Online payment in Morocco in 2026: how to accept your customers' payments (methods, fees, steps)

Online payment in Morocco, for a business, means accepting cards with 3-D Secure authentication — Visa, Mastercard, Maroc Pay — and, with ChariPay, cash paid at an agency against a reference, through a payment link, a hosted checkout or a subscription, with the money landing in a payment account in the company's name. This guide is written for merchants who want to get paid, not for individuals looking to pay a bill online: payment methods, real costs, the steps from sandbox to production, and integration with or without a developer. It is long on purpose: it is the page to read once, before you choose.

The essentials in 60 seconds

• Two methods, three tools. Your customers pay by card — Visa, Mastercard or Maroc Pay, with 3-D Secure — or in cash at an agency of the Chari network, against a reference. You collect through a payment link, a hosted checkout on your site, or a subscription.
• A regulated activity. Collecting money on a merchant's behalf is a regulated activity: your provider must rely on an institution licensed by Bank Al-Maghrib. ChariPay is operated by Chari Money, a Bank Al-Maghrib-licensed payment institution, on a PCI DSS Level 1 certified platform.
• Money without the wait. Every successful payment, by card or in cash, lands in a payment account credited instantly, held by Chari Money, with a RIB in your company's name. The payout to your bank is a separate operation, automatic every night or on demand.
• Published costs. Free sandbox; an activation fee of MAD 6,000, VAT included, paid once when you go live; a commission per successful transaction, set after your application is reviewed; free refunds.
• Try it today. Test mode is free, has no time limit and needs no approval. Start in test mode: three fields — name, work e-mail, company —, an activation link sent by e-mail, your password, then a test key created from the portal and a first payment with the test card. Verifying your company only matters when you go live.

Where things stand in 2026

Online payment in Morocco does not look like the version described in guides written for Europe or North America. Cards work, and 3-D Secure is the authentication standard: the buyer's bank decides, transaction by transaction, whether to ask for a confirmation. But some buyers have no card, or a card that is not enabled for online payments — many Moroccan cards are only enabled once the holder asks their bank to activate them. Others have the card and the habit, but not yet the trust to type a number into a site they do not know. For all of them, cash on delivery remains a reflex of Moroccan e-commerce, with its refused parcels and its cash riding around town.

A second local trait: the sale is often closed away from the site, in a WhatsApp or Instagram conversation, and payment has to follow the conversation rather than a cart. A third: the international gateways developers know are not all open to companies established in Morocco — more on that below. We quote no market share: the figures in circulation on card versus cash usage are rarely sourceable, and your own payment failure rate will tell you more than a national average.

The legal framework, on the other hand, is clear. According to Bank Al-Maghrib, Law No. 103-12 on credit institutions and similar bodies introduced a category of non-bank institutions, payment institutions, authorized to hold payment accounts and offer the related payment services. The central bank counted 18 of them at the end of 2024, out of 93 licensed credit institutions and similar bodies. That status is what allows a provider to receive your customers' money and pass it on to you. A payment gateway in Morocco is not licensed as a piece of software: the institution that operates it is — for ChariPay, Chari Money.

What changed in 2025

The card acquiring market — the business of accepting card payments on behalf of merchants — had until then been marked, in the Competition Council's own words, by a quasi-monopoly. In its decision No. 152/D/2024 of October 31, 2024, the Council made a set of behavioral and structural commitments binding. Its press release of May 19, 2025 states that payment institutions and bank subsidiaries dedicated to acquiring, when duly authorized, may operate on the market from May 1, 2025, that the entry of these new players will bring a new competitive dynamic to the acquiring market, and that the transitional period, during which the Council monitors the implementation of the other commitments, ends on November 1, 2025.

For a merchant, the practical consequence is simple: the question "who is licensed, and to do what?" matters more than before, and it is checked with Bank Al-Maghrib, not on a sales page. The PSP in Morocco page explains what a license covers and how to read one.

The five ways to accept an online payment in Morocco, compared

A gateway is chosen first by what it lets you accept, and how. There are two payment methods — card and cash — and three tools to put them to work — the payment link, the hosted checkout and the subscription. The table puts them side by side. At ChariPay, all of them credit the same payment account, and all of them credit it instantly.

