Payment integration patterns
A payment integration connects a customer action to a commercial state. The application must distinguish an initiated payment, provider acceptance and the product rights that follow.
How should the data flow?
- 01
Create a payment or subscription request using a server-controlled product reference.
- 02
Direct the customer through the provider-supported collection flow.
- 03
Verify incoming events and apply a replay-safe lifecycle transition.
- 04
Reconcile provider state and expose unresolved payment exceptions to an operator.
What business handoff does this integration support?
A subscription product needs to activate access, handle delayed events and explain cancellation. Provider events inform the lifecycle but should not directly bypass the application’s own entitlement rules.
How do authentication and permissions work?
Keep provider secrets server-side and verify event authenticity using the provider’s documented method. Prefer provider-hosted collection so sensitive payment details do not pass through the application unnecessarily.
How are changes detected?
A browser return URL is not authoritative payment evidence. Validate server-to-server events and use a reconciliation task to detect missing or delayed updates.
What are the implementation options?
- Hosted checkout connected to an explicit order lifecycle for a focused first release.
- A subscription adapter with separate entitlement logic when billing states affect ongoing product access.
Systems involved
- A product or commerce application managing orders, subscriptions and entitlements.
- A selected payment provider handling the agreed payment collection and event interface.
Sync direction
The application initiates a commercial request; the provider reports payment state. Product access remains an explicit application decision that can be reconciled independently.
Error handling and reconciliation
Deduplicate event IDs and tolerate out-of-order delivery. Before retrying an uncertain creation request, check whether the provider already accepted the original business operation.
Limitations to verify
Available payment methods, regions, subscription features and account eligibility require current provider confirmation. This pattern does not establish financial or compliance suitability.