What is a payment gateway?
A payment gateway is the service between a customer's payment method and the merchant's bank account. It presents the checkout (UPI, cards, netbanking, wallets), routes the transaction to the card network, bank or UPI system, reports whether it succeeded, and settles the money to the merchant, usually net of a fee and on a settlement cycle. In India, the companies people call gateways usually also act as payment aggregators, which collect funds on a merchant's behalf and need authorisation from the Reserve Bank of India.
WhatsApp does not process payments for businesses; a gateway does, even inside WhatsApp Payments in India. It plugs into a WhatsApp journey in three ways: it generates a payment link the business sends in a message or button; it is linked to the WhatsApp Business Account as a payment configuration so an order details message can be paid in chat (Meta's payment-gateway mode supports only a short list of Indian gateways); or it generates UPI intents for Meta's UPI intent mode. In every case the gateway, not Meta, holds the merchant relationship — KYC, settlement, refunds and chargebacks follow its rules.
The step integrations most often get wrong is confirmation. A customer's "paid" message, a screenshot or the page they were redirected to is not proof; the gateway's server-to-server webhook, verified with its signature and cross-checked through its API, is. Only then should the order move to paid and a WhatsApp confirmation go out. UPI, meanwhile, is a payment rail the gateway accepts — not a gateway itself — and a payment link is one product the gateway generates, not the gateway.
Key takeaways
- A payment gateway processes a customer's UPI, card, netbanking or wallet payment and settles the money to the merchant.
- WhatsApp does not process payments itself; a gateway sits behind every payment link and every in-chat order details checkout.
- Only the gateway's signed server-to-server webhook, cross-checked through its API, proves a payment — never a screenshot.
- In India, gateways that collect funds on a merchant's behalf act as payment aggregators and need RBI authorisation.
- UPI is a payment rail that the gateway accepts, not a gateway itself.
Why the difference matters
Why does a payment gateway matter?
The gateway decides which payment methods a WhatsApp customer can use, how fast money reaches the business, what each transaction costs and how reliably the business learns that a payment succeeded. Choosing one that supports UPI intent and in-chat checkout, wiring its webhooks correctly and reconciling its settlements against WhatsApp orders is the difference between a chat that sells and a chat that fills up with "I paid, where is my order?" messages.
How does a payment gateway work?
- Step 1
Onboard with a gateway
Complete merchant KYC, get API keys and a webhook signing secret, and enable the methods your buyers use — UPI first for most Indian consumers, then cards, netbanking and wallets.
- Step 2
Create a payment object per order
From your backend, create an order or payment link at the gateway with the amount, currency and your own order or invoice reference, so every payment traces back to one sale.
- Step 3
Plug it into WhatsApp
Send the link in a utility template URL button or a CTA URL message, or link the gateway as a payment configuration and send an order details message for in-chat checkout.
- Step 4
Confirm by webhook
Receive the gateway's payment event, verify its signature over the raw body, check the amount and reference against your order, and process each event ID exactly once.
- Step 5
Close the loop and reconcile
Mark the order paid, send the WhatsApp receipt or
order_status: processing, and reconcile daily settlements, fees and refunds against your orders.
A payment gateway in code
import crypto from "node:crypto";import express from "express";const app = express();// Gateways sign the raw body, so read bytes, not parsed JSON.app.post("/webhooks/pg", express.raw({ type: "application/json" }), async (req, res) => {const expected = crypto.createHmac("sha256", process.env.PG_WEBHOOK_SECRET).update(req.body).digest("hex");const given = req.get("X-Gateway-Signature") ?? "";if (given.length !== expected.length ||!crypto.timingSafeEqual(Buffer.from(given), Buffer.from(expected))) {return res.sendStatus(401);}const event = JSON.parse(req.body.toString("utf8"));// jobId = event ID: a retried delivery of the same event is not queued twiceawait queue.add("pg-event", event, { jobId: event.id });return res.sendStatus(200); // acknowledge only once the event is safely queued});// Worker: match, cross-check with the gateway's API, then tell the customerasync function handlePgEvent(event) {if (event.type !== "payment.captured") return;const order = await orders.byReference(event.data.reference);if (!order || order.amountPaise !== event.data.amount) return flagForReview(event);const payment = await gateway.fetchPayment(event.data.payment_id);if (payment.status !== "captured") return;if (await orders.markPaidOnce(order.id, event.data.payment_id)) {await whatsapp.sendTemplate(order.phone, "fee_receipt", [order.number]);}}
Header and field names differ between gateways; the order of operations does not: verify, queue once per event ID, acknowledge, then match amount and reference, cross-check with the API and message the customer.
Common mix-ups
Common mistakes with a payment gateway
Trusting the redirect or a screenshot
Customers can close the tab before the redirect, and screenshots can show a failed or edited attempt. Only a verified webhook or an API status check proves the payment.
Verifying the signature over parsed JSON
Most gateways sign the raw bytes with an HMAC. Parsing and re-serialising changes them, every check fails, and teams are tempted to switch verification off. Hash the body exactly as received.
Processing retried events twice
Gateways retry webhooks until they get a 2xx. Without webhook deduplication on the event ID, a customer receives two receipts and your books show two payments.
Collecting card details in the chat
Never ask for card numbers, CVVs or UPI PINs on WhatsApp. Send the customer to the gateway's checkout, which is built and audited for that data.
Skipping settlement reconciliation
Settlements arrive in batches, net of fees and refunds. Reconcile them against WhatsApp orders daily, or small mismatches pile up unnoticed for months.
A payment gateway: key facts and limits
- What it handles
- Checkout, routing, status, settlement, refunds
- Methods in India
- UPI, cards, netbanking, wallets
- Regulator (India)
- RBI — payment aggregators need authorisation
- In-chat checkout
- Linked as a payment configuration for order details
- Proof of payment
- Signed server-to-server webhook plus an API check
- Card data
- Stays on the gateway's PCI DSS–scoped checkout
Example: A Hyderabad coaching institute's fee collection
A Hyderabad coaching institute collects term fees over WhatsApp. For each student its backend creates a gateway payment link tied to the fee invoice number and sends it in a utility template. When a parent pays by UPI, the gateway posts a signed payment-captured event to the institute's webhook; the handler verifies the signature, matches invoice and amount, marks the fee paid and sends a receipt template within seconds. Two parents who replied "paid" with a screenshot but had no captured event were checked in the gateway dashboard first — one payment had failed — before any receipt went out.
Payment Gateway FAQs
Is UPI a payment gateway?+
Does WhatsApp hold the money when a customer pays in chat?+
Do I need a particular gateway to take payments on WhatsApp?+
Where should payment confirmation come from?+
Rules of thumb
Best practices for a payment gateway
- Pass your own order or invoice reference to the gateway and read it back from every webhook.
- Set link and order expiries that match the offer, so stale links cannot be paid.
- Alert when captured-payment events stop arriving, not only when errors appear.
- Prefer a gateway that supports UPI intent if most buyers pay from their phones.