Payment integration (iyzico, PayTR, Stripe) is the most critical and most-mistaken part of an e-commerce project. A practical guide distilled from dozens of integrations.
Which Provider?
In Turkey iyzico and PayTR are common; Stripe for global sales. Choose by commission, installment support, marketplace (multi-vendor) needs and documentation quality. Virtual POS contract processes should start before the decision is made (they take days).
Test and Live Environments
Never test with a live card: sandbox keys, test cards and webhook simulation are used. All success/failure/refund scenarios run in test.
Webhook and Order Status
Payment results are never processed trusting only the frontend: the provider notifies via webhook from its server, and you confirm via API. 90% of "paid but no order" bugs come from missing this flow. Idempotency (processing repeated notifications once) is mandatory.
Security: PCI DSS
Card data must never touch your server: iframe/redirect flows are used. This avoids heavy PCI obligations. 3D Secure is nearly mandatory in Turkey; the flow must be well designed against conversion drops.
Refunds and Accounting
Refund API, partial refunds and accounting receipts are planned from day one. Adding them later means rewriting the order model.
FAQ
How many days does integration take? Days in a ready e-commerce package, 1–2 weeks in custom software.
How much is an e-commerce package? Starting at 25,000 TL — calculate.