How to Automate bKash & Nagad Payment Verification for SaaS Platforms

If you've ever had to manually check a bKash or Nagad transaction before unlocking a user's subscription, you know exactly how painful that process gets at scale. One person sends money, messages you on WhatsApp, and then waits while you cross-check their Transaction ID, update a spreadsheet, and manually add credits. Multiply that by 50 users a day and you have a serious operational bottleneck.

This guide explains the architecture VelorOps built to solve this problem completely — from the moment a user sends a payment to the moment their account credits appear, with zero human involvement.

1. Why Manual Payment Verification Breaks SaaS Operations

Bangladesh's mobile financial ecosystem is unique. bKash and Nagad together process over 90% of digital payments in the country, but neither offers a direct developer API that's practical for SaaS billing. What they do provide — the SMS confirmation that lands on the merchant's phone after every transaction — turns out to be the perfect data source, if you know how to read it.

The information in that SMS is everything you need: the Transaction ID, the amount, the sender number, and a timestamp. The challenge is getting it out of a phone and into your backend automatically. That's where the SMS Webhook Gateway pattern comes in.

2. The Architecture: How It Works End to End

Here's the complete flow from payment to credit, broken into steps that you can understand — and potentially replicate — regardless of your stack:

const trxMatch = smsBody.match(/TrxID\s+([A-Z0-9]+)/i);
const amountMatch = smsBody.match(/Tk\s+([0-9,.]+)/i);

3. Security: Where Most Implementations Get It Wrong

Payment systems attract fraud attempts. The SMS webhook pattern is sound, but it only stays secure if you implement these three protections correctly:

• Webhook secret validation: Every request to /api/webhooks/sms must include a pre-shared secret in the headers. Requests without it are rejected immediately. This prevents anyone who knows your endpoint URL from submitting fake payment notifications.
• Replay attack prevention: Each Transaction ID can only be applied once. The database enforces a unique index constraint on TrxIDs, so even if the same webhook fires twice (which can happen with SMS forwarder apps), the second attempt hits a conflict error and is safely ignored.
• Amount validation: Credits are only granted if the paid amount exactly matches or exceeds the plan price. Partial payments don't get partial credits — they get logged for manual review. This closes the gap where someone might send ৳1 and hope to receive a full subscription.

4. What You Need to Set This Up

If you're building something similar for your own SaaS, here's the practical checklist. See VelorOps platform features for how this integrates with the full publishing and billing workflow.

5. The Result

When this system is working properly, the user experience is almost magical from the customer's side: they send money, go back to the app, and their credits are already there. No waiting, no messaging support, no delays. That kind of instant fulfillment significantly reduces support volume and builds trust — both of which matter a lot in a market where SaaS is still earning user confidence.

VelorOps uses this exact architecture in production. The system has processed thousands of bKash and Nagad payments with a false-positive rate of effectively zero, thanks to the strict validation stack described above.