How to collect Paystack payments from WhatsApp without handling customer money

Keep funds in the business account

A payment workflow is safest when the business collects directly into its own payment provider account. The software can create a link and verify a completed transaction, but it should not receive or hold the customer’s money.

That separation matters: the customer sees the business at checkout, the payment settles to the business, and the business remains responsible for the goods, service, fulfilment, refunds, taxes, and disputes.

A safe payment flow

For a typical WhatsApp sale, the flow should be straightforward.

• The business connects its own Paystack secret key securely on the server.
• A staff member or approved automation creates a payment request for the specific lead and amount.
• The link is sent in the same conversation so the request has context.
• Paystack confirms a completed transaction to the business account.
• The system verifies the reference and sends the business’s chosen confirmation message.

Do not treat a redirect as proof of payment

A customer returning to a thank-you page is helpful, but it is not enough on its own. Bank transfer and other payment paths may not rely on a browser redirect. The payment provider’s verified transaction status is what should change the request to paid and trigger a confirmation.

What to explain to customers

Be plain: ‘You are paying directly into our Paystack account. This link is for this order only.’ That answers the natural trust question without making security claims you cannot substantiate.