Payment Gateway Integration Skill

Non-negotiable security rules (apply regardless of provider)

Never touch raw card numbers. Always use the provider's hosted/embedded checkout, Elements, or Checkout Sessions — card data goes directly from the browser to the provider, never through your server. This keeps you out of full PCI-DSS scope.
Secret keys server-side only. Publishable/public keys can be client-side; secret keys live in server env vars, never in client bundles.
Verify webhooks with the signing secret — never trust an unverified webhook payload as truth (an attacker could POST a fake "payment succeeded" event otherwise).
Idempotency: use idempotency keys on payment-creation requests so a network retry doesn't double-charge.
Source of truth is the webhook, not the client redirect. A successful client-side redirect after checkout is a UX signal, not proof of payment — only grant access/fulfill the order once the corresponding webhook event is verified server-side.

Stripe — default for global SaaS, subscriptions, usage-based billing, strongest developer experience and docs.
Razorpay — default for India-first businesses (UPI, netbanking, local payment methods, INR settlement, GST-compliant invoicing).
PayPal — useful as an additional option for buyer trust in some markets, rarely the primary rail for a new SaaS.

Load the relevant reference file based on which provider(s) the user needs:

references/stripe.md — Checkout, subscriptions, webhooks, customer portal
references/razorpay.md — Orders API, subscriptions, webhooks, India-specific compliance notes