Article
Payment Gateway Integration Basics for Malaysian Web Apps
Accepting online payments is a key milestone for many Malaysian businesses. Customers expect to pay by online banking, cards and e-wallets, and a smooth checkout directly affects sales. Behind the scenes, payment integration involves more than adding a "Pay now" button.
This guide covers the concepts developers and business owners should understand before integrating a payment gateway, so the project avoids common problems with failed orders, missing payments and reconciliation headaches.
Payment Methods Malaysian Customers Expect
- FPX online banking: direct payment from Malaysian bank accounts, widely used for online purchases.
- Debit and credit cards: essential for many customers and for international buyers.
- E-wallets: such as Touch 'n Go eWallet, GrabPay, Boost and ShopeePay, popular for smaller transactions.
- DuitNow QR and other options depending on the gateway.
- Buy now, pay later services offered through some gateways.
Most businesses use a payment gateway that bundles several methods under one integration, rather than connecting to each provider separately. Compare which methods each gateway supports, along with their fees, settlement times and onboarding requirements.
Think about your customers when choosing which methods to show first. Business buyers may prefer online banking for larger amounts, while younger retail customers may reach for e-wallets. Your gateway's reports will show what customers actually use after launch.
Hosted Checkout Versus Embedded Integration
With a hosted payment page, the customer is redirected to the gateway's secure page to pay, then returned to your site. This is simpler and reduces your security responsibilities, since card details never touch your server.
Embedded or API-based integrations keep customers on your site with fields provided by the gateway. They can feel smoother but need more careful implementation. Never store raw card data on your own systems; card security standards such as PCI DSS impose strict requirements, and gateways' hosted fields exist precisely to keep you out of that scope.
Tip for SMEs: start with the gateway's hosted checkout or official plugin. Optimise the experience later once payments work reliably.
If you use a platform such as WooCommerce or Shopify, check the gateway's official plugin or app. Official integrations are usually maintained as the gateway changes its API, which saves you from fixing breakages yourself.
Webhooks and Payment Status
The most common integration bug is relying only on the customer's browser returning to your site to mark an order as paid. If the customer closes the browser or loses connection, the order stays unpaid even though money was taken.
- Use the gateway's server-to-server callback or webhook to confirm payment status.
- Verify webhook signatures to make sure messages genuinely come from the gateway.
- Make webhook handling idempotent, so duplicate notifications do not create duplicate orders.
- Log every payment event for troubleshooting and reconciliation.
Our detailed guide on webhooks that do not drop orders covers retries and idempotency patterns.
Refunds, Failed Payments and Reconciliation
Plan for things that go wrong. Customers abandon payment pages, banks time out, cards are declined and refunds are requested. Define clear order statuses, such as pending, paid, failed, cancelled and refunded, and show customers helpful messages for each.
Reconciliation matters for accounting. Make sure each order stores the gateway transaction ID, amount, fees and settlement date where available. Finance staff should be able to match gateway settlement reports to orders without manual detective work.
Test edge cases in the gateway's sandbox environment: success, failure, cancellation, delayed notifications and partial refunds.
Decide how long a pending order should reserve stock. Holding stock indefinitely for abandoned payments can cause false out-of-stock messages, while releasing it too quickly can oversell during busy sales.
Security and Compliance Basics
Use HTTPS on every page, keep gateway API keys secret on the server, restrict admin access and keep your platform updated. Separate test and live keys clearly to avoid accidental live charges during development; our guide on managing secrets for small teams explains how.
Business owners should complete the gateway's onboarding requirements accurately, including business registration documents, refund policy and terms on the website. Clear policies reduce disputes and are often required for approval.
Monitor payments after launch. A sudden drop in successful payments can indicate an integration problem, an expired key or a gateway outage, and early detection limits lost sales.
FAQ
Which gateway is best in Malaysia?
It depends on your payment methods, fees, settlement needs and platform. Compare several and test their support.
Can I accept payments without a registered business?
Requirements vary by gateway. Many require business registration for full merchant accounts.
How long does integration take?
Using an official plugin can be quick. Custom integrations with webhooks and reconciliation take longer and need proper testing.
Payment integration works best when it is reliable rather than fancy. Offer the methods customers expect, start with hosted checkout, confirm payments through verified webhooks, plan for failures and refunds, and keep keys and customer data secure.