Cards, with 3-D Secure

It is the method everyone expects, and the simplest to set up: your customer enters their card on a page hosted by ChariPay, their bank asks for 3-D Secure authentication, they return to your site — and the result reaches you by webhook. You never touch a card number, neither on your server nor in your browser: the card is entered inside a PCI DSS Level 1 certified perimeter, and your scope stays that of a merchant who never sees card data.

The point that surprises integrators: a card payment does not complete at the moment you call it. There is the bank, the authentication, the return. The confirmation page the buyer sees is only a redirect; the signed notification your server receives is the one source of truth. On what makes an authentication fail — abandonment, refusal by the issuing bank, wrong details, suspected fraud —, 3-D Secure: what makes a payment fail goes into the detail. The product that brings this method to your site is the 3-D Secure hosted checkout.

Cash at an agency, by reference

ChariPay is the only payment gateway in Morocco that also collects cash at agencies. On a payment link's page, your customer chooses cash, receives a reference and deposits the amount at an agency of the Chari network; you are notified as soon as the network confirms the deposit, and the amount is available in your payment account at that very moment.

What it changes is the order of operations. An order paid on delivery ships first and gets paid afterwards — or does not. With the agency deposit, the order is paid before it ships, the money never travels with a courier, and the collection shows up in the same statement as your card payments. The only delay is the time the customer takes to visit an agency: give the reference a sensible expiry date and plan a reminder. The setup is detailed in Taking cash without a till — payment by reference.

The payment link

The payment link is the tool of conversational selling and of the shop without a developer. You create it from the portal — amount, description, single or multiple use, expiry after 24 hours, 7 days, 30 days, never, or on a set date — and share it however you like: pasted into WhatsApp, sent by e-mail, printed as a QR code or a PDF poster for a counter. The customer opens a page in your name, picks card or cash, and pays.

A single-use link matches one specific order; a multi-use link collects from several customers for the same amount — a membership fee, a ticket, a best-selling product. Cash payment, for its part, always relies on a single-use link: one reference per deposit. Everything is described on the payment links page, and Payment link or checkout: which to pick helps you decide between the two tools.

The hosted checkout, through payment sessions

As soon as you have a cart and a back office, the payment session replaces the link. Your server creates one session per order, with the amount in MAD, your order reference and the buyer's details; the API returns a payment URL to which you redirect the customer. The hosted page carries your colors and logo, and handles card entry and 3-D Secure authentication; your server, meanwhile, waits for the webhook. A session is consumed only once and expires on its own, seventy-two hours after creation unless you set another deadline. For a customer who prefers to pay in cash, the tool remains the single-use payment link: one reference per deposit.

The subscription

The subscription serves businesses that collect on a schedule: gym, school, software, rent, subscription box. You create it for a client — name, e-mail, optional phone number — from the portal or through the API, with an amount, a frequency (daily, weekly, monthly or yearly), a start date and, if needed, an end date. On every due date, ChariPay e-mails the customer a single-use payment link; they pay on the hosted page, by card with 3-D Secure. As long as an installment remains unpaid, a reminder goes out every day with the same link and no new period is opened; the link stays payable for 14 days after the due date, after which the subscription is canceled if it is still unpaid. The detail is on the Subscriptions page.

Payment methods in Morocco: what your customers use

Before choosing a tool, look at how your customers already pay. There is no reliable public statistic on the split between card and cash in Moroccan e-commerce; the profiles, however, are easy to recognize, because they all message you on WhatsApp.

• Visa and Mastercard cards. Issued by a Moroccan bank, they are the reflex of customers used to buying online. One thing to watch: many Moroccan cards are closed to online payments by default, and the holder has to ask their bank to enable them. That kind of failure has nothing to do with your site; a clear line on your order page prevents some of it.
• Maroc Pay. Accepted by default alongside Visa and Mastercard, on the same payment page and with the same 3-D Secure authentication.
• Cards issued abroad. Every amount is in dirhams, and the issuing bank authorizes or declines each payment: we do not guarantee that a card issued abroad will be accepted. If your business targets foreign customers, ask us with your specific case before launching the offer.
• Cash. The customer who pays for everything in cash exists, and is far from marginal. Rather than losing them or sending them to cash on delivery, a reference to pay at an agency lets them pay in cash before the order ships.
• Cash on delivery. Still common, it converts — that is its strength — and it costs — that is its weakness. The next section compares it with online payment, criterion by criterion.
• Bank transfer with a screenshot. The customer transfers from their bank and sends you proof. It works for an occasional quote, but nothing about it is automatic: manual checks, manual reconciliation, no notification.

