Cantürk Çelikok
Türkçe
Payment and messaging integrations

Payment gateway integration that leaves no security gaps

A payment integration isn't finished when the sample code from the docs runs. The real work is verifying that a notification really came from the provider, making sure the same payment is never processed twice, and closing half-finished transactions correctly.

In PlusTurk I built a setup where customers connect iyzico, PayTR, Stripe or Nestpay with their own credentials; debtors receive a payment link by SMS and the case closes itself once the payment arrives. In Ayda POS I tied the online order payment flow into the same screen as the till.

Let's talk about your project Estimate your budget

What you get

Provider integration

iyzico, PayTR, Stripe or Nestpay, either a single provider or selectable per customer.

3D Secure flow

Redirecting to the bank, verifying the result on return and showing failures in plain language.

Webhook verification

Signature/hash checks on provider notifications and idempotent handling of repeated callbacks.

Refunds and cancellations

Partial and full refunds and cancellations, tracked in the admin panel.

Payment links

Single-use payment links by SMS or email; the related record updates itself when payment arrives.

Reporting

Exportable lists of successful, failed and refunded transactions.

Card details should never pass through your server

Collecting card numbers in your own form and forwarding them to the provider puts the PCI DSS burden on you. Instead I use the provider's hosted payment page or embedded form; card data goes straight to the provider and your system only learns the result.

API keys are never kept in code or as plain text in the database; they are stored encrypted and used only on the server.

Trust the server, not the browser, for the payment result

When a customer returns to your site after paying, a parameter in the address bar may say 'success', but that alone proves nothing. I confirm the payment through the provider's server-to-server notification or by querying the provider directly, so nobody can approve an order with a fake return URL.

How we work

  1. 01

    Flow design

    We define what is being paid for (product, subscription or debt) and what happens afterwards.

  2. 02

    Test environment

    Successful, failed and refund scenarios are tested with the provider's test keys and cards.

  3. 03

    Going live

    Live keys are connected to your account and we watch the first real transactions together.

  4. 04

    Reporting

    Transaction lists for accounting and support are prepared.

Technologies I use

iyzicoPayTRStripeNestpayNode.jsNext.js

Typical budget and timeline

TRY 20,000 – TRY 80,000

2–8 weeks · depends on scope

Estimate your own scope

Frequently asked questions

Which payment provider should I choose?
For mostly domestic Turkish cards and instalments, iyzico or PayTR usually fit better; for international sales, Stripe. Fees and payout times change, so compare current offers.
Can you add payments to our existing site?
Yes. I review your current stack and connect the payment flow to your existing orders or memberships.
How long does an integration take?
Usually 1–3 weeks for a single provider with a standard flow; longer with subscriptions, payment links or several providers.

Other services