Adding KHQR to a website means wiring in one of three things: a bank's payment gateway such as ABA PayWay, a Bakong-certified aggregator, or a direct integration with the National Bank of Cambodia's own Bakong Open API. Each produces a QR code a Cambodian customer can scan from any bank app, but they differ sharply in cost, control, and how much confirmation logic the development team has to build itself.
Skipping the decision is not really an option anymore. Over 4.5 million merchants across Cambodia already accept KHQR (fintechcambodia.net, 2025 data), and the National Bank of Cambodia counts roughly 30 million registered Bakong wallets, 1.69 times the country's population of about 17.9 million (Ledger Insights, March 2025; UNFPA, 2024 revision). This guide covers what each path requires and which fits a given order volume; our wider guide to ecommerce in Cambodia covers the platform and delivery side of that decision.
What Does "Integrating KHQR" Mean for a Website?
Integrating KHQR into a website means the site generates a fresh, order-specific QR code for every transaction and receives an automatic confirmation the moment it is paid, rather than showing one fixed image and waiting for a person to check a bank app manually.
The QR itself follows the EMVCo QR Code Specification for Payment Systems, the same standard behind Thailand's PromptPay and Singapore's PayNow, extended with Cambodia-specific fields. Every generated code carries a unique transaction identifier, and the National Bank of Cambodia's own KHQR SDK documentation (version 2.9, May 2025) requires an MD5 hash of that string so a payment matches back to the order that created it.
That is a different object from the counter QR a business gets by registering with an NBC-licensed bank and printing the code from its merchant portal (fintechcambodia.net). It works for a coffee shop till, not a checkout page: it carries no amount and never confirms whether anyone paid.
What Are the Three Ways to Add KHQR Checkout to a Website?
A website can add KHQR checkout through a bank's payment gateway such as ABA PayWay, a Bakong-certified aggregator packaging several banks under one contract, or a direct integration with the National Bank of Cambodia's public Bakong Open API using an open-source SDK.
| Path | Who you contract with | Card support alongside KHQR | Confirmation method |
|---|---|---|---|
| Bank gateway (e.g. ABA PayWay) | The bank itself | Yes: cards, ABA Pay, WeChat Pay, Alipay | Webhook callback plus a Check Transaction API call |
| Certified aggregator | A licensed third-party payment service provider | Varies by aggregator | The aggregator's own webhook |
| Bakong Open API + open-source SDK | Nobody: you use your own bank's existing Bakong account | No, KHQR only | You poll a status endpoint yourself |
ABA PayWay is a common default because ABA is Cambodia's largest bank by assets, deposits and loans, with $16.2 billion in assets and upwards of 4.5 million customers in 2025 (Cambodia Investment Review, April 2026), but ACLEDA, Wing and other NBC-connected institutions run comparable gateways.
How Does the KHQR/Bakong API Work Behind the Scenes?
Most guides treat "the Bakong API" as one thing a business calls directly, but the National Bank of Cambodia's public Bakong Open API only works on top of a Bakong account ID a business already holds at a participating bank: it checks whether a payment landed, it does not turn a business into its own payment processor.
A commercial gateway like ABA PayWay sits a layer above that. Its QR API accepts a request at POST /api/payment-gateway/v1/payments/generate-qr, signed with an HMAC-SHA512 hash, and returns the raw QR string plus a ready-to-display image, with validity configurable from 3 minutes to 120 days, 30 by default (ABA PayWay Developer Suite documentation). PayWay confirms payment two ways at once: a webhook, and a separate Check Transaction endpoint.
The direct Bakong Open API path works differently and has a real catch. Developers register at the National Bank's own api-bakong.nbc.gov.kh for a bearer token, and open-source packages like the Python library bakong-khqr wrap that into a few lines: generate a QR tied to your bank account, then poll check_payment() until the status flips from UNPAID to PAID. The catch: NBC's token only works from a Cambodia-based server IP, which is why that same project bolted on an unofficial third-party relay as a workaround.
What Does a KHQR Payment Website Integration Cost?
A KHQR payment website integration carries no flat setup fee: the cost is a per-transaction fee on a bank gateway or aggregator, or engineering time on the Bakong Open API, and order volume decides which is cheaper.
Getting to a bank gateway takes longer than writing the integration itself. ABA's onboarding runs through three steps: register with the Ministry of Commerce, open a business account, then apply for the PayWay merchant account. PayWay's sandbox registration is separate from that merchant application (ABA PayWay developer documentation), so a team can build and test the integration first and switch to production credentials once the paperwork clears.
| Path | Time to production | Ongoing engineering | Fee model |
|---|---|---|---|
| Bank gateway | Weeks, mostly business registration and bank onboarding, then a short sandbox integration | Low: gateway maintains the webhook and SDKs | Per-transaction processing fee |
| Certified aggregator | Similar registration overhead, one contract across several banks | Low to moderate | Aggregator's own per-transaction fee |
| Bakong Open API + SDK | Days, if the business already has a Bakong-linked account | Ongoing: you own the polling job, error handling and relay dependency | No fee to the National Bank, but server or relay costs plus developer time |
The 3-minute to 120-day validity window on a gateway-issued QR, 30 days by default, is not a footnote: it changes what you can build. A Siem Reap tour operator taking a $150 deposit for a booking made two weeks out can issue one QR that stays valid until the payment deadline, instead of regenerating a fresh code every time the customer reopens the page.
