Editorial illustration.
Originally published 23 June 2023; rewritten and reviewed on 15 October 2026.
A legacy checkout can continue processing orders for years while its surrounding documentation changes. When revisiting the MOLPay example in the original blog, I would start with the merchant account and supported integration contract, not with the old endpoint or sample hash.
Establish which integration the merchant actually has
Confirm the current provider, merchant identifier, enabled payment methods and documentation supplied for that account. A historical brand name is not enough to select the endpoint or signing algorithm for a live integration.
Keep sandbox and production configuration separate. Store merchant secrets in protected server-side configuration, and ask the provider to clarify any ambiguity about signature inputs, encoding or callback validation.
Keep totals and identity on the server
Create the local order before preparing a gateway request. Record the expected amount, currency and reference from trusted application data. Treat the browser’s fields as presentation, not as authority to change those values.
Prepare local order
→ Build the request required by the merchant's current specification
→ Send the customer through the supported payment flow
→ Receive and verify the provider notification
→ Reconcile order, amount, currency and transaction status
→ Record the transition once
This is an integration outline, not a substitute for a current vendor signing implementation. The original sample’s digest should not be copied into a different merchant protocol.
Make an uncertain result recoverable
A customer may close the browser after payment. A notification may be repeated or delayed. Keep a reconciliation route that can establish the provider’s final status without creating another charge.
Test those cases with the provider’s supported environment before release. An integration is maintainable when the team can explain a payment’s state from stored references and verified responses, even when the browser journey was interrupted.