Payment Gateway Integration for Indian Online Stores: A Guide

A customer has chosen a product, added it to the cart, entered an address and tapped "Pay". What happens in the next few seconds decides whether you make a sale. A slow, confusing or failing payment step loses customers who were ready to buy - and in India, where shoppers move between UPI apps, cards and cash on delivery, payments need extra care.

This guide explains how payment gateways work, what to look for when choosing one, the technical steps of a proper integration, and the mistakes that cause failed payments and reconciliation headaches.

How a payment gateway works

When a customer pays on your store, several parties are involved:

1. Your website creates an order and hands the payment over to the gateway.
2. The payment gateway (for example Razorpay, PayU, Cashfree, CCAvenue or PhonePe's gateway) collects the payment details securely.
3. The payment network - UPI via NPCI, or card networks such as RuPay, Visa and Mastercard - routes the request.
4. The customer's bank approves or declines it.
5. The gateway reports the result back to your website and later settles the money to your bank account after deducting its fees.

Your website never needs to see or store the customer's card number or UPI PIN. That is the gateway's job, and it is one of the main reasons to use one.

Payment methods Indian customers expect

| Method | Why it matters | Points to plan for |
|---|---|---|
| UPI | The default for many Indian shoppers, especially on mobile | Intent flow on mobile (opens the UPI app), QR on desktop, collect requests |
| Debit and credit cards | Common for higher-value and international orders | OTP authentication, tokenised saved cards |
| Net banking | Preferred by some older or business buyers | Bank list and occasional bank downtime |
| Wallets | Popular in some segments | Check which wallets your gateway supports |
| EMI and pay later | Helps with higher-value products | Eligibility rules, clear display on product pages |
| Cash on delivery | Still important in many categories and smaller towns | Return-to-origin risk, verification, PIN code limits |

How to choose a payment gateway

Do not pick a gateway only because a friend uses it. Compare these factors:

1. Payment methods and checkout experience

Check that every method your customers want is supported, and test the actual checkout on a mid-range Android phone. Is the UPI flow smooth? Does it open apps directly? Is the screen clear in both light and dark mode?

2. Integration options

Most gateways offer a few ways to integrate:

• Hosted or redirect checkout - the customer goes to the gateway's page. Simplest, least control over design.
• Embedded or popup checkout - the gateway's checkout appears over your page. A good balance for most stores.
• Custom or server-to-server flows - maximum control, more development and compliance responsibility.

Also check for ready plugins if you use Shopify or WooCommerce, and for clear API documentation if your store is custom built.

3. Settlement and reconciliation

Ask how quickly money reaches your bank, whether settlement reports can be downloaded or fetched by API, and how refunds and chargebacks appear in those reports. Clean reports save your accounts team hours every week.

4. Fees and terms

Fee structures vary by method and gateway, and they change over time. Ask each gateway for its current, written fee schedule for the methods you will use, including refunds, international cards and any setup or annual charges, and compare them like-for-like.

5. Onboarding and support

Gateways must complete KYC before activating live payments. Check the documents they need for your business type, how long activation usually takes, and how support works when a payment fails during a festive sale.

6. Extra features

Depending on your business, you may need payment links (useful for WhatsApp and phone orders), subscriptions or recurring payments, international card acceptance, split settlements for marketplaces, or smart routing across banks.

The integration process, step by step

A reliable integration follows the same sequence regardless of gateway:

1. Complete KYC and get test (sandbox) API keys.
2. Create orders on your server, not in the browser. The server records the amount, currency and order ID, then creates a matching order with the gateway.
3. Open the checkout using the gateway's library or SDK, passing the server-created order ID.
4. Verify the payment on your server. When the gateway returns a success response, check its cryptographic signature with your secret key before marking the order as paid. Never trust a "success" message from the browser alone.
5. Set up webhooks. Configure the gateway to notify your server of events such as payment captured, payment failed and refund processed. This catches payments where the customer closed the browser before returning to your site.
6. Handle every outcome. Success, failure, pending and cancelled payments each need a clear screen and a clear order status.
7. Build refunds into your admin. Staff should be able to issue full or partial refunds from the order screen, with the status tracked.
8. Reconcile daily. Match gateway settlement reports against orders, automatically if possible.
9. Test thoroughly, including failure cases, then switch to live keys and run a small real transaction before launch.

If your store needs to sync payments with an ERP, Tally or a CRM, our API integration and automation team can connect those systems so finance data stays consistent.

Security essentials

• Never store card numbers, CVV or UPI PINs. RBI's card tokenisation framework means merchants must not keep full card details; saved cards work through tokens.
• Keep secret API keys on the server only - never in front-end code or a public repository.
• Verify webhook signatures so attackers cannot fake a "payment received" message.
• Use HTTPS everywhere and keep your platform, plugins and libraries updated.
• Restrict admin access to refunds and payment settings, with two-factor login and audit logs.
• Handle personal data carefully. Names, phone numbers and addresses collected at checkout are personal data under the Digital Personal Data Protection Act, 2023. Collect only what you need and protect it.

For a broader review of your store's security, see our cyber security services.

Designing the payment step for mobile shoppers

Most Indian shoppers will see your checkout on a phone, so design for that first:

• Show UPI prominently and let mobile users jump straight into their UPI app instead of typing a UPI ID.
• Keep the order summary visible - amount, items and delivery charge - so there is no doubt about what is being paid.
• Avoid surprise charges at the last step. Unexpected fees are a common reason shoppers abandon a cart.
• Write clear failure messages. If a payment fails, say whether money was deducted and what happens next ("If money was debited, it will be refunded automatically by your bank").
• Offer an easy retry with a different method, without making the customer rebuild the cart.
• Send instant confirmation on email, SMS or WhatsApp once payment is verified, with the order number.

Getting cash on delivery right

COD brings orders but also risk - refused deliveries and return-to-origin shipments. Sensible controls include:

• Limiting COD by PIN code, order value or product category
• Confirming COD orders through an automated WhatsApp or SMS message before dispatch
• Offering a small incentive for prepaid UPI payment at checkout
• Flagging repeat refusals from the same phone number or address

Common payment integration mistakes

• Marking orders as paid based on the browser redirect without server-side verification
• No webhooks, so orders stay "pending" even when the customer has paid
• Generic error messages that leave customers unsure whether money was deducted
• Testing only on desktop and never on real phones with real UPI apps
• No process for handling duplicate payments or refunds
• Forgetting to switch from test to live keys - or worse, exposing live keys in code

Key takeaways

• Offer UPI, cards and net banking as a minimum, and decide COD rules deliberately.
• Choose a gateway on checkout experience, methods, settlement reports, support and written fee terms.
• Always create orders and verify payments on the server, and use webhooks.
• Never store card data; keep API secrets out of front-end code.
• Reconcile settlements daily and give staff a proper refund workflow.

Build payments your customers trust

A smooth, secure checkout is one of the highest-impact parts of any online store. In a free consultation, our Jaipur team reviews your products, customers and current setup, recommends a gateway configuration and sends a written quote for the work. See how we build complete stores on our e-commerce website development page.