---
title: "Gkash backend callback (Server-to-Server)"
method: POST
path: "/payment/callback/gkash"
tags: ["payment"]
---

# Gkash backend callback (Server-to-Server)

`POST /payment/callback/gkash`

Receives payment status updates from Gkash via server-to-server callback. This endpoint:
    - Verifies the callback signature (if provided)
    - Updates payment status in database
    - Stores the epkey for future recurring payments
    - Returns "OK" in response body (required by Gkash)
    
    **Important:** 
    - This endpoint must be publicly accessible
    - Response body must contain exactly "OK" (case-sensitive)
    - Configure this URL in Gkash merchant portal as callbackurl
    - Gkash will send callbacks for both successful and failed payments
    
    **Callback Parameters:**
    - CID: Merchant code
    - POID: Payment Order ID (Gkash transaction ID)
    - status: Payment status (e.g., "88 - Transferred" for success)
    - description: Payment description (e.g., "00 - Approved" for success)
    - cartid: Your reference number (refNo)
    - epkey: Token for recurring payments (only on successful payments)
    - signature: Callback signature for verification

## Request body

- GkashCallbackDto
  - `CID` string, required — Merchant Code (CID) - Your Gkash merchant identifier
  - `POID` string, required — Payment Order ID (POID) - Gkash transaction ID. Use this to track the payment in Gkash system.
  - `status` string, required — Payment status code. "88 - Transferred" indicates successful payment. Other values indicate failure or pending status.
  - `description` string, required — Payment description/result code. "00 - Approved" indicates successful payment. Other values indicate the reason for failure.
  - `cartid` string, required — Cart ID - Your merchant reference number (refNo) that was sent in the initial payment request. Use this to identify the payment in your system.
  - `epkey` string — Epkey (Encrypted Payment Key) - Token for recurring payments. Only present on successful payments. Store this for future recurring payment charges.
  - `signature` string — Response signature for callback verification. Verify this signature to ensure the callback is from Gkash.
  - `amount` string — Payment amount that was processed
  - `currency` string — Currency code
  - `PaymentType` string — Payment type/method used by customer (e.g., credit card type and last 4 digits)

## Response `200`

Callback processed successfully. Response body contains "OK" as required by Gkash.

- GkashCallbackResponseDto
  - `response` 'OK', required — Callback acknowledgment. Must be exactly "OK" (case-sensitive) as required by Gkash.

## Other responses

- `400` — Invalid callback data or signature verification failed
- `404` — Payment not found with the provided cartid

---

[API](https://skmtc.dev/tonewow/apis/tonewow-database-api.md) · [All operations](https://skmtc.dev/tonewow/apis/tonewow-database-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/tonewow/tonewow-database-api/revisions/f36472974ad4/schema)