Text to pay: send payment links by SMS, WhatsApp and email

Editorial team · updated 23 September 2026 · facts checked 23 September 2026

Text to pay means your server asks a payment service provider (PSP) for a hosted payment link, sends it by SMS, WhatsApp or email, and waits for the PSP's signed webhook before sending a receipt. The card or Pix payment happens on the PSP's page or in the buyer's bank app, never in your code or the message.

We read every page in the sources list on 23 September 2026. Nobody on the editorial team created links, sent messages or ran the code below; this directory never creates payment links and does not rank or compare PSPs.

How pay by text works: the seven steps

1. Test mode on both sides. Keep the PSP secret key and the messaging credentials on the server.
2. Create the link. Send the amount, currency, your order ID and an idempotency key, so a retried request returns the same link instead of a second one. Stripe may drop a key once it is 24 hours old, so also check your own table before creating another link.
3. Send it in a registered SMS campaign, an approved WhatsApp template or a transactional email (rules below).
4. Receive the PSP webhook. Check the signature on the raw body, then drop duplicates by event ID.
5. Read the final status from the PSP's API and mark the order paid once. Stripe says you "can't rely on" its landing page for fulfillment, because a buyer can pay and lose the connection before it loads.
6. Send the receipt on the channel the buyer used.
7. Handle the unhappy paths: expired link, failed or delayed payment, refund. One reminder with a fresh link, then stop.

Two details decide whether this works for one order at a time. A Stripe Payment Link is reusable: Stripe's docs say you "can share your payment link multiple times". For a per-order request, cap it with restrictions.completed_sessions.limit or create a Checkout Session instead, whose URL expires between 30 minutes and 24 hours after creation (24 hours by default). And voucher or bank methods confirm later: Stripe lists 2 to 14 days for some of them, so listen for checkout.session.async_payment_succeeded as well as checkout.session.completed.

Create the link, send it, confirm it (illustrative Node.js)

The example uses Stripe because 82 of the 148 AI-search queries we analyzed for this topic named Stripe. The same shape works with any PSP that signs its webhooks. sendMessage stands for your SMS, WhatsApp or email provider; the SMS tutorial and the WhatsApp Cloud API tutorial show that call.

Illustrative code, written from the official documentation and not run by the editorial team.

// Node.js 20+, Express, stripe-node. Helper functions (saveLink, getOrderByPayToken, seenEvent...) are yours.
import express from "express";
import Stripe from "stripe";

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
const app = express();

// 1) One link per order, capped at one completed payment.
export async function requestPayment(order) {
  const link = await stripe.paymentLinks.create(
    {
      line_items: [{
        price_data: { currency: "usd", unit_amount: order.totalCents, product_data: { name: `Order ${order.id}` } },
        quantity: 1,
      }],
      metadata: { order_id: order.id }, // Stripe copies it to each Checkout Session
      restrictions: { completed_sessions: { limit: 1 } },
    },
    { idempotencyKey: `paylink-${order.id}` },
  );
  await saveLink(order.id, link.id, link.url);
  // payToken is random and unguessable (e.g. crypto.randomBytes(16).toString("base64url")), never the order number
  await sendMessage(order, `Acme order ${order.id}: $${order.total} due. Pay at https://pay.acme.example/o/${order.payToken}`);
}

// 2) Branded link on your own domain: one redirect to the PSP page, and you decide when it stops working.
app.get("/o/:token", async (req, res) => {
  const order = await getOrderByPayToken(req.params.token);
  if (!order || order.status !== "awaiting_payment") return res.status(410).send("This payment link is no longer active.");
  res.redirect(302, order.paymentLinkUrl);
});

