Payment Gateway Integration, Step by Step: Testing, Go-Live and Reconciliation

Payment gateway integration is nine steps, and only two are really about code: choose the gateway, pass merchant KYC, pick a route, connect keys, currencies and methods, configure webhooks, sign off in the sandbox, go live in a controlled order, then reconcile every settlement weekly. Most failed launches skip the paperwork at the start or the reconciliation at the end — both surface as a store that cannot take, or cannot account for, real money.

The short answer: the integration process in nine steps (table)

The problem: go-lives stall on paperwork and first payments nobody reconciles

Stores rarely miss a launch date because the checkout was hard to build. They miss it because the merchant account still waits for a trade licence copy or bank statement nobody prepared, or because the website review fails: no published refund policy, no delivery terms, no verifiable contact details on the live site.

The second stall arrives after launch: the first settlement lands as one lump sum matching no single order. Without a matching routine, finance staff cannot tell a missing payment from a batched one.

Step 1–2: Choose the gateway and pass merchant KYC (documents, website review)

Choose the gateway on operational fit: the payment methods your customers use, settlement into your UAE corporate bank account, and platform support. If you are still deciding the platform, settle that first — our Shopify vs WooCommerce comparison covers the payment side of that choice.

Treat KYC as a project stage, not a form. Telr's published onboarding sequence models what UAE gateways ask: create the account, complete the business profile, upload documents, submit the website for review, integrate, then activate. Its documents checklist asks for the trade licence, passport and visa copies for the owner or partners, the memorandum of association or share certificate, and three months of bank statements showing the IBAN. Gather yours before applying.

The website review catches merchants by surprise: the gateway checks the live store for published terms and conditions, refund and delivery policies, and clear contact information. Publish those pages before you submit.

Step 3: Pick the integration route — hosted page, plugin or API

A hosted payment page redirects the customer to the gateway's own page to pay, then returns them to your store. It is the fastest route to build and, because the gateway handles card data entirely, it carries the smallest PCI DSS scope under the PCI Security Standards Council's self-assessment framework.

A plugin or platform app — the normal route on Shopify and WooCommerce — embeds the gateway inside your platform's checkout. You trade some control for maintained updates — why stores built through ecommerce website development in Dubai usually start here. A direct API integration keeps customers on your checkout with full control, at the cost of the largest PCI scope, your own 3-D Secure handling, and permanent maintenance. Choose it only when checkout control is a requirement — and never let raw card numbers touch your servers.

Step 4: Connect keys, currencies and payment methods

Install test keys first and keep them separated from live keys: test credentials in staging, live credentials only in production, secret keys only on the server — never in the browser or a repository. Name one person to own the key swap; "someone will switch it later" is how stores trade for a weekend in test mode.

Set currencies deliberately: the presentment currency the customer sees and the settlement currency your account receives, with store, plugin and gateway dashboard all agreeing. Enable methods in order — cards, then wallets, then any others — and confirm each is activated on the account, not merely visible in settings.

Step 5: Configure webhooks so orders and payments can never drift apart

A webhook is the gateway's message to your store that a payment succeeded, failed, was refunded or was disputed. The customer's browser returning to a thank-you page is not proof of payment — browsers close, connections drop. The verified webhook is the proof.

Register an HTTPS endpoint and subscribe to payment success and failure, refund and dispute events. Verify the signature on every event with your webhook secret before acting on it — an unverified endpoint accepts forged "paid" messages from anyone. Make the handler idempotent, so a retried delivery updates the order once, not twice, and respond quickly, processing heavy work after acknowledging receipt. Add a fallback: a scheduled comparison of gateway transactions against order statuses. Well-built Shopify development integrations treat this as part of the build.

Step 6: Sandbox sign-off — the stage, not the scenarios

The sandbox stage proves the whole flow — checkout, 3-D Secure prompts, webhooks, order status changes, refunds — works end to end with test cards before real money moves. It must produce a sign-off: a named person confirms correct behaviour in test mode and clears the build for live keys.

The individual test scenarios — success, decline, refund, wallet and failure cases — are a discipline of their own, covered by our separate go-live testing checklist.

