Payment Gateway Integration for Online Stores: What to Check

By Grocito12 October 2026

Payment gateway integration connects your online store to a provider that securely collects the customer's payment details, asks the bank or card network for approval and tells your store whether the payment succeeded. Choose a provider that supports the payment methods your customers use, keep card data off your own servers, confirm orders through webhooks, and test failures and refunds before launch.

Key takeaways

A gateway collects and routes the payment; the money itself moves through banks and processors, and settlement takes time.
Support the methods your buyers actually use. In India that usually means UPI, cards and net banking, and often cash on delivery for some product types.
Use a hosted or provider-embedded checkout so card numbers never touch your servers. Never store card numbers yourself.
Treat the webhook, not the browser redirect, as the source of truth for whether an order is paid.
Compare fees, settlement timing, refund handling and support, not just the headline rate.

Gateway, processor and aggregator in plain terms

These words are often used loosely, so it helps to separate them.

Payment gateway

The gateway is the technology layer. It presents a secure payment form or API, encrypts the details and passes the request along. Think of it as the card machine of an online shop.

Payment processor and acquiring bank

The processor and the acquiring bank talk to the card networks and issuing banks, authorise the transaction and move the funds. Some providers handle all of this behind one agreement.

Payment aggregator

Many Indian providers work as aggregators. They hold the merchant relationship with the banks for you, so you can start accepting payments without a separate bank arrangement. The trade-off is that your onboarding, limits and settlement schedule depend on the aggregator's policies. Rules for aggregators are set by regulators and change, so check current requirements with the provider and a qualified professional.

Payment methods that matter in India

Buyers expect to pay the way they already do everywhere else. The right mix depends on your audience and what you sell.

UPI: Very familiar to Indian customers, quick to complete on a phone and often the first choice for smaller orders. Check that your checkout supports both intent flows (opening a UPI app) and collect-style requests where the provider offers them.
Cards: Debit and credit cards remain important for larger orders and for customers who travel or buy from abroad. Ask about international card support if you sell outside India.
Net banking: Still used by some buyers who prefer to pay from their bank account directly. Success rates vary by bank, so ask the provider how bank downtime is handled.
Wallets: Useful where your audience already holds wallet balances, but support differs by provider.
Cash on delivery: Popular for first-time buyers, and also costly through failed deliveries and returns. Decide per product category whether to offer it.
EMI and pay later: Can help with high-value items. Confirm who bears the cost.

Do not switch on every method simply because it is available. Each one adds testing and reconciliation work.

Hosted checkout, embedded and API-based integration

Hosted or redirect checkout

The customer is sent to the provider's page, pays there, and returns to your store. This is the quickest to build and keeps the most sensitive data away from you. The trade-off is less control over branding and a small break in the experience.

Embedded or pop-up checkout

The provider's form is shown inside your page, often as a pop-up. The look feels closer to your store, while card entry stays inside the provider's secure component.

Direct API integration

You build your own payment form and call the provider's APIs. This offers the most control, but it puts more of the security burden on you, so it is rarely worth the added compliance work. For a mobile app with its own screens, use the provider's official mobile SDKs, which keep sensitive fields inside their components. Our app development and e-commerce solution teams can help you choose.

Security and PCI DSS at a plain level

PCI DSS is the Payment Card Industry Data Security Standard, a set of security requirements for any business that handles card data. The practical lesson for a store owner is simple.

Let the gateway handle card details, using its hosted page or secure components.
Never store card numbers, expiry dates or security codes in your database, logs or spreadsheets, and do not ask customers to send them by email or chat.
Serve your whole site over HTTPS and keep your platform, plugins and server software updated.
Restrict who can see payment dashboards, and use two-step verification.
Keep API secrets in server-side configuration, not in front-end code or in your repository.

How much formal PCI paperwork applies depends on how you integrate and how many transactions you process, so ask your provider and, if needed, a qualified adviser. Our website security checklist covers the wider basics.

