Payments and gateways

Gateway setup

1. Create separate sandbox and production credentials.
2. Store secrets only in protected WBAMS settings.
3. Configure return, callback, webhook, and notification URLs exactly.
4. Verify supported currencies, recurring methods, vault behavior, refunds, and disputes.
5. Run successful, failed, canceled, delayed, duplicate, and refunded payment tests.

Callback safety

Payment notifications must be authenticated, idempotent, logged, and matched to the correct invoice and transaction. Never trust an amount, status, or customer identifier only because it arrived in a browser return URL.

Reconciliation

Compare gateway settlements, fees, refunds, disputes, and currency conversions with WBAMS transactions. Investigate mismatches while logs and provider evidence are still available.