Programming Notes: Linking To Payment Gateways

Payment gateways can be intimidating for many web developers. I have always found a certain amount of anxiety associated with them, particularly because of security requirements and presumed liability issues that could arise from insecure transactions. However, the actual integration with a payment gateway reveals that it is not much different than interacting with any other application programming interface (API).

The Process

So, to link an ecommerce application to a payment gateway, you must first select a gateway and then obtain an API username and password from it. This information will be included with all requests made to the payment gateway API, and provides your application with a way to identify itself and gain access. There are subtle API differences between the various gateway companies, so make sure you understand them if you are working with more than one.

Second, you will need to collect the information to send to the payment gateway, such as a customer’s credit card number. In order to be PCI compliant, developers need to ensure that this information is always encrypted when it is transmitted. Also, be aware of what information you will need to collect, as there can be multiple verification methods, depending on your gateway.

Once the information you need has been collected, payment requests can be made to the gateway. Typically, a gateway will send a series of responses to the application, allowing developers to troubleshoot and make decisions based on whether the transaction was approved or not. Developers have a precarious balancing act at this point. They need to save enough transaction information for accurate and usable records, such as payment number and card name. However, this data must meet PCI compliance standards, which means the information needs to be encoded and access to that data must be limited and controlled.

Interacting with a payment gateway is more intimidating than difficult. Because gateways offer robust APIs, the actual payment process is made simple for developers in most cases. However, take the extra time to ensure that the application is secure and otherwise meets PCI standards.