Failed payments, webhooks and reconciliation

Why payments fail

Payments fail for ordinary reasons: insufficient funds, a bank decline, a timed-out UPI request or a network drop. Your checkout should explain what happened in plain language, keep the cart intact and offer another method one tap away.

Use webhooks as the source of truth

After a payment, the customer's browser is sent back to your store. That return trip is unreliable, because people close tabs or lose signal. A webhook is a message the provider sends to your server when the payment status changes. Build your order logic around webhooks:

Verify the webhook signature so you know the message is genuine.
Make your handler idempotent, so receiving the same event twice does not create two orders.
Record every status change with the provider's payment reference, as messages can arrive late or out of order.

Reconciliation

Reconciliation means matching your orders to the provider's records and then to the money that lands in your bank account. Store the provider reference against each order, make a settlement report easy to export, and review mismatches regularly. Our finance and billing automation product shows how this matching can be automated.

Refunds, settlement and fees: what to ask providers

Before you commit, ask each provider these questions and record the answers in writing.

Settlement

How long after a payment does money reach your account, and does this differ by method?
Are there holds on new accounts, and how are bank holidays handled?
What reports match each payout to individual orders?

Refunds

Can you issue full and partial refunds from a dashboard and through the API?
How long do refunds take to reach the customer, and who pays for them?
Are fees returned on refunded transactions?

Fees

Compare fees as a whole rather than only the headline rate. Check the rate for each payment method, charges for international cards, extra charges for failed or disputed payments, setup or annual fees, taxes on fees and any minimum commitment. Ask for the full fee schedule in writing. Also ask about chargebacks, which are disputes raised by a cardholder: how you are notified, what evidence is needed and how quickly you must respond.

Testing in sandbox mode

Every serious provider offers a sandbox or test mode with test keys and test payment details. Use it fully before going live.

Test a successful payment for each method you plan to offer.
Test declines, cancelled payments and a customer closing the window halfway.
Test a webhook that arrives twice, and one that arrives before the customer returns.
Test full and partial refunds and confirm the order status, stock and customer email all update.
Test on a real phone, including UPI app switching.
Switch to live keys, run one small real transaction yourself, then refund it.

Keep test and live keys clearly separated.

A worked example

Imagine a small online store selling home goods across India. It launches with a card form only, and records an order as paid when the customer reaches the thank-you page. Soon the owner finds customers who paid but never reached that page have no orders. A better setup would offer UPI, cards and net banking through a hosted checkout, create the order as pending, mark it paid only when a verified webhook arrives, and send an email if a payment is unresolved after a set time. Settlement reports would be matched to order references, and cash on delivery limited to certain order sizes after a review of return patterns.

FAQ

What is the difference between a payment gateway and a payment processor?

The gateway is the software layer that captures the payment details securely and sends the request on. The processor and the banks behind it authorise the transaction and move the money. Many providers bundle both, so in practice you often choose one provider that does everything.

Is it safe to store customer card details on my own website?

It is best not to. Storing card numbers puts a heavy security and compliance burden on you, and Indian rules also restrict how card details may be saved. Let the provider tokenise cards if you want saved-card convenience, and check current requirements with your provider.

Which payment methods should an Indian online store offer?

Start with UPI, cards and net banking, then add cash on delivery, wallets or EMI only if your customers ask for them and you can handle the extra operations.

How long does it take to integrate a payment gateway?

A hosted checkout on a standard platform can be set up quickly, while custom stores with webhooks, refunds and reconciliation take longer. Testing is usually where the time goes.

Next steps

Write down your payment methods, order volume and refund policy. Shortlist two or three providers, ask the settlement, refund and fee questions above, and run each through a sandbox test. If you would like help with the integration, contact us and we can review your store with you. You may also find our guide on how to choose an e-commerce platform useful, since your platform shapes which gateways are easy to connect.