System Requirements

NaafiPay is a hosted, multi-region service so the requirements on your side are intentionally light. You need a server (or serverless platform) that can make outbound HTTPS requests, a public HTTPS endpoint to receive webhooks, and a runtime that supports modern TLS. This page lists the exact versions, ports, and network rules you need to put in place before you go live, plus a few common pitfalls we see when merchants self-host the integration on shared hosting.

Runtime support

Any language with an HTTPS client works. The following runtimes are tested and have official examples in our docs.

PHP 7.4 or newer (8.1+ recommended)
Node.js 18 LTS or newer
Python 3.9 or newer
Go 1.20+, Ruby 3.0+, Java 11+, .NET 6+ — all work via standard HTTP libraries

Network requirements

Your server must be able to make outbound TCP connections to naafipay.com on port 443. NaafiPay does not require any inbound firewall rules unless you register a webhook endpoint — in that case your webhook URL must be reachable from the public internet on HTTPS.

WarningSelf-signed certificates will fail

Webhook URLs must use a valid certificate from a public certificate authority. Self-signed certificates, IP addresses, and http:// URLs are rejected at registration time. Use a free certificate from Let's Encrypt or a paid certificate from your hosting provider.

TLS

NaafiPay requires TLS 1.2 or higher. TLS 1.0 and 1.1 are disabled at the load balancer. If you are running on an older PHP version on cPanel hosting, make sure your cURL extension was compiled against OpenSSL 1.1.1 or newer — otherwise outbound requests will fail with a handshake error.

Webhook delivery

Webhooks are delivered from a fixed list of IP addresses. If you run a strict allow-list firewall, you can fetch the current IP list from your dashboard. Webhooks are retried with exponential backoff for up to 24 hours if your endpoint returns a non-2xx response or times out after 10 seconds.

TipLocal development

For local development, expose your machine using a tunnelling tool such as ngrok or Cloudflare Tunnel. Both provide a public HTTPS URL that forwards to localhost, so you can receive real webhook deliveries on your laptop without deploying.

Browser support for hosted checkout

The hosted checkout works on the last two major versions of Chrome, Edge, Firefox, and Safari on both desktop and mobile. The bKash, Nagad, and Rocket app deep-links are supported on Android 7+ and iOS 13+. Older devices fall back to the web-based checkout for each provider.

What we handle for you

Payment-reference and status management without storing raw card data
SMS-reader infrastructure for MFS verification
Webhook retries, signing, and replay protection
Reconciliation across payment methods
Currency formatting and localised receipts