Other payment methods can be enabled on request with the team, depending on your business. The practical rule fits in one sentence: offer card and cash at an agency, then measure how much still goes to cash on delivery.

Cash on delivery or online payment?

Cash on delivery is not the enemy: it reassures a customer who does not know you yet. But it pushes its cost past the sale, where it is hardest to measure — packaging, outbound shipping, return shipping and restocking for a refused parcel, value tied up during the whole trip and then until the courier pays the collection back. The table compares the three options open to a Moroccan shop.

The right-hand column sums up our position: cash at an agency keeps the customer who pays in cash while taking the courier out of collection. A sensible strategy is to offer card and cash at an agency by default, keep cash on delivery as an option if your customers insist on it, and track your refused-parcel rate month after month. The guide to e-commerce payments in Morocco details the real cost of cash on delivery and how to connect an online shop.

What accepting online payments costs in Morocco

Prices are compared last — a commission can be renegotiated, an architecture cannot be undone. But they are compared, and for that you need to know what a quote is made of. In Morocco as elsewhere, the cost of accepting payments online breaks down into five items, only two of which are printed in large type on the brochures. We publish no market price grid: only the method, then our own numbers.

The five items of a quote

• Activation. A one-off sum covering the review of your application, activation and support through go-live. Ask whether it is paid before or after activation.
• The commission. A percentage taken on each transaction, sometimes topped up with a fixed part. It generally depends on your line of business, payment methods and volumes. Two questions to ask: is it charged on successful transactions only, and is the percentage the same for every method?
• The security deposit. An amount held for the length of the relationship, meant to cover disputes and unpaid amounts. Its size depends on the perceived risk of your business; ask how and when it is returned to you.
• Refunds. Refunding a customer is a normal part of trade, not an incident. Check what a full refund, then a partial one, actually costs you, and whether the commission on the original transaction is kept.
• Payouts. The most underestimated item. When does the money you collected reach an account you control? A settlement deferred by several days is a cash-flow cost you will never see on an invoice, and a fee charged on every payout adds up fast.

Then come the costs that appear on no quote: development time, manual reconciliation when exports do not speak to your accounting, and the cash you keep handling on the side when the provider does not collect it. For the full comparison method, read how to choose a payment platform in Morocco: eight questions to ask, of us as of anyone else.

Our numbers

ChariPay's prices fit in a few lines, and the pricing page says nothing more.

• The sandbox is free, with no time limit and no commitment. You build and test your whole integration before signing anything.
• The activation fee is MAD 6,000, VAT included, paid once, when you go live. Nothing before.
• The commission is a percentage per successful transaction. It is set after your application is reviewed — your products, your payment methods, your volumes —, and the security deposit with it. The proposal arrives with figures, before any commitment; we do not publish a "from" percentage, which would say nothing about your application.
• Refunding a customer is free, in full or in part.
• Funds are available instantly in your payment account, with a RIB in your company's name. The payout to your bank happens automatically every night once a settlement account is configured, or by transfer on demand. From that account you can also pay bills and make transfers: what you have just collected is already usable. The Wallet & payouts page details these uses.

The steps: from sandbox to production

There are two sets of steps, and they are nothing alike. The first asks nothing of anyone: it is test mode, which you open yourself, for free and with no time limit. The second is administrative: enabling production, which requires a verified company. The eight steps below take you from sign-up to your first real payment.

1. 1Create your account. Create your test account on the merchant portal: three fields — name, work e-mail, company. No documents, no meeting, no card required.
2. 2Activate it from the e-mail. The activation link you receive by e-mail lets you choose your password; the activation token exists only in that e-mail. Test mode is open from that moment: no approval to wait for.
3. 3Log in and select your company. Depending on your account's permissions, the portal may ask you to enroll a two-factor authentication app; keep your recovery codes. The portal is available in French and English.
4. 4Create your test key. Creating a key is a sensitive action: the portal asks you to confirm again, then you choose its permissions — grant only what your integration calls. The key starts with chari_sk_test_ and is shown only once: store it in a vault or an environment variable, never in page code (Protecting your API keys).
5. 5Make a first test payment. Create a payment link or a session, then pay with the test card 4918914107195005, CVV 123, any future expiry date and 3-D Secure code 555. No real money moves, and webhooks are sent just as in production.
6. 6Build your integration. A link from the portal, a session and a webhook through the API, or a subscription: test the full journey, failures and refunds included. A GET /v1/wallet that answers confirms your key is properly authenticated.
7. 7Get your company verified. KYB verification — identity documents and trade register, with dual human review — is done from the portal, in parallel with the integration. The team reviews your application and sends you a proposal with figures: commission and security deposit.
8. 8Pay the activation fee and switch. Once the MAD 6,000, VAT included, is paid, you launch the check from the portal and your production key is created automatically. On switch-over day, you change the key — and the webhook signing secret, which differs between sandbox and production.