Selling online also carries a separate legal step: Cambodia's Law on Electronic Commerce requires a dual license, an e-commerce permit from the Ministry of Commerce plus an online-operation permit from the Ministry of Post and Telecommunications (Library of Congress Global Legal Monitor, 2021; Lexology, 2023), filed online since 2023 (VDB Loi), before the checkout can go live under a registered business name.
Where KHQR Payment Website Integrations Fail
A checkout page that shows a static KHQR image with no amount pre-filled is not a payment integration, it is a mental-math test we would not put in front of a paying customer. Any mistake in what they type becomes an unmatched payment the merchant has to chase by hand against a bank statement instead of a transaction ID match.
The DIY Bakong Open API route fails in a quieter way: silently. Because it returns status through polling rather than a webhook, a bug in the polling loop or a dropped connection to the Cambodia-only endpoint does not throw an error, it just leaves a paid order marked UNPAID until someone checks manually. A gateway's webhook plus its Check Transaction API catch that failure mode twice over.
A gateway integration fails a third way, in the opposite direction: trusting a webhook that was never checked. ABA PayWay signs its callback with the same HMAC-SHA512 scheme as the original request, so a checkout that flips an order to paid on any POST to its callback URL, without recomputing and comparing that hash, will accept a forged "paid" event from anyone who finds the endpoint. Verify the signature on every callback, not only the first one that works in testing.
Our Take: Do the Math Before You Pick a Path
Run the numbers before defaulting to either extreme. Take a $15 average order, a realistic ticket for a Khmer silk scarf shop selling through Instagram. ABA PayWay's transaction costs run 3.6 to 3.8 percent at the high end, lower on ABA's own cards (Travel Begins at 40, 2026); at that ceiling, a $15 order costs $0.54 to $0.57 in fees. The Bakong Open API route avoids that fee but carries its own fixed cost: a small Cambodia-region VPS plus a relay service, together around $10 a month.
At $0.56 a transaction, that $10 fixed cost is covered by around 18 orders a month, well under one a day. Past that point, the DIY route is not saving money: it moves the cost from a visible fee to a less visible pile of server bills, relay dependency and the engineering hours needed to keep a polling loop and its silent-failure risk running.
That crossover point also moves with order value, not just order count. A $30 average ticket hits the same $10 fixed cost at only about 9 orders a month, since the fee doubles with it. Lower-ticket businesses can run DIY for longer before the fee model turns against them.
That changes our advice: we would only pick the Bakong Open API route for occasional or pilot volumes, a handful of transactions a month rather than a day, like the Siem Reap tour operator above. A Phnom Penh bubble tea counter or grocery delivery service doing 20, 30 or more orders a day is already past the point where the math favours a gateway or aggregator.
This is the same judgment call behind any custom ecommerce build we ship out of Phnom Penh: match the payment stack to real order volume. Read our breakdown of Bakong's actual scale first if KHQR and Bakong still feel unclear, then get a KHQR estimate or browse recent project work we have shipped.
Prefer to chat? Message our founder directly on Telegram (@maxgrolier), or book a call with the team.
Frequently asked questions
Can I just use my personal or business KHQR code on my website?
You can display it as an image, but it will not behave like an integration. A static code carries no order amount and no automatic confirmation, so every sale has to be reconciled by hand against a bank statement instead of matched by its transaction ID.
Do I have to use ABA PayWay specifically?
No. ACLEDA, Wing and other National Bank of Cambodia-connected institutions run comparable gateways, and Bakong-certified aggregators can bundle several banks under one contract. The right choice depends on which bank the business already uses and whether card payments matter.
Does the Bakong Open API let a business accept payments without going through a bank at all?
No. The Open API still runs on top of a Bakong account ID tied to an existing bank, and NBC's own developer token only works from a Cambodia-hosted server, which is why some integrations add a third-party relay to reach it from elsewhere. It replaces the confirmation step, not the bank relationship.
How long does it take to get KHQR live on a website?
It depends on the starting point more than the coding work. A business with an existing registration and bank account can usually reach a live bank-gateway integration within weeks, mostly spent on the merchant application. The Bakong Open API route can be wired up in days once a qualifying account exists, at the cost of building and maintaining the polling logic yourself.
Can a KHQR checkout also accept credit cards?
Through a bank gateway or aggregator, yes. ABA PayWay's own QR API also supports WeChat Pay and Alipay alongside KHQR and cards. The direct Bakong Open API and its open-source SDKs only generate and verify KHQR, with no card option.
Is the QR code on a website the same as the one printed at the counter?
Not functionally. The counter code is usually static, tied to a fixed merchant identifier with no amount attached. A website integration should generate a dynamic, per-order code with its own transaction ID and a validity window matched to how the checkout is used, from minutes for an impulse purchase to weeks for an invoiced deposit.
