How it works
PayMyBid sits between a leaderboard and a card processor. The board decides what a rank costs and who holds it. We collect the money and report the result.
- The payer bids on your board. Your board works out the amount due, in whole units of its currency, and gives the order its own reference.
- Your board creates an order. One authenticated POST to our API with the amount and the reference. We return an order id and a checkout link on this domain.
- The payer pays. Your board sends the payer to the checkout link, on our domain. The card form on that page is served by Stripe; we never see the number.
- Your board polls. While the payer waits on your page, your board asks us every few seconds whether the order is paid. We ask the processor and answer. Nothing calls you.
- Your board moves the rank. On
paid, your board applies the credit. The payer's receipt comes from the processor; the confirmation of the rank comes from you.
What we never do
- Store card numbers. The processor's page takes them and its vault keeps them.
- Call your servers. There is no webhook to expose, sign or rotate.
- Touch a rank. We can tell you an order is paid; we cannot place anyone anywhere.
- Contact your payers, beyond the receipt the processor sends for their own payment.
- Publish who our boards are. Boards are known to us by a key, and that is all our systems hold.
Why polling and not webhooks
A webhook is a public endpoint that has to be signed, verified, retried and monitored, and a forged one is the classic way a "paid" order that was never paid gets onto a board. A poll is authoritative by construction: your board asks, we look the order up at the processor, and the answer cannot be spoofed by anyone who does not hold your token. Poll every three seconds while the payer is on your page and every few minutes afterwards; our own sweep catches anything nobody is watching.