When should you release an order paid by bank transfer?

When the confirmation webhook is received, never on the response to the invoice-creation call. At the end of that call, the order is committed but not yet paid.

Does the buyer have to enter a card number?

No. They provide their phone number and a validation code found in their virement.tn space, then pay by bank transfer from their bank.

Accepting bank transfer payments on your website

On an online store, card payment goes through a gateway that answers “paid” or “declined” within seconds. A bank transfer works differently: it is made by the buyer in their bank, after the order. Here is how to integrate it safely.

What changes compared with the card

No hosted payment page, no redirect. The buyer stays on your site.
No immediate “paid” response. The API call that creates the invoice answers that the order is committed.
Confirmation arrives later, by webhook, when the buyer's bank confirms the transfer.

In other words: the order is released only on that webhook.

The journey in five steps

The buyer chooses “pay with virement.tn” on your payment page.
Your form asks for two fields: their phone number and their validation code (6 characters, single-use, valid for 24 h, available in their virement.tn space). This code replaces entering a card number: it proves consent.
Your server creates the invoice through the API, authenticating the call with your key in the X-Api-Key header. The response indicates that the invoice is confirmed: the order is committed.
The buyer makes the transfer from their bank's app, to your verified RIB.
The bank confirms, virement.tn sends the signed webhook to your server. This is the signal to release the order.

What you need before starting

An active virement.tn merchant account.
A verified RIB: without it, invoice creation is refused.
An API key, generated from Settings → API keys (Manager role required). The key and the webhook signing secret are displayed only once: keep them on the server side.

Mistakes to avoid

Releasing the order on the API response. This is the most serious mistake: the transfer has not happened yet.
Calling the API from the browser. Your API key must stay on your server.
Not verifying the webhook signature. Without that, anyone can fake a confirmation.
Not making processing idempotent. As a precaution, make sure receiving the same confirmation twice breaks nothing (releasing an already released order must have no effect).
Forgetting the “never paid” case. Plan for expiry or cancellation of orders awaiting a transfer.

Why offer bank transfer in addition to the card

No card fees.
No card data to handle or protect.
A natural option for customers who prefer not to enter their card online.

You don't have to choose: bank transfer can complement the card. Our comparison of bank transfer, card or direct debit helps you decide according to your sales.

To go further

The integration page summarizes the principle. The full technical reference — endpoints, formats, sandbox environment — is provided directly to partners during integration.

Accepting bank transfer payments on your e-commerce site