Blog
Why a payment redirect is not proof of payment
The customer reached your success page. That does not mean you were paid.
What goes wrong
- The redirect URL can be opened by anyone, without paying.
- The customer can close the tab after paying, so the redirect never happens.
- The provider callback can fail or arrive late.
The safe pattern
- Create the payment on your server and remember its id.
- Mark it paid only when the provider confirms it to your server, by signed callback or by asking the provider for the status.
- If no callback arrives, keep checking the status until the payment settles.
- Make the update idempotent, so a repeated callback does not credit twice.
Where this shows up
Dhuri Gateway works this way: an invoice is marked paid only when the provider confirms the payment, and missing callbacks are checked for you. See the WHMCS payment gateway for Nepal.
Questions
Is the success page enough to mark an order paid?
No. Confirm with the provider from your server, by signed callback or a status check.
What if the callback never arrives?
Query the provider for the payment status until it settles, instead of leaving the invoice unpaid.
Keep reading
Correspondence
Tell us what you are building.
Sign-in, payments or point of sale: one message to a real person.