Payment Gateway Integration for Your Online Store or App: Stripe, PayPal, Redsys and Bizum

We connect payments to the rest of your business: an order is confirmed when the bank confirms it, refunds go out from your order management, and every payment matches what lands in your account. On PrestaShop, WooCommerce, Magento, Shopify or a custom application.

  • Redsys + Bizum How the EquiMercado store takes payments
  • Stripe Ampans donations and Asufin membership fees
  • ISO 27001 And ENS: certified since 2026
How the store sells: synced catalogue, shopping experience, payment, order into the ERP, measurement and your team’s operation Every sale refines the catalogue 01 · Catalogue Products andprices in sync 02 · Experience Search, productpage and cart 03 · Payment Gateways andanti-fraud 04 · Order ERP, stock andlogistics 05 · Measurement Conversion andmargin 06 · Operation Your team sells,the system scales
  1. 01 · Catalogue Products and prices in sync
  2. 02 · Experience Search, product page and cart
  3. 03 · Payment Gateways and anti-fraud
  4. 04 · Order ERP, stock and logistics
  5. 05 · Measurement Conversion and margin
  6. 06 · Operation Your team sells, the system scales
  7. Every sale refines the catalogue
Scroll

Definition

What Is a Payment Gateway?

A payment gateway is the service that connects your online store or application to the bank or payment provider: it collects the customer’s payment details in a secure environment, requests authorisation from the card-issuing bank (with 3-D Secure when required) and returns the result to your system so the order is marked as paid or declined.

In Spain two families coexist. The bank’s virtual POS, which at most Spanish banks runs on Redsys and can also take Bizum payments. And payment providers such as Stripe or PayPal, which give you your own account with several payment methods and pay out to your bank.

Summary

Executive Summary

What you get when you hand us your payments.

Payments are the part of a store that cannot fail and the part nobody notices until it does: payments declined for no clear reason, paid orders that never show as paid, refunds someone processes by hand in the bank’s dashboard, and takings that do not match the bank account at month end.

We choose the right mix with you (your bank’s virtual POS for Bizum and negotiated fees, Stripe or PayPal for more payment methods, subscriptions or international sales) and integrate it with the order, refunds and reconciliation, not just with the pay button. And we test the cases that actually break: the customer who closes the window mid-payment, the bank notification that never arrives, the double click that charges twice.

On security the principle is simple: with a redirect payment page or the provider’s own hosted payment fields, the card number never passes through your server, so you neither store it nor can lose it. Gateway keys live in an encrypted vault, never in the code, under the same controls we are certified for in ISO 27001 and Spain’s National Security Framework (ENS).

  • 0 Card numbers on your server with redirect or tokenised payments
  • PSD2 3-D Secure and strong customer authentication handled
  • 1 payment = 1 order: reconciliation without spreadsheets

What's included

What We Integrate

Payment methods and everything that happens after the payment.

  • Redsys, your bank’s virtual POS: by redirect or with payment inside your page, plus the signed notification that confirms the order
  • Bizum in your online store, enabled through your bank’s virtual POS
  • Stripe: cards, Apple Pay, Google Pay and SEPA Direct Debit, with Stripe’s payment page or its fields embedded in yours
  • PayPal as an extra method, with its refunds and disputes reflected on the order
  • Buy now, pay later and instalments with the financing provider that fits your average order value
  • 3-D Secure 2 and SCA (PSD2): strong authentication without needless friction, using the exemptions your provider supports
  • Subscriptions and recurring billing: card stored by the provider, renewals and retries of failed payments
  • Refunds and reconciliation: full or partial refunds from your order management, and every payment and fee matched to its order
  • Marketplace payments: one payment split between sellers, with the platform fee retained

Why

The Order Is Confirmed by the Bank’s Notification, Not by the Customer’s Return

The most common mistake in a payment integration, and how we avoid it.

Many stores mark an order as paid when the customer comes back from the gateway to the thank-you page. But the customer may close the window, lose signal or return without having paid. We confirm the order with the server-to-server notification the gateway sends (Redsys’s notification or Stripe’s webhook), verify its signature before trusting it and process it only once, even if it arrives twice. If a notification never arrives, a periodic query to the gateway recovers the real payment status. No paid orders left unconfirmed, no confirmed orders left unpaid.

payment-flow.yaml
# A card payment, end to end
order: awaiting payment
gateway:
- customer pays on the bank or Stripe page
- 3-D Secure if the issuing bank asks
server_notification:
signature: verified
duplicate: ignored
order: paid
reconciliation: payment, fee and payout
  • Verified Signature
  • Prevented Double charge
  • Off your server Card data

Key points

Where We Integrate It

The platforms we work with every day, because we build on them too.

  1. 01

    PrestaShop and WooCommerce

    Redsys on PrestaShop or WooCommerce, Stripe and PayPal through their modules, properly configured and tested with test payments. If the module does not cover what you need (Bizum, partial refunds, reconciliation), we extend it. More in PrestaShop development and WordPress development.

