The most common way gateways get cheated is trusting the customer’s browser. UPIPayments never does.
Confirmation comes from the provider
A payment becomes successful only when the provider’s status API says so, or after a correctly signed notification from the provider is checked against that status API.
The amount must match
If the provider reports a different amount than the order, the payment is not accepted.
Exactly once
Every change locks the payment record. If the webhook, the customer’s return and the automatic check all arrive at once, the fee is charged once, your webhook is sent once and any invoice is paid once.
0 comments