How do online payments work on a website? Gateways, UPI and what to check

What a payment gateway is

A payment gateway is a service that sits between your website, your customer’s bank and your own bank account. Popular gateways in India include Razorpay, Cashfree and PayU, and Stripe is also used. Availability and onboarding rules differ by business, so check which one accepts yours.

How a payment flows

1. The customer clicks Pay on your checkout.
2. Your server creates an order with the gateway for the exact amount.
3. The customer pays on the gateway’s secure screen using UPI, card or net banking.
4. The gateway tells your server the result through a message called a webhook.
5. Your system marks the order as paid and sends confirmation.
6. The gateway settles the money to your bank account, usually after a short delay and minus its fee.

Why the server must confirm the payment

A customer’s browser can be closed, refreshed or even tampered with. The only reliable proof of payment is the confirmation your server receives directly from the gateway. Sites that trust only the success page on the screen risk marking unpaid orders as paid.

Security basics

• Never store card numbers yourself. The gateway handles card data.
• Keep secret keys on the server, never in the website code that visitors can see.
• Use HTTPS everywhere.
• Test in the gateway’s test mode before going live.
• Handle failed, pending and duplicate payments properly.

Things to check before choosing

• The fee per transaction for each payment method.
• How long settlement takes.
• The paperwork needed to activate your account.
• Support for refunds, subscriptions or invoices if you need them.