  2. 02

    Magento and Adobe Commerce

    The EquiMercado store takes payments with Redsys and Bizum in both its stores, the consumer one and the trade one, on a single Magento 2 installation. More in Magento development.

  3. 03

    Shopify

    Shopify Payments or a compatible third-party gateway. Redsys and Bizum are not built in and are added through a payments app; we tell you which one and what extra fee Shopify charges for using an external gateway on your plan. More in Shopify development.

  4. 04

    Custom Applications

    Payments inside your own Laravel, Symfony or Node.js application. On the Asufin platform, built with Laravel and Vue, members pay their fees with Stripe from their private area. More in Laravel development.

  5. 05

    Donations

    Simple, accessible donation forms with one-off or recurring payments. On the Ampans portal, donations are collected with Stripe in an accessible flow, and online donations grew by 200% with the new website.

  6. 06

    Marketplaces and Platforms

    When you collect payments on behalf of others: seller onboarding and verification with the provider, payment splitting and the platform fee. It carries more legal obligations than a store, so we analyse it with you before writing any code.

How we work

How We Work

From how you take payments today to payments that reconcile themselves.

  1. 01

    Payments Review

    Which payment methods you have, which contracts (bank POS, Stripe, PayPal), what fees you pay, what fails today and how payments are reconciled. We tell you which mix suits you and why.

  2. 02

    Contracts and Test Environments

    We help you set up the virtual POS or provider account and work in their test environments. Keys go into an encrypted vault, never into an email or the code.

  3. 03

    Integration

    Payment, signed notification, order statuses, refunds, subscriptions if needed and reconciliation data, on your platform.

  4. 04

    Testing What Breaks

    Approved and declined payments, 3-D Secure, window closed mid-payment, duplicate or lost notifications, partial refunds. All in the test environment before touching production.

  5. 05

    Go-Live and Monitoring

    Go-live with a first real payment verified end to end, and checkout monitoring. With website maintenance, monitoring continues every month.

Who it is for

Is This for You?

This service fits when getting paid properly is part of the business, not just another button.

Who it's for

  • Online stores that want to add Bizum, Redsys or Stripe, or switch gateways without losing sales.
  • Businesses with paid orders that never show as paid, or with refunds and reconciliation done by hand.
  • Companies with subscriptions, membership fees or recurring billing: clubs, associations, software, monthly boxes.
  • Foundations and non-profits that receive online donations.
  • Platforms that collect payments on behalf of third parties and need to split them.

Who it's not for

  • Anyone who only needs to switch on the official module in a standard store: your bank’s or provider’s support may be enough.
  • Anyone who wants us to store card numbers on their own server: we advise against it and do not build it.
  • Negotiating fees with your bank: that is yours to do; we tell you what to compare.

Deliverables

What Is Included and What Is Not

So you know exactly what you get.

Included

  • Recommendation of gateways and payment methods for your business
  • Payment integration with confirmation by signed notification
  • 3-D Secure and strong customer authentication (PSD2) configured
  • Refunds from your order management and reconciliation data
  • Tests for approved, declined, abandoned and duplicate payments
  • Documentation of the integration and of where every key lives

Not included

  • Bank or payment provider fees (part of your contract with them)
  • Your business’s PCI DSS validation (handled by your bank or provider)

The proof

Payments That Already Work

The Magento store of EquiMercado, the Fair Trade project of Fundación Adsis, takes payments with Redsys and Bizum in its consumer store and its private trade store, which share a single order management. On the Fundació Ampans portal, the donation system is accessible and simplified, with Stripe, and online donations grew by 200%. In the Laravel and Vue application of Asufin, the Spanish Association of Financial Users, members pay their fees with Stripe from their private area, alongside the electronic signature of their documents.

  • 2009 Building stores and applications since
  • 2 EquiMercado payment methods (Redsys and Bizum)
  • +200% Ampans online donations with the new website
  • 5.0 Clutch rating

For the CTO

CTO Summary

How we build it under the hood.

Payment status is decided on the server: the Redsys notification is validated with its HMAC-SHA256 signature and Stripe webhooks with their signature before anything changes. Every notification is processed idempotently (the same notification twice does not change the order twice) and a scheduled job queries the gateway for payments left without a notification. The card is captured on the provider’s page or in its hosted fields, so your application only ever sees an identifier or a token.

Reconciliation builds on what each provider returns: the Redsys transaction identifier or Stripe’s balance transactions and payouts, linked to the order number to match payments, fees and refunds or export them to your ERP. Keys for each environment live in an encrypted vault, with test and production kept separate.

Technologies

  • Redsys
  • Bizum
  • Stripe
  • PayPal
  • PrestaShop
  • WooCommerce
  • Magento 2
  • Shopify
  • Laravel
  • Symfony
  • Node.js
  • Webhooks
  • Order confirmed by server-to-server notification with a verified signature
  • Idempotent processing and scheduled checks for unnotified payments
  • Card captured by the provider: your server only sees a token
  • Payments, fees and refunds linked to the order for reconciliation
  • Keys in an encrypted vault, separated by environment

Risks and how we cover them

The Risks We Prevent

What we see when a store with payment problems lands on our desk.

