Payment Gateway Integration Services

Hosted checkout or direct API — which should you integrate?

This is the first decision, and it sets your compliance burden for years. It is worth more thought than the choice of provider.

Hosted checkout sends the customer to a page the provider controls. Card data never reaches your infrastructure, which normally puts you on the lightest PCI DSS self-assessment. You give up some control of the visual flow, and you inherit a redirect that your order state machine has to handle when the customer closes the tab mid-payment.

Direct API keeps everything on your pages. It looks better and converts a little better, and it moves you into a much heavier PCI category because you are now handling card data. For most SMEs that trade is not worth it.

There is a middle path most merchants should look at first: provider-hosted fields embedded in your own page. The customer never leaves, the card data still never touches your servers.

Your exact PCI scope depends on your integration and must be confirmed with your provider or a qualified security assessor. Treat the above as the shape of the decision, not as a compliance opinion.

Which payment methods does a Saudi merchant actually need?

Coverage is not a preference. If a Saudi buyer reaches your checkout and their card is not supported, that sale is gone.

The mada share figure is as reported by SAMA via Arab News. STC Bank's licensing and transition from STC Pay is documented in its own notice of transformation. Fees and eligibility change; confirm current terms with each provider.

What does it cost to accept digital wallet payments?

Two costs that get confused with each other constantly.

The transaction cost is what the provider takes. It varies by scheme, card type, whether the payment is domestic or cross-border, your volume, and what you negotiated. Anyone quoting you a single percentage without knowing those things is guessing. Get it from the provider in writing.

The build cost is what it takes to integrate properly, and it moves with a short list of things: how many payment methods you support, whether you need saved cards or recurring billing, how complicated refunds and reconciliation are in your business, and whether e-invoicing obligations apply to you. A single hosted checkout with one method is a small piece of work. A multi-method checkout with subscriptions, partial refunds and ERP reconciliation is not.

Ijjad scopes this after looking at your provider and your existing checkout, and does not publish fixed prices for it. If you want to think about ranges before talking to anyone, the Saudi payment gateway fees guide covers published market rates with sources and dates.

What a small business needs before it can accept payments

Most delayed payment launches are not engineering problems. They are onboarding problems, and they are almost always discovered late.

• A registered legal entity and a business bank account the provider can settle into.
• KYC and beneficial-ownership documents, which take longer to gather than teams expect.
• A live website with published refund, delivery, and privacy terms. Providers reject applications over missing terms far more often than over technical issues.
• A description of what you sell that matches what the provider sees on your site.

Start onboarding before the build, not after it. It is the longest pole and the one you control least.

What is different about integrating payments in Saudi Arabia

Domestic method coverage is the first difference, and mada is the reason. The second is invoicing. Where ZATCA e-invoicing applies to your business, invoice generation, QR and clearance or reporting stop being a finance task and become part of the payment workstream, because the invoice has to be produced at the moment the order is confirmed.

The third is naming. STC Pay completed its transition to STC Bank under a SAMA licence, and a lot of documentation and buyer language still says STC Pay. If your team is searching provider docs under the old name, check both.

Whether ZATCA obligations apply to you, and in which wave, is a question for qualified Saudi tax and legal advisers. Ijjad scopes the technical controls once you have that answer.

Already have a gateway? This is usually where it is broken

Reviewing an existing checkout is often more useful than rebuilding one. The same faults recur:

• Webhooks without idempotency. The provider retries, your endpoint processes twice, the customer gets two orders.
• Refunds done in the provider dashboard. The money goes back and your store never finds out, so stock and reporting drift apart.
• Silent 3-D Secure failures. The step-up fails, the customer sees a blank state, and nothing is logged.
• No reconciliation against settlement reports. Nobody notices a missing payout until the accountant does, months later.

None of these show up in a successful test payment. They show up in production, at volume, at the worst time.

How Ijjad delivers a payment integration

Four stages. The first is deliberately before any code, because the integration model and your invoicing position change everything that follows.

1. Review. Your current checkout, your provider contract, the methods your buyers actually use, and whether ZATCA obligations apply. We read your provider's real API documentation here, not a generic template.
2. Scope. A written definition of order states, refund rules, who owns reconciliation, and what happens on every failure path. You get this before committing to a build.
3. Build and test. Integration against the provider sandbox, then live-key verification with real low-value transactions, including a deliberate refund and a forced 3-D Secure step-up.
4. Handover. Code, credentials and provider relationships stay yours, documented with the failure paths rather than only the successful one.

Provider onboarding runs in parallel from day one. It is the longest pole and the one Ijjad does not control.

Ijjad builds custom, so this connects to whatever you already run rather than requiring you to move platforms first. Where a payment integration sits inside a larger build, it is usually part of e-commerce development or an Arabic-first Saudi store.