BMPF Payment Infrastructure

External Services

BMPF communicates with PayFast, a third-party payment service, to process payments and verify payment notifications.

When a payment is created, BMPF sends the payment request data required by PayFast, including the merchant identifier, payment amount, payment description, customer return URLs and the BMPF transaction reference. PayFast processes the payment on its own service.

PayFast sends an Instant Transaction Notification (ITN) to the BMPF endpoint configured for the site. BMPF validates the notification and performs a server-side confirmation request to PayFast before updating the transaction status.

For more information about PayFast’s services, terms and privacy practices, see:

• PayFast General Terms & Conditions: https://payfast.io/legal/general-terms-conditions/
• PayFast Privacy Policy: https://payfast.io/privacy-policy/

Invoice Payments

BMPF can provide a standalone invoice payment experience using the [bmpf_payment] shortcode.

The customer enters an invoice or payment reference and the amount to be paid. BMPF validates the request, creates the PayFast transaction and redirects the customer to PayFast.

Example:

[bmpf_payment id="invoice-default"]

Invoice references support letters, numbers and common reference characters including periods, underscores, slashes and hyphens.

Donations

BMPF can provide a standalone donation payment experience using the same reusable payment shortcode system.

Suggested donation amounts can be configured alongside a custom donation amount.

Example:

[bmpf_payment id="donation-default"]<h3>Payment Flow</h3>

The standard BMPF payment lifecycle is:

1. 01A website requests a payment through BMPF.
2. 02BMPF validates the payment request.
3. 03BMPF creates a pending transaction.
4. 04BMPF generates the PayFast payment request and signature.
5. 05The customer is redirected to PayFast.
6. 06PayFast processes the payment.
7. 07PayFast sends an ITN notification to BMPF.
8. 08BMPF validates the notification.
9. 09BMPF locates the original transaction.
10. 10BMPF validates the payment amount.
11. 11BMPF confirms the transaction directly with PayFast.
12. 12BMPF updates the transaction according to the verified PayFast status.

Transaction Protection

BMPF maintains its own transaction record for each payment attempt.

Verified transactions are protected against being treated as new active payments for the same payment reference.

Pending transactions are handled separately from completed transactions so that payment state can be tracked safely.

Existing transaction records are retained for administration and audit purposes.

Payment Configuration

BMPF provides reusable payment configurations for standalone payment experiences.

Each configuration can define:

• Configuration name
• Configuration key
• Description
• Payment type
• Minimum amount
• Maximum amount
• PayFast payment name
• Suggested donation amounts where applicable
• Optional Pay Button Colour
• Enabled or disabled status

Configurations can be managed from the WordPress administration area.

Public Integration API

BMPF includes a public integration API that allows other Bold Mark Creative systems and custom WordPress development to request payments through the central BMPF payment infrastructure.

This keeps PayFast handling, transaction creation, verification and payment state in one reusable payment layer.

Current Status

The Free Edition currently provides the core payment foundation for invoice payments and donations.

The PayFast Sandbox payment lifecycle has been successfully tested, including payment creation, redirect, ITN receipt, notification validation, amount validation, server-side confirmation and transaction verification.

Standalone invoice payments and donations have also been implemented and tested, including decimal payment amounts and configurable donation amounts.

The plugin is intended to provide a stable foundation for future payment integrations while keeping the core payment engine reusable and independent.

Development Roadmap

1. 13PayFast payment infrastructure — COMPLETE
2. 14Signature generation — COMPLETE
3. 15PayFast redirect — COMPLETE
4. 16ITN validation — COMPLETE
5. 17Server-side payment verification — COMPLETE
6. 18Transaction system — COMPLETE
7. 19Transaction administration — COMPLETE
8. 20BMPF dashboard — COMPLETE
9. 21Public integration API — COMPLETE
10. 22Standalone invoice payments — COMPLETE
11. 23Standalone donations — COMPLETE
12. 24Payment configuration system — COMPLETE
13. 25Free Edition 0.1.2 — COMPLETE
14. 26Additional payment integrations — FUTURE

Architecture

BMPF is designed as a reusable payment infrastructure layer.

The core architecture consists of:

BMPF | +– Payment Engine +– PayFast Signature Handling +– ITN Verification +– Transaction System +– Admin Dashboard +– Integration API | +– Standalone Payment Experiences +– Future Integrations

The payment engine remains responsible for PayFast communication and payment state, while individual payment experiences provide the customer-facing payment context.

Security

BMPF validates payment requests server-side and does not rely solely on browser-side payment information.

PayFast ITN notifications are validated before transactions are updated.

Payment amounts are checked against the original transaction before a payment can be marked as verified.

Administrative actions use WordPress capability checks and nonces.

Requirements

• WordPress 6.0 or later
• PHP 7.4 or later
• A PayFast merchant account

Author

Bold Mark Creative

https://boldmark.co.za/