The base URL is the same in both environments — https://api-psp.charipay.ma — because the key chooses the environment, not the address. Until production is enabled, a chari_sk_live_ key gets an explicit 403 with the code PRODUCTION_ACCESS_NOT_ENABLED: that is not an integration bug, it is an administrative step that is not finished yet. Your developer can therefore prepare the production configuration without risk, and the sandbox then remains your staging environment. The list of what to check before switching is in Sandbox to production: the go-live list, and the Getting started guide in the API documentation walks through every request.

Who can accept online payments: the KYB documents

The question comes up in every form: do you need a limited company, can a self-employed auto-entrepreneur accept online payments, can an association collect membership fees by card? The honest answer comes in two parts.

To test, you need nothing: test mode opens at sign-up, whatever your legal form, with no document to provide. It is the right time to build and validate your payment journey, before any paperwork.

To collect real payments, your company goes through KYB verification — "know your business", the obligation for a payment institution to know who it is collecting for. The documents requested depend on your legal form and are specified during KYB verification (identity, trade register). They are examined with dual human review, and this verification is only required to go live. We publish neither a list per legal form nor a timeline: the portal tells you what is expected in your case. Your legal adviser or accountant remains the only one able to rule on your own obligations — status, invoicing, VAT.

A note for networks: if you collect on behalf of other merchants — franchisees, points of sale, a marketplace —, each sub-merchant is verified like any merchant, documents and trade register, before collecting in production.

Integration, depending on your situation

There is no one right integration, there are four, and yours depends on two questions: do you have a developer, and do you collect once or on a schedule? If you sell through an online shop, the guide to e-commerce payments in Morocco applies these choices to your cart, Shopify and WooCommerce included.

Without a developer: payment links

Your shop runs on Shopify, WooCommerce or Instagram, and nobody on the team writes code. The circuit takes three moves: the order comes in, you create a payment link for the exact amount from the portal, you send it to the customer — WhatsApp, e-mail, or a QR code on the delivery note. The customer pays by card or in cash at an agency; the portal shows it to you, and you mark the order as paid in your shop. There is no extension to install, and we do not promise one: the link first, then the checkout through the API when volume justifies automating. The guides to Shopify and WooCommerce in Morocco walk through this circuit step by step.

The portal is built for a team, not a single person: it distinguishes the owner, manager, cashier and accountant roles, accepts several users, and exports your collections to CSV for your accounting.

With a developer: sessions and webhooks

With a developer, the integration comes down to two pieces: create a payment session for every order, and handle the notification that comes back. The Checkout sessions module of the documentation describes creation, shown here in curl:

curl -X POST https://api-psp.charipay.ma/v1/payment-sessions \
  -H "X-CHARI-PAY-API-KEY: chari_sk_test_…" \
  -H "Idempotency-Key: order-2026-0001" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 250.00,
    "orderId": "ORD-2026-0001",
    "externalId": "order-2026-0001",
    "config": {
      "customer": {
        "firstName": "Amine", "lastName": "Bennani",
        "email": "amine@example.com", "phone": "+212600000000"
      },
      "urls": {
        "accept": "https://votre-boutique.ma/merci",
        "decline": "https://votre-boutique.ma/echec",
        "notification": "https://votre-boutique.ma/webhooks/charipay"
      }
    }
  }'

The amount is in dirhams, with no currency field: the API works in MAD only. The response carries the checkoutUrl to which you redirect the buyer. The Idempotency-Key header, derived from your order reference, makes the call safe to replay; the externalId, unique per environment, means a second call for the same order returns the existing session with a 200 instead of creating a new one.

