Tabby BNPL
Install and configure Tabby Buy Now Pay Later integration for KSA, UAE, and Kuwait.
Tabby BNPL Integration
Tabby is the leading Buy Now, Pay Later (BNPL) platform in Saudi Arabia, UAE, and Kuwait. The Linkit Tabby integration provides 7 apps covering the full BNPL lifecycle — from checkout session creation to dispute management.
Tabby is regulated by SAMA (Saudi Arabian Monetary Authority) and supports SAR, AED, and KWD currencies.
Prerequisites
- A Tabby merchant account (merchant.tabby.sa for KSA)
merchant_codeandsecret_keyfrom Tabby onboarding- Linkit organization with at least one connected platform (Salla, Zid, HungerStation, etc.)
Available Apps
| App | Type | Purpose |
|---|---|---|
| Tabby Checkout | Payments | Create BNPL checkout sessions with customer eligibility scoring |
| Tabby Payments | Payments | Capture, refund, and close payment lifecycle management |
| Tabby Webhook Bridge | Automation | Register and receive Tabby payment status webhooks |
| Tabby Disputes | Payments | List, challenge, and submit evidence for payment disputes |
| Tabby BNPL Analytics | Analytics | BNPL adoption rates, approval rates, and conversion tracking |
| Tabby POS Payment Links | POS | In-store QR code payment links for POS transactions |
| Tabby Reconciliation | Automation | Cron-based payment status sync and missed webhook recovery |
Installation
- Navigate to App Store in the Linkit dashboard
- Search for Tabby in the Payments or POS categories
- Install the desired apps (all are independent — install only what you need)
- Enter your Tabby credentials in the app configuration modal:
- Merchant Code — from Tabby merchant portal
- Secret Key — API secret key for authentication
- Base URL —
https://api.tabby.sa(KSA) orhttps://api.tabby.ai(UAE/Kuwait)
Configuration
Each installed Tabby app reads credentials from the organization app's custom params:
| Parameter | Description | Default |
|---|---|---|
merchant_code | Your Tabby merchant code | — |
tabby_secret_key | API secret key (or use the API Secret field) | — |
tabby_base_url | API endpoint | https://api.tabby.sa |
auto_capture | Auto-capture authorized payments | false |
default_currency | Default currency for sessions | SAR |
default_lang | Checkout language | ar |
webhook_auth_token | Custom auth token for webhook verification | — |
POS Integration
Tabby POS payment links are managed via the Unified Providers Paylinks API with "provider": "tabby":
POST /api/v1/providers/paylinks — Create payment link
GET /api/v1/providers/paylinks — List payment links
GET /api/v1/providers/paylinks/{id} — Check status
POST /api/v1/providers/paylinks/{id}/capture — Capture payment
POST /api/v1/providers/paylinks/{id}/cancel — Cancel linkFlow
- Cashier creates an order → calls
POST /api/v1/providers/paylinkswith"provider": "tabby" - QR code URL is returned → display to customer
- Customer scans QR → completes Tabby checkout on their phone
- Tabby webhook confirms authorization → auto-capture if enabled
- Cashier confirms → order marked as paid
See the Providers Paylinks API Reference for full endpoint documentation.
Webhooks
The Tabby Webhook Bridge app registers a webhook URL with Tabby and handles incoming events:
authorized— Customer completed checkout, ready for captureclosed— Payment fully captured and settledexpired— Session timed out without completionrejected— Customer not eligible for BNPL
Tabby sends webhooks from specific IP addresses. Ensure your firewall allows:
34.166.36.90, 34.166.35.211, 34.166.34.222, 34.166.37.207, 34.93.76.191, 34.166.128.182, 34.166.170.3, 34.166.249.7
Data Collections
| Collection | Purpose |
|---|---|
tabby_webhooks | Raw webhook audit trail for all incoming Tabby events |
tabby_paylinks | POS payment link records with session/payment tracking |
Regional Endpoints
| Region | API | Checkout | Merchant Portal |
|---|---|---|---|
| Saudi Arabia | api.tabby.sa | checkout.tabby.sa | merchant.tabby.sa |
| UAE / Kuwait | api.tabby.ai | checkout.tabby.ai | merchant.tabby.ai |
Testing
Tabby provides testing credentials and a Postman collection:
Set is_test: true in your webhook registration to receive test events only.