browser makes it back to your site.

Admin Order View

After a successful payment, the PayGuard Transaction ID is displayed in the Admin → Sales → Orders → view page under the payment method section:

Payment & Shipping
──────────────────
bKash
Payment Method   bKash
Transaction ID   DGU3VY9R39

Routes

The plugin registers three public routes:

Method	URL	Purpose
GET	/payguard/redirect/{provider}	Entry point from checkout — creates order and redirects to PayGuard
GET	/payguard/callback/{provider}	Browser return from PayGuard after payment
POST	/api/payguard/webhook	Signed server-to-server IPN from PayGuard

{provider} is bkash or nagad.

The webhook route is CSRF-exempt (server-to-server call) but every request is verified with HMAC-SHA256 before any action is taken.

Local Development (Webhook Testing)

PayGuard can't reach localhost. Use ngrok to expose your local server:

ngrok http 8000

Copy the https://...ngrok-free.app URL and temporarily set it as APP_URL in your .env:

APP_URL=https://a1b2c3d4.ngrok-free.app

Then run php artisan config:clear and test a full checkout. Switch APP_URL back to http://localhost:8000 when done.

Package Structure

src/
├── Config/
│   ├── payment-methods.php       # Registers payguard_bkash + payguard_nagad
│   └── system.php                # Admin config fields (API key, connection IDs, etc.)
├── Http/Controllers/
│   └── PayGuardController.php    # redirect() / callback() / webhook()
├── Payment/
│   ├── AbstractPayGuardPayment.php
│   ├── PayGuardBkash.php
│   └── PayGuardNagad.php
├── Providers/
│   └── PayGuardServiceProvider.php  # Routes, views, render event hook
├── Resources/views/admin/orders/
│   └── payment-info.blade.php    # Transaction ID block in admin order view
├── Routes/
│   └── web.php
└── Services/
    └── PayGuardClient.php        # HTTP client for PayGuard API + HMAC verification

Changelog

1.0.0 — 2026-07-30

• Initial release
• bKash + Nagad checkout via PayGuard redirect flow
• HMAC-SHA256 webhook signature verification
• Transaction ID saved and displayed in admin order view
• Auto invoice creation on payment confirmation

Support

• PayGuard docs: app.sourcemonkey.online/docs
• Issues: github.com/abefimrs/bagisto-payguard/issues
• PayGuard dashboard: app.sourcemonkey.online

License

MIT — see LICENSE.