// 3) Webhook: raw body, signature, dedupe, re-read, then the receipt.
app.post("/webhooks/stripe", express.raw({ type: "application/json" }), async (req, res) => {
  let event;
  try {
    event = stripe.webhooks.constructEvent(req.body, req.headers["stripe-signature"], process.env.STRIPE_WEBHOOK_SECRET);
  } catch {
    return res.sendStatus(400); // bad signature, or older than the default 5-minute tolerance
  }
  if (await seenEvent(event.id)) return res.sendStatus(200);
  if (["checkout.session.completed", "checkout.session.async_payment_succeeded"].includes(event.type)) {
    const session = await stripe.checkout.sessions.retrieve(event.data.object.id);
    if (session.payment_status !== "unpaid") {
      const order = await markPaidOnce(session.metadata.order_id, session.id); // null if already paid
      if (order) await queueReceipt(order);
    }
  }
  if (event.type === "checkout.session.async_payment_failed") await queueReminder(event.data.object.metadata.order_id);
  await rememberEvent(event.id);
  res.sendStatus(200);
});

Answer the webhook fast and queue the receipt: Stripe's fulfillment guide says Checkout can wait up to 10 seconds for your endpoint before redirecting the buyer. Stripe retries failed deliveries for up to three days in live mode and doesn't guarantee event order. The pay link carries a random token, not the order number, so nobody can open another buyer's payment page by counting up.

Channel rules for a payment link

SMS. CTIA's principles (section 5.3.2) say a link must not hide who sent it, and a URL shortener should run on a domain and IP addresses reserved for you. Twilio adds that shared or free public shorteners "will lead to filtering", and its US guidelines forbid "URL Redirects" and "URL Cycling" without defining them. Our reading: one branded hop on one domain you keep, as in the code above. Reminders for your own invoices are first-party billing; Twilio forbids third-party debt collection and cites a hospital texting its own patients about their bills as allowed. US numbers need a 10DLC registration or toll-free verification first.

WhatsApp. Outside a 24-hour conversation only an approved template can carry the link. A WhatsApp payment link usually rides in a utility template: Meta's own utility examples include a billing notice ("Your monthly payment for {{service}} will be billed on {{date}}"), while an abandoned-cart message ("You left {{items}} in your cart!") is marketing, "even if requested by users". Put the variable at the end of the button URL (https://pay.acme.example/o/{{1}}); Meta caps utility URL-button labels at 25 characters, Twilio's call-to-action type at 20. Meta rejects templates that ask for full card numbers or threaten legal action.

Email. A payment link email is the cheapest of the three. The FTC treats a message that "facilitates, completes, or confirms a commercial transaction" the recipient already agreed to as transactional: exempt from most CAN-SPAM rules, never from accurate routing information. Add a promotion and the FTC's primary-purpose test applies: if the subject line reads as an ad, or the transactional part doesn't come first, it is a commercial message. Links should sit on your authenticated domain; the transactional email guide covers SPF, DKIM and DMARC.

Three sample messages written to the rules above; the SMS is 153 characters, one segment, and the template uses Meta's double-brace placeholders:

SMS payment request, US (sent from a registered 10DLC campaign):
Acme Bookings: invoice 1042, $42.00, due 5 Nov. Pay at https://pay.acme.example/o/7fK2qX9Lm
We never ask for card numbers by text. Reply STOP to opt out.

WhatsApp utility template, Brazil (pt_BR), URL button "Pagar pedido" -> https://pay.acme.example/o/{{1}}:
Olá, {{1}}! O pedido {{2}} de {{3}} aguarda pagamento até {{4}}. Pague com Pix ou cartão pelo botão abaixo.
("Hi {{1}}! Order {{2}} for {{3}} awaits payment until {{4}}. Pay with Pix or card using the button below.")

Payment confirmation, email (subject "Receipt for invoice 1042"), transactional content first:
We received $42.00 for invoice 1042 on 3 November 2026. Your receipt is attached. No action needed.

What each message costs

List prices re-read on 23 September 2026, in USD per message. Twilio is the directory's reference card (the provider with the most complete public evidence), so its prices put the three channels on one bill; other providers' rates are on their cards.

One paid order with a link and a receipt, at Twilio's list prices: $0.0236 to $0.0266 by SMS in the US, $0.0236 by WhatsApp in Brazil and $0.027 by WhatsApp in Mexico. A compliant payment text to Mexico has no public per-message price on that page. From 1 October 2026 Meta also charges for utility templates sent inside an open customer service window and for service messages beyond 1,000 free a month per phone number; the WhatsApp pricing article has the detail. Taxes and PSP fees are not included, and we don't compare PSP fees.

