A “Pay now” button is a thin slice of a payment system. Behind it sit authorization, capture, settlement, disputes, partial refunds, and a ledger that finance can trust.
Most production incidents are not “card declined.” They are double charges, missed webhooks, or refunds that never reached the customer record.
Capabilities to design for day one
- Idempotent charge and refund APIs (safe retries)
- Webhook verification and ordered event handling
- Clear mapping from provider events to your order states
- Reconciliation exports finance can match to the bank
- Support tooling to look up a payment without engineering help
“We celebrated checkout going live. Two weeks later finance asked why settlement files didn't match the orders table. That was the real go-live.”
Treat the provider as a dependency
Timeouts, region outages, and 3-D Secure challenges will happen. Your UX should explain waiting states; your backend should not mark an order paid until confirmation is authoritative.
Document who owns disputes and chargebacks — product, finance, or support — before the first one arrives.
Operational bar
Idempotent
charge & refund calls
Signed
webhooks only
<1h
to investigate a payment ticket
Daily
reconcilable settlement feed
