High-Level Solution Architecture
Amwal provides a secure, cloud-native payment orchestration platform regulated by the Saudi Central Bank (SAMA, License PSP013) and certified under PCI-DSS Level 1.
Architecture Diagram
The diagram below illustrates the direct service flow between the Merchant Application and the Amwal Payment Platform:
Rendering diagram...
Service Flow Overview
Rendering diagram...
Integration & Operating Model
- Session Creation: The merchant backend server issues a secure server-to-server request (
POST /payment_links/{store_id}/create) using their private API Secret Key. - Hosted Checkout Redirection: Amwal returns a unique
payment_url. The merchant redirects the customer to Amwal's PCI-compliant checkout modal (pay.sa.amwal.tech). - Biometric Passkey & 0% Bank Installments:
- Customers complete payment in 1 click using Biometric Passkeys (Touch ID, Face ID).
- Eligible Saudi credit cards can convert their purchase into 0% Bank Installments (3, 6, 12, or 24 months).
- Order Reconciliation via Signed Webhooks: Upon payment authorization, Amwal immediately delivers an RSA-PSS SHA-256 signed
order.successnotification to the merchant's webhook endpoint for automated fulfillment.
Security & Compliance Highlights
| Dimension | Specification |
|---|---|
| Regulatory License | Authorized & Regulated by Saudi Central Bank (SAMA License PSP013). |
| Card Data Security | PCI-DSS Level 1 Certified. Zero raw card data touches merchant servers. |
| Authentication | Passwordless FIDO2 / WebAuthn Biometric Passkeys reducing checkout drop-off. |
| Integrity & Encryption | TLS 1.3 transport encryption and RSA-PSS SHA-256 cryptographic webhook signatures. |