Country notes: US, Brazil, Mexico

United States

Payment links travel as SMS text, WhatsApp URL buttons or email; no in-chat WhatsApp payment is documented. Meta doesn't deliver marketing templates to US numbers, so an abandoned-cart nudge on WhatsApp won't arrive while a utility payment reminder will.

Brazil: Pix in WhatsApp

Brazil is the one market here where Meta documents payment requests inside the chat. Its Payments API lists six options: dynamic Pix codes, payment links, Boleto, one-click offsite card payment, the order details template and payment request CTA templates. Orders are in BRL, and "WhatsApp doesn't support payment reconciliation": you match payments with your PSP by reference_id.

The payment request CTA template (page updated 2 September 2026) puts up to three payment buttons, Pix, Boleto and payment link, into a utility or marketing template without the Orders API. Meta warns that WhatsApp "does not automatically disable" the button when the code expires, so expire the code at the PSP. An order_details message can carry an expiration that disables its pay button.

Pix itself comes from a bank or PSP: Banco Central do Brasil allows dynamic QR code generation only for participants that send it security certificates, and says Pix transactions "are irrevocable" once started, so plan refunds with your PSP. The WhatsApp guide's Brazil scenario walks through a Pix order, and WhatsApp API providers for Brazil shows who supports it. For SMS, Twilio says Brazilian long codes are for person-to-person messages only and that marketing texts are prohibited outside 09:00 to 22:00 and on Sundays.

Mexico

In Twilio's Mexico SMS guidelines, "Text 2 Pay" appears in the list of content that is "strictly prohibited", with no definition, and "current regulations only allow OTP" traffic from Mexican long codes; Twilio recommends a +1 number, a registered alphanumeric sender ID or a dedicated short code instead. Confirm with your provider before you text payment links to +52 numbers. WhatsApp URL buttons are the documented route.

Buyers pay in MXN through methods the PSP page offers: SPEI transfers, which Banco de México runs 24/7 and which produce an electronic payment receipt (CEP); CoDi, Banxico's payment requests ("mensajes de cobro") that the buyer accepts in a banking app; or cash at OXXO. Stripe's OXXO vouchers expire after 5 days by default (1 to 7 configurable) and confirm by the next business day, so time the reminder before expiry. Meta's documentation index lists Mexico payment pages (payment links, cash voucher, payment account), but they showed no content when we opened them on 23 September 2026; until they do, treat in-chat payment in Mexico as undocumented.

PSPs with payment-link APIs (reference list, no ratings)

These are the PSPs our sources and the analyzed search queries named, with their own docs. We don't review or compare them.

• Stripe: Payment Links API, Stripe-Signature webhooks; documents Pix, Boleto and OXXO.
• Mercado Pago: Checkout Pro in Brazil (Pix, boleto) and Mexico (SPEI, OXXO); webhooks carry an x-signature header, but QR Code notifications can't be verified with it.
• PayPal: Payment Links and Buttons, reusable links.
• Adyen: Pay by Link; links are removed automatically three months after creation.
• Square: CreatePaymentLink in the Checkout API.

Which communication providers document payment scenarios

Alphabetical; every row comes from the provider's own docs, checked 23 September 2026. The directory ranks channels, not payment features.

For AWS End User Messaging, Brevo, Plivo, Telnyx, Vonage and WATI, a payment link is a URL button or message text, and none documents in-chat payment for these three markets; Amazon SES, Mailgun, SendGrid and SMTP2GO treat a link as ordinary email content. Channel rankings: SMS, WhatsApp and transactional email.