The second piece is your webhook endpoint, described in the Webhooks module. Every delivery carries X-CHARI-SIGNATURE, a hex-encoded HMAC-SHA256 computed over the string timestamp + "." + raw body, and X-CHARI-TIMESTAMP, the timestamp in milliseconds. Verification fits in a few lines of Node:

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyChariSignature(rawBody, headers, secret) {
  const timestamp = headers['x-chari-timestamp'];
  const signature = headers['x-chari-signature'];
  if (!timestamp || !signature) return false;

  // 5-minute tolerance, matching the ChariPay side
  if (Math.abs(Date.now() - Number(timestamp)) > 5 * 60 * 1000) return false;

  const expected = createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');
  return expected.length === signature.length
    && timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Four rules are enough after that. Verify against the raw body, before any parsing. Deduplicate on Chari-Event-Id: the same event can be delivered more than once, and that is a guarantee, not a defect. Answer 200 as soon as the event is stored somewhere, and do the rest in the background. And if your server does not answer, nothing is lost: delivery is retried at 1 min, 5 min, 30 min, 1 h, then every 6 h, up to 16 attempts over roughly 72 hours, and the portal's delivery log lets you replay any delivery in one click. Getting your webhook integration right details the five mistakes we see most often, and the guide to the payment API in Morocco covers the full integration, in Node and Python.

Subscriptions

A subscription adds one step before the payment: the client, created with POST /v1/clients, then the subscription, opened with POST /v1/subscriptions — both can also be created from the portal, without code. On every due date, ChariPay e-mails the customer a single-use payment link; the subscription stays INCOMPLETE until the first payment, then turns ACTIVE. Your server receives subscription.payment_succeeded when an installment is paid, subscription.payment_failed when a card attempt on the link fails — the link stays payable — and subscription.canceled on cancellation. In the sandbox, a start date set to today sends the first link right away, and a daily frequency brings the second installment the next day; the rest is described on the Subscriptions page.

Marketplace and distribution

If you collect on behalf of a network — a marketplace, franchisees, points of sale —, each entity can be declared as a sub-merchant, with its own wallet and its own verification, and the payment session names, in config.settlement, the wallet to credit. The setup is prepared with the integration team; the Distribution page gives the outline.

Security and compliance

Three frameworks overlap when you accept an online payment, and each answers a different question.

• PCI DSS Level 1: who sees the cards? ChariPay is a PCI DSS Level 1 certified platform, renewed every year. Card numbers are never written to a database; your site never sees them, and your scope stays that of a merchant who never sees a card number. Which self-assessment questionnaire applies to you is confirmed with your adviser or your acquirer.
• 3-D Secure: who is paying? Card payments go through the 3-D Secure authentication requested by the buyer's bank. Open the payment page in the main tab, never in a hidden iframe: bank authentication does not work properly otherwise.
• Law 09-08: what happens to the data? Personal data is processed within the framework of Law 09-08; sensitive data is masked in logs, and exports of personal data are strictly controlled.

On the account side, the portal adds what you expect from a tool that moves money: two-factor authentication, re-authentication before every sensitive action, dual approval on payouts, a cryptographically chained audit log. Webhooks are signed with HMAC-SHA256, with a five-minute anti-replay window, and signing secrets differ between sandbox and production. The detail of the controls is on the Security page.

PayPal and foreign gateways in Morocco

Morocco is not on Stripe's official list of countries where it is available, checked again on October 2, 2026: a company established in Morocco cannot open an account there, and setups through a foreign company move the problem — funds outside Morocco, foreign exchange, VAT — more than they solve it, to be validated with your adviser. PayPal, for its part, publishes a home page for Morocco, with one section for individuals and another for businesses; its official pages are where to check what its offer covers for your business. Both topics are covered in full in Stripe in Morocco and PayPal in Morocco.

The classic mistakes

We see a lot of integrations go by. The same mistakes keep coming back, and none of them is technical in the strict sense: they are shortcuts taken on day one and paid for in month three.

• Shipping on the return page. A buyer who closes the tab after paying will never see your confirmation page. If your order is only confirmed there, it never will be — while the money did arrive in your payment account. The rule is simple: the return page says thank you, the webhook ships.
• Forgetting idempotency. A network that drops between your call and our response, a user who double-clicks, a replayed job: without an Idempotency-Key on your creates and without a unique externalId, you will end up creating two sessions for one order, or shipping twice. Never charge twice — idempotency explained shows how to derive these keys from your own references.
• Ignoring cash. The merchant who only accepts cards online keeps handling cash on delivery, outside any system, and does not count it as a cost. Offering the agency deposit, through a payment link, brings that money back into the statement, before shipping.
• Reconciling by hand. Comparing a bank statement with an order sheet at every month end is the symptom of an integration that did not use externalId and metadata. These fields come back on every notification and in the CSV exports: reconciliation becomes a join, not a read-through. Reconciling your collections with your accounts shows the method, time zone included.
• Switching the key without switching the secret. On go-live day, the API key changes and so does the webhook signing secret. Forgetting the second gives the most baffling incident there is: payments go through, orders don't ship.