  1. 01

    Paid orders that never show as paid

    Mitigation

    Confirmation by server notification, not by the customer’s return, plus periodic queries to the gateway for payments left without a notification.

  2. 02

    Customers charged twice

    Mitigation

    Every payment attempt has a unique identifier and notifications are processed once even if they arrive repeatedly.

  3. 03

    Sales lost at 3-D Secure authentication

    Mitigation

    3-D Secure 2 configured so payments can be authenticated without friction when the issuing bank allows it, and declined payments reviewed to see where they drop.

  4. 04

    Leaked or lost gateway keys

    Mitigation

    Keys in an encrypted vault, separated by environment and with personal access. Never in the code, an email or a shared document.

Technologies

Gateways and Technologies

The ones we integrate and the platforms we integrate them on.

  • Redsys
  • Bizum
  • Stripe
  • PayPal
  • Apple Pay
  • Google Pay
  • SEPA
  • 3-D Secure 2
  • PrestaShop
  • WooCommerce
  • Magento 2
  • Shopify
  • Laravel
  • Symfony
  • Node.js

FAQ

Payment Gateway Integration FAQs

What people ask us most before integrating payments.

Which payment gateway should I use: Redsys, Stripe or PayPal?

It depends on where you sell and how you charge. Redsys, your bank’s virtual POS in Spain, usually has negotiable fees and lets you take Bizum. Stripe offers more payment methods, subscriptions and international sales from a single integration. PayPal adds trust for customers who prefer not to enter their card. Many stores combine the bank POS with Stripe or PayPal, and we help you choose using your data.

How is the Redsys gateway integrated into PrestaShop?

With the Redsys module your bank provides or a paid one, configured with your virtual POS details (merchant number, terminal and key) and tested first in the Redsys test environment. What matters is that the order is confirmed by the bank’s signed notification and that refunds and Bizum work; if the module does not cover that, we extend it.

Can an online store take Bizum payments?

Yes. Bizum is enabled on your bank’s virtual POS (on Redsys) and appears as another payment method: the customer confirms the payment in their banking app. You request activation from your bank; we integrate and test it in your store. EquiMercado, for example, takes payments with Redsys and Bizum.

How much does payment gateway integration cost?

In a new store, payment gateways are part of the project: an online store starts at €8,000. For an existing store or application, we give you a fixed quote after the review, because it depends on the platform, the payment methods and whether there are subscriptions, automatic refunds or reconciliation with your ERP. Transaction fees are separate, under your contract with the bank or provider.

Do I have to comply with PCI DSS if I take card payments?

Yes: every business that accepts cards is subject to PCI DSS. But with a redirect gateway or the provider’s own hosted payment fields, the card number never reaches your server, and what is required of you shrinks considerably, usually to the shortest self-assessment questionnaire. Your bank or payment provider validates it. We build the integration so you fall into that case.

What is 3-D Secure and what changes with PSD2?

3-D Secure is the issuing bank’s check on a card payment (a code or a confirmation in its app). The European PSD2 directive requires strong customer authentication (SCA) for most online payments. With 3-D Secure 2 properly configured, many payments are authenticated without asking the customer for anything, and those that do require it happen without leaving the checkout.

Can you set up subscriptions or recurring billing?

Yes. The provider stores the card securely and your system keeps only a reference for later charges. We do it with Stripe and also with your bank’s POS where it supports it, with renewals, plan changes and retries of failed payments.

How are payments reconciled with what reaches the bank?

By linking every payment, fee and refund to its order number using the data the gateway returns, and matching it against the provider’s payouts or the bank’s credits. You know which orders make up each deposit and can pass it to your ERP or accounting software without manual matching.

Can a marketplace take a payment and split it between sellers?

Yes, with providers built for it, such as Stripe Connect: the provider verifies each seller, the customer pays once and the money is split, with the platform fee retained. It is a project with legal and tax implications that are worth reviewing before choosing a provider.

Can you switch payment gateways without taking the store offline?

Yes. We set up the new gateway in parallel, test it in its test environment and switch it on once everything matches. Active subscriptions are the delicate part: depending on the provider, stored cards can be migrated or customers have to re-enter them, and we tell you before starting.

Next step

Tell Us How You Take Payments Today and We Will Tell You What to Change

A 30-minute video call with the person who will build the integration. If the official module is enough for you, we will say so.

  • No commitment
  • Response in 24h
  • Custom proposal
Last updated: October 2026

Let's talk.

Initial technical consultation

AI, security and performance. Diagnosis with phased proposal.

  • NDA available
  • Response <24h
  • Phased proposal

Your first meeting is with a Solutions Architect, not a salesperson.

Talk to an architect