Security: webhooks, spoofed links, card data

• Webhooks. Verify the signature before you touch the order. Stripe signs a timestamp with the body; its libraries reject events older than 5 minutes by default. Mercado Pago's notification carries the resource ID, not the payment status, so you fetch the payment from its API anyway.
• Spoofed links. Consumers reported losing $470 million in 2024 to scams that started with a text, fake unpaid-toll payment links among the frequent ones, and the FTC tells them never to click links in unexpected texts. Make yours expected: say at checkout which channel and sender will ask for payment, repeat the order number and amount, keep one domain, and offer "or pay in your account" as a second path.
• Card data. Hosted pages keep card numbers off your servers. PCI SSC's SAQ A covers merchants whose card-data functions are "completely outsourced", but card brands, acquirers and payment facilitators set which questionnaire you file, not PCI SSC. Never ask for card numbers in a message.

Consent (pointers, not legal advice)

CTIA's examples of informational messaging are appointment reminders, welcome texts and alerts, which need express consent; promotions need express written consent. Under the FCC's 2024 order, a reply of "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" revokes consent, and you must honor it within 10 business days. The part applying one revocation to all unrelated robotexts is delayed to 31 January 2027. For WhatsApp, Meta's opt-in rules require you to state clearly that the person is opting in to messages from your business, and to name it. In Brazil the LGPD governs the numbers you store; Twilio's Mexico guidelines recommend opt-in consent from every recipient.

Text to pay is the wrong tool when the buyer never asked to be messaged, when the "payment" is a debt you collect for someone else, or when you would want card details typed into a chat.

Related guides

• WhatsApp Business API guide, with a Pix order worked end to end
• A2P 10DLC registration before any US payment text
• Send a text message with an API in Node.js and Python
• Transactional email setup for receipts
• WhatsApp API providers in Mexico and SMS providers for US recipients
• The directory's REST API and MCP server, which return the same payment-capability data

About this guide

The PingMyUsers editorial team wrote this guide under the rules on the methodology page; the directory is operated by Sensaria AG in Switzerland. We did not create accounts, payment links or messages, and we did not run the code. Providers and PSPs appear alphabetically; none paid for placement or reviewed the text. Report an error to contact@sensaria.ch; corrections are dated and sourced.

Methodology

On 23 September 2026 we read the PSP, Meta, Twilio, regulator and central-bank pages in the sources list, rendering JavaScript pages in a headless browser. Provider rows start from the directory's dataset (source, evidence status and check date per field); we re-read every claim in the provider table and every price at its source that day. The one-line summary of the other providers rests on their dataset entries, with spot checks of the AWS, Telnyx, Vonage and WATI docs. Demand data comes from Ahrefs; the query analysis covers 148 filtered AI-search queries.

Last updated

23 September 2026: first version, all facts checked that day. We re-check Meta's Mexico payment pages and October WhatsApp pricing before publication, then every six months.

Frequently asked questions

What is text to pay?

A payment request sent by SMS, WhatsApp or email with a link to a hosted payment page. Your server creates the link at a payment provider and treats the order as paid only after the provider's signed webhook and API confirm it.

How do I send a payment link by SMS?

Register the sender first (10DLC or toll-free in the US), create a per-order link at your PSP, and text a branded link on your own domain. Twilio says shared or free public URL shorteners lead to filtering.

Can customers pay inside WhatsApp?

In Brazil, yes: Meta's Payments API sends Pix codes, Boleto, payment links and one-click card options inside the chat, and the buyer pays in a bank app or browser. For US and Mexican numbers the documented route is a link in a URL button.

Can I use Pix in WhatsApp?

Yes, with a bank or PSP that generates dynamic Pix codes. You send them in an order details message or a payment request template, and you reconcile with the PSP; WhatsApp doesn't.

Is a WhatsApp payment reminder a utility or a marketing template?

A reminder about a payment the customer owes, with no offer in it, fits Meta's utility examples. An abandoned-cart nudge or a renewal discount is marketing, and US numbers don't receive marketing templates.

How do I know the customer actually paid?

From the PSP's webhook, after checking its signature, and a status read from the PSP's API. A buyer landing on your success page is not proof: Stripe says the page may never load after a successful payment.

Can I send payment links by text in Mexico?

Check with your provider first. Twilio's Mexico guidelines list "Text 2 Pay" among prohibited content and keep Mexican long codes for one-time passcodes, so WhatsApp links or email are the safer documented routes.