Module and release scope
This guide covers Bank Alfalah Alfa Payment Gateway 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.5–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.
Open System → Payment gateways (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.
Exact connection fields
These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.
| Key / label | Type | Required | Default / guidance |
|---|---|---|---|
mode — Environment |
select | Yes | Default: "sandbox" Choices: sandbox = Sandbox, live = Live |
merchant_country — Merchant legal country |
select | Yes | Default: "PK" Choices: PK = Pakistan |
settlement_currency — Bank-approved settlement currency |
text | Yes | Default: "PKR" Use the currency approved in your merchant contract. Invoice conversion is separate. |
merchant_id — Merchant ID |
text | Yes | Use the account-specific value described below. |
store_id — Store ID |
text | Yes | Use the account-specific value described below. |
merchant_username — Integration merchant username |
text | Yes | Use the account-specific value described below. |
merchant_password — Integration merchant password |
secret | Yes | Use the account-specific value described below. |
merchant_hash — Merchant hash |
secret | Yes | Use the account-specific value described below. |
encryption_key_1 — Bank-issued encryption key 1 |
secret | Yes | Use the account-specific value described below. |
encryption_key_2 — Bank-issued encryption key 2 |
secret | Yes | Use the account-specific value described below. |
Configuration-only Extension API 1 payment module prepared for a later gateway update. Normal installation leaves it disabled. Saving credentials never implies bank verification: connection tests deliberately fail, every currency remains unavailable for checkout, and checkout/webhook calls cannot return a verified payment. No request is sent to the merchant portal or bank.
Enter the integration credentials supplied by the bank, rather than the human merchant-portal login password. The official guide describes a merchant/store ID, integration merchant username/password/hash, bank-issued encryption keys, redirected hosted checkout, and bank-whitelisted notification URL. A later implementation must verify actual merchant identity, contractual currency support, sandbox settlement, fixed bank API endpoints, the exact amount/currency/order identifiers, authenticated status inquiry, and production approval before enabling real payments.
Official source: Alfa Payment Gateway Merchant Integration Guide v1.1. This package does not accept arbitrary callback URLs from untrusted notifications or mark an invoice paid from browser-return parameters.