Quick answer
A reliable payment gateway integration creates an order on your server, sends the customer to the gateway’s checkout, verifies the payment result on the server rather than trusting the browser, processes signed webhooks idempotently, handles pending and failed states, supports refunds and reconciles gateway settlements against orders and accounting records.
Key takeaways
- Never trust the browser redirect alone as proof of payment.
- Verify webhook signatures and process events idempotently.
- Design for pending, failed and late-confirmed payments.
- Reconcile settlements, fees and refunds with accounting.
Who this guide is for
Ecommerce teams, SaaS founders and developers integrating Razorpay, Stripe, PayU, Cashfree or similar gateways.
Choose the gateway and methods
Compare gateways on supported payment methods such as cards, UPI, net banking and wallets, international payments, fees, settlement timelines, subscription support, documentation quality and compliance requirements. Check onboarding requirements for your business type. Your customers’ preferred methods should drive the choice more than small fee differences.
Create orders on the server
Before payment, create an order in your system and a corresponding order with the gateway from your server, with amount and currency set server-side. Never let the browser decide the amount. Store the gateway’s order reference against your order so you can match payments later.
Verify payment on the server
After checkout, the customer’s browser returns with a result, but browsers close, networks drop and responses can be tampered with. Verify the payment through the gateway’s signature verification or by fetching the payment status server-side before marking an order paid. Show the customer a pending state if confirmation is not yet available.
Process webhooks reliably
Gateways send webhooks for payment captured, failed, refunded and disputed events. Verify signatures, process each event idempotently so duplicates do not create double fulfilment, and respond quickly while doing heavy work asynchronously. Log events for troubleshooting. Webhooks are often the only reliable signal when customers close the browser after paying.
Handle edge cases
Plan for payments that succeed after your timeout, customers who pay twice, partial captures, currency rounding and payments for cancelled orders. Decide automatic refund rules for duplicates. UPI and bank payments can remain pending for some time; communicate that state rather than failing the order immediately.
Implement refunds and disputes
Use the gateway’s refund API for full and partial refunds, record refund references and update order and accounting status. Monitor chargebacks or disputes and respond within the gateway’s timelines with evidence such as delivery proof. Make refund permissions role-based and logged, because refunds move money out of the business. Customers should receive confirmation with the refund reference and the expected timeline published by your payment provider, so support teams can answer follow-up questions consistently.
Reconcile settlements
Gateways settle funds in batches after deducting fees and taxes. Reconcile settlement reports with orders, refunds and bank credits, and post fees correctly in accounting. Automated reconciliation catches missing payments and unexpected deductions. A complete integration scope includes checkout, verification, webhooks, edge cases, refunds, reconciliation and monitoring.
Scope checklist
- Which payment methods do your customers prefer?
- Is the amount set and verified on the server?
- Are webhook signatures verified and events idempotent?
- How are pending payments shown?
- How will settlements be reconciled?
Frequently asked questions
Which payment gateway is best in India?
Popular options include Razorpay, PayU, Cashfree, Stripe and others. Choose based on payment methods, fees, settlement times, subscription needs, documentation and support.
Why is my payment successful but the order not created?
Usually because the integration relied on the browser redirect, and the customer closed the page, or a webhook failed. Server-side verification and reliable webhook processing fix this.
What is idempotency in payment webhooks?
Processing the same event more than once has the same effect as processing it once, so duplicate webhooks do not create duplicate orders or refunds.
Sources and implementation references
- Razorpay: webhooks
Webhook events, signature validation and retry behaviour for one common Indian gateway.
- Stripe: receive webhook events
Signature verification, duplicate events and asynchronous processing guidance.
Prepared with AI assistance as an engineering decision guide. Examples are illustrative unless explicitly labelled as an internal implementation. No independent expert review or customer outcome is claimed.
Planning a website or ordering change?
Share the pages, journeys and systems involved so we can discuss scope and estimate assumptions. Scope, access, dependencies and commercial terms are agreed before delivery. Do not submit passwords, API keys or confidential records.
