Integrate the payment. Design the full state change.

Choose the boundary

Match checkout control to engineering responsibility.

Hosted or redirected checkout

Use a gateway-managed payment step to reduce the amount of payment UI and sensitive handling inside the merchant application. The merchant still creates the payment, preserves the order reference, handles the customer return, and waits for authoritative status.

API-led checkout

Use APIs where the approved route supports a more controlled product experience and the merchant can own the additional technical, security, error-handling, and lifecycle responsibilities.

Platform or plugin connection

A platform-specific route can shorten implementation where a compatible connector exists. Availability, maintenance, version support, and the payment states exposed by the connector still need review.

State model

Pending is a real state, not an error message.

The order system should represent the payment lifecycle explicitly. A useful state model distinguishes creation, customer action, authorisation, success, pending review, failure, expiry, reversal, refund, and settlement readiness where the approved route exposes them.

Server-side confirmation

Use callbacks and webhooks as operational inputs.

Browser redirects are useful for customer experience but can be interrupted. The merchant backend should verify payment status through the mechanism documented for the approved integration and safely handle duplicate or out-of-order notifications.

• Validate the notification using the documented signature or authentication method.
• Match it to the merchant order and gateway transaction reference.
• Store the received state and relevant timestamps.
• Process the business action once, even if the notification repeats.
• Return a clear acknowledgement without exposing secret information.

Test before money moves

Exercise success, delay, failure, and recovery.

Testing should cover more than a single successful checkout. The final plan depends on the route, but merchants should expect to test rejected payments, abandoned customer journeys, pending confirmation, repeated callbacks, invalid signatures, refunds, timeouts, and reconciliation exports.

Protect credentials

Keep secret keys on the server, separate test and production configuration, rotate exposed credentials, and restrict access to the people and systems that need it.

Go-live gate

Launch only when technical and commercial approval meet.

Production access follows the required merchant review, signed commercial terms, technical validation, and any partner approval that applies to the payment route.