Frequently asked questions

How do I accept online payments in Morocco?

You need a provider backed by an institution licensed by Bank Al-Maghrib, an account to receive the money, and a collection tool suited to the way you sell. With ChariPay, you open test mode for free, choose between a payment link, a hosted checkout and a subscription, test with the test card, then pass KYB verification and pay the activation fee to collect real payments.

Which payment methods should I offer?

At a minimum, cards with 3-D Secure — Visa, Mastercard and Maroc Pay are accepted by default — and, if some of your customers pay in cash, cash at an agency against a reference. Both trigger the same signed notification and credit the same payment account; cash goes through a single-use payment link, one reference per deposit. Other methods can be enabled on request with the team, depending on your business.

Can customers without a card pay?

Yes. On a payment link's page, the customer chooses cash, receives a reference and deposits the amount at an agency of the Chari network. You are notified as soon as the network confirms the deposit, and the money is available instantly in your payment account. ChariPay is the only payment gateway in Morocco that also collects cash at agencies, without changing tool or statement.

Do I need a website?

No. A payment link is created from the portal and shared by WhatsApp, e-mail, QR code or PDF poster: the customer pays on a hosted page in your name. To sell a small catalog without a site, the hosted e-commerce storefront publishes your products and tracks your orders. A website becomes useful when you want a cart and a payment built into your own checkout flow.

How much does it cost?

The sandbox is free, with no time limit. Going live costs an activation fee of MAD 6,000, VAT included, paid once. The commission per successful transaction and the security deposit are set after your application is reviewed, based on your products, payment methods and volumes, and you know them before you commit. Refunding a customer is free.

When is the money available?

The instant the payment succeeds: by card, as soon as the buyer's bank confirms; in cash, as soon as the network confirms the deposit. The amount is available in your payment account, with a RIB in your company's name, and can be used for a transfer or a bill payment. The payout to your bank is automatic every night, or happens on demand.

Do I need a developer?

No, not to get started. Payment links are created and sent from the portal, without a line of code, and are enough as long as you handle your orders by hand. A developer becomes useful when volume calls for automation — one session per order, the order updated by webhook — or when your subscriptions need to be created from your own software rather than from the portal.

Can I use Stripe or PayPal?

Stripe, no: Morocco is not on its official list of supported countries, checked again on October 2, 2026. PayPal publishes a home page for Morocco, with one section for individuals and another for businesses; check its official pages for what its offer covers for your business, and read our article on PayPal in Morocco. Setups through a foreign company raise foreign-exchange and tax questions, to be validated with your adviser before you commit.

Which currency?

The Moroccan dirham, only. API amounts are in MAD, in major units with two decimals; so are balances, refunds and payouts, and the payment page always shows the amount in dirhams. No conversion stands between what your customer pays and what your accounting records. For customers abroad, ask us with your specific case before launching the offer.

How do I test before going live?

Open test mode from the portal: sign-up in three fields, activation by e-mail, a password, then a test key you create yourself. Pay with the test card 4918 9141 0719 5005, CVV 123, 3-D Secure code 555, and check that your server receives the webhook. It is free, has no time limit, and no approval is needed before you start.

Next step

You now know what you want to accept, and how. Start in test mode: three fields, an activation e-mail, your password, then your test key and a first payment with the test card — free, with no time limit, no approval to wait for. Then pick your tool on the payment links page or in the API documentation, depending on whether you have a developer.

Sources

• Competition Council (Conseil de la concurrence) — press release of May 19, 2025 (decision No. 152/D/2024 of October 31, 2024) — read on 2026-10-02
• Bank Al-Maghrib — Payment systems and means of payment (Law No. 103-12, payment institutions) — read on 2026-10-02
• Bank Al-Maghrib — Structure of the banking system (figures at end-2024) — read on 2026-10-02
• Stripe — Global availability — read on 2026-10-02
• PayPal Morocco — home page — read on 2026-10-02