Step 7: Go-live sequence: live keys, first real transactions, monitoring

Go live in a controlled order, at a quiet time, with someone watching. Swap test keys for live keys, remove every test-mode setting, and confirm production points at live endpoints only. Then place the first real transactions yourself: a small genuine order paid with a real card, including the 3-D Secure challenge the bank presents, followed by a refund of that order. Sandbox success hides real-card behaviour; only a live card shows the authentication journey customers take.

Watch the first transactions individually: authorisation, webhook arrival, order status, confirmation email. Confirm amounts and currencies match the order exactly, with the charged amount recalculated on the server, never trusted from the browser. If the store design is also being rebuilt, launch payments separately — our guide to ecommerce website design for online stores explains why.

Step 8–9: Settlement and reconciliation: the weekly routine that closes the loop

Settlement is the gateway paying accumulated transactions into your bank account as a batch, minus fees and refunds. That is why the deposit never equals a day's order total, and reconciliation is a comparison exercise, not a glance at the balance.

Run it weekly, in four passes. One: match every order marked paid against a successful gateway transaction of the same amount. Two: match the settlement report against the bank deposit, line by line — total, fees, refunds. Three: list exceptions — paid orders with no transaction, transactions with no order, partial refunds, disputes — and clear or carry each with a note. Four: confirm refunds exist on both sides; drift here breeds double refunds.

Keep it owned by a named person, on a fixed weekday, in a shared sheet or your accounting system.

Common integration mistakes (test-mode leftovers, unsigned webhooks, mismatched currencies)

The recurring failures are unglamorous: stores still pointing at sandbox keys; webhooks accepted without signature verification, letting forged events mark orders paid; currency mismatches — the store displays one currency, charges a second, settles in a third; amounts trusted from the browser instead of recalculated server-side; duplicate charges on retry, prevented by idempotency keys — a unique reference per attempt, so a retry returns the original result instead of charging twice. And the quietest mistake: nobody reconciling, so the rest compound undetected.

FAQ

What documents does a UAE merchant need for payment gateway KYC?

Your trade licence, passport and visa copies for the owner or partners, your memorandum of association or share certificate, and recent bank statements showing the IBAN. Telr's published checklist asks for exactly these; other UAE gateways ask for substantially the same. Publish your terms, refund and delivery policies too.

Hosted checkout, plugin or API — which route should I choose?

The simplest route your store can live with. A hosted page is fastest and carries the smallest PCI DSS scope, because the gateway handles card data entirely. A plugin suits most Shopify and WooCommerce stores. A direct API gives full control but the largest compliance scope and permanent maintenance.

Why does my first settlement not match my order total?

Because a settlement is a batch, not a mirror of one day's orders. The gateway deducts its fees, nets off refunds, and may settle several days together. The deposit is correct only when it reconciles line by line against the settlement report — orders, fees and refunds each accounted for. Any remaining difference goes to the gateway, report in hand.

What is a webhook, and why does my store depend on it?

A webhook is an automatic message from the gateway confirming a payment succeeded, failed, was refunded or was disputed. Order status should follow verified webhooks, not the browser reaching a thank-you page, because browsers close and connections drop. Verify each signature, handle repeats idempotently, and periodically compare gateway transactions against orders to catch missed messages.

Can I integrate the gateway before my merchant account is approved?

Usually, yes. The build can proceed in the sandbox while KYC runs in parallel — Telr's sequence starts integration while documents are being reviewed. What you cannot do is take live payments before activation. Sequence the work so build and sign-off finish around the approval.

Have your gateway integrated end to end (CTA)

If you would rather have the whole sequence run for you — gateway selection, KYC preparation, integration, webhooks and a reconciled first settlement — that is part of our ecommerce web development service. Tell us your platform, gateway situation and the methods your customers ask for, and we will scope it as fixed work. WebStackRank provides an itemised proposal within 24 business hours; reach us on WhatsApp at +971 52 595 3174 or hello@webstackrank.com. Stores trading across the UAE get the paperwork planned in from day one.