The 3-Step Payment Lifecycle
A payment gateway integration involves three distinct steps:
1Server Order Creation: Your backend calculates the cart total securely (never trust client-side prices!) and calls the payment gateway API to create an
order_id.2Client Checkout Modal: Your frontend opens the gateway modal with the generated
order_id.3Webhook Verification: The payment gateway's server notifies your backend via an asynchronous webhook that the payment succeeded.
Node.js Webhook Verification Implementation:
javascriptKorvith Code Snippet
import crypto from "crypto";
export const handleRazorpayWebhook = async (req, res) => {
const secret = process.env.RAZORPAY_WEBHOOK_SECRET;
const signature = req.headers["x-razorpay-signature"];
// Cryptographically verify payload authenticity
const expectedSignature = crypto
.createHmac("sha256", secret)
.update(JSON.stringify(req.body))
.digest("hex");
if (expectedSignature !== signature) {
return res.status(400).json({ error: "Invalid cryptographic signature" });
}
const event = req.body.event;
if (event === "payment.captured") {
const payment = req.body.payload.payment.entity;
// Mark order as paid in database
await updateOrderStatus(payment.order_id, "PAID", payment.id);
}
res.status(200).json({ status: "ok" });
};Always respond with HTTP 200 immediately to prevent the gateway from retrying the webhook unnecessarily.