medusa-payment-paystation

A Paystation payment provider plugin for MedusaJS v2. Paystation is a Bangladeshi payment gateway aggregator supporting bKash, Nagad, Rocket, cards, and mobile banking.

Ships as a self-contained MedusaJS plugin: the payment provider itself, plus the redirect/webhook route Paystation calls back to after a hosted checkout completes.

Installation

yarn add medusa-payment-paystation
# or
npm install medusa-payment-paystation

Register it as a payment provider in medusa-config.ts:

module.exports = defineConfig({
  modules: [
    {
      resolve: '@medusajs/medusa/payment',
      options: {
        providers: [
          {
            resolve: 'medusa-payment-paystation/providers/paystation',
            id: 'paystation',
            options: {
              merchantId: process.env.PAYSTATION_MERCHANT_ID,
              password: process.env.PAYSTATION_PASSWORD,
              isSandbox: process.env.PAYSTATION_IS_SANDBOX === 'true'
            }
          }
        ]
      }
    }
  ]
});

Then enable paystation as a payment provider on the relevant region(s) in the admin dashboard (Settings → Regions → Payment providers).

Configuration

PAYSTATION_MERCHANT_ID=your_merchant_id
PAYSTATION_PASSWORD=your_password
PAYSTATION_IS_SANDBOX=true
BACKEND_URL=http://localhost:9000
NEXT_PUBLIC_BASE_URL=http://localhost:3000

| Variable | Purpose | | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------ | | PAYSTATION_MERCHANT_ID / PAYSTATION_PASSWORD | Credentials from your Paystation merchant dashboard | | PAYSTATION_IS_SANDBOX | true uses Paystation's public sandbox endpoint and test credentials; false uses production and your real credentials | | BACKEND_URL | Used to build the callback_url sent to Paystation when initiating a payment | | NEXT_PUBLIC_BASE_URL (or STOREFRONT_URL) | Where the webhook route redirects the customer's browser after payment |

How it works

Paystation is a hosted-checkout gateway: your storefront initiates a payment, redirects the customer to a Paystation-hosted page, and the customer is redirected back to your backend when done. There is no reliable server-to-server webhook — in practice, the browser redirect is the only notification you get, so this plugin treats it as the source of truth but never trusts it blindly:

1. initiatePayment creates an invoice with Paystation and returns the redirect URL.
2. The customer pays on Paystation's hosted page and is redirected to <BACKEND_URL>/payment/hooks/paystation.
3. That route independently re-verifies the transaction against Paystation's /transaction-status API before doing anything — the redirect's own status query param is attacker-controllable and invoice_number is a low-entropy, guessable value, so it is never trusted on its own.
4. Once verified, the payment is captured via Medusa's capturePaymentWorkflow (not the raw module service, so the CAPTURED event fires for downstream subscribers), and the customer is redirected to their order confirmation page.

Webhook / callback URL

Configure this in the Paystation merchant dashboard, if it offers a separate webhook/notify URL setting (some accounts don't expose one — the redirect above covers that case regardless):

<BACKEND_URL>/payment/hooks/paystation

Storefront provider id

pp_paystation_paystation

Requirements

• MedusaJS ^2.11.3
• Node.js >=20

License

MIT