PromptPay / TrueMoney Wallet Auto Top-Up: How Payment Automation Works Under the Hood

#payments #api #tutorial #javascript

Payment automation is the invisible engine behind every modern online service, and in Thailand it increasingly means PromptPay and TrueMoney Wallet. When a player deposits and the balance appears instantly, that is a chain of API calls happening in seconds. Here is what happens under the hood.

The flow, step by step

The user initiates a deposit — picks an amount and payment method on the site.
A payment order is created — the site generates a unique reference (order ID) and stores it server-side with status pending.
The user is redirected to the payment provider — a wallet app or bank app handles authentication and confirmation on the user's device.
The provider calls the webhook — the critical step. The provider's server sends an HTTP callback to the site's server with the order ID and confirmation status.
The site verifies and credits — the server checks the signature, confirms the order ID matches, updates the status to completed, and credits the balance.

The two hardest parts: webhooks and idempotency

Webhooks are the fragile link. Your server must respond to the provider's callback even if the user closes their browser halfway. This is why payment automation is server-side, not client-side — a JavaScript fetch cannot be trusted to complete a payment.

Idempotency prevents double-crediting. If the provider retries a webhook (which they do when the first call times out), your server must recognize it already processed that order ID and return success without crediting twice. The standard pattern: a database unique constraint on order_id plus a processed_at check.

// pseudo-code: idempotent webhook handler
async function handleWebhook(req) {
  const { orderId, status, signature } = req.body;
  if (!verifySignature(signature)) return 401;
  const existing = await db.findOrder(orderId);
  if (existing && existing.status === "completed") return 200; // already done
  if (status === "success") {
    await db.markCompleted(orderId);
    await creditBalance(existing.userId, existing.amount);
  }
  return 200;
}

Why "auto top-up" matters to users

Speed is trust. A deposit that takes 10 minutes feels broken; one that lands in 3 seconds feels magical. True Wallet and PromptPay integrations enable deposits without minimum thresholds because the cost per transaction is negligible compared to bank transfers.

If you want to see how a real site describes its wallet deposit flow — including minimums and processing times — check out our True Wallet deposit guide.

Security checklist for payment code

Always verify the webhook signature before trusting any payload.
Never log full card/wallet credentials — log masked IDs only.
Use HTTPS everywhere — a payment flow over plain HTTP is indefensible.
Rate-limit the deposit endpoint to prevent abuse.
Keep order IDs unpredictable — sequential IDs let attackers probe for order numbers.

The takeaway

Payment automation is not magic — it is a webhook, an idempotency key, and careful verification. Get those three right and instant top-ups just work.

Originally published on PGSLOT333.

DEV Community