The short answer
Four habits make a payment integration last:
- Keep card data out of your systems with the provider's hosted page, hosted fields or tokenisation, shrinking your security scope.
- Treat payment events as records: store every authorisation, capture, refund and chargeback; process webhooks reliably.
- Reconcile daily across gateway, bank deposits and accounting or ERP.
- Add an internal payments layer so you can add methods or change providers without rewriting every system.
Integration patterns
Agree early on who does what; the terms are used loosely. One contract bundling gateway, processing and merchant account is simpler but harder to leave unless your integration allows it. Check that the provider holds the licence or approval the Central Bank of Nigeria (CBN) requires for its role, and that settlement goes to an account in your company's name.
Who does what: gateway, processor, acquirer
| Role | What it does |
|---|---|
| Payment gateway | Securely captures payment details and passes transactions to be processed |
| Payment processor | Routes transactions through the card networks or payment systems |
| Acquirer (merchant bank) | Holds the merchant account and settles funds to you |
| Payment service provider or facilitator | Bundles several of these roles, often with simplified onboarding |
| Pattern | How it works | Effect on your security scope |
|---|---|---|
| Hosted payment page | Customer uses the provider's page | Smallest; card data never touches your servers |
| Hosted fields or embedded components | Provider-controlled fields inside your page | Small; your page scripts still need protection |
| Direct API with your own form | Your systems receive card data and send it on | Largest; you handle card data directly |
| In-person terminals | Card-present payments through certified terminals | Depends on setup and the link to your POS |
The PCI Data Security Standard applies to entities that store, process or transmit cardholder data, or that could affect the security of the cardholder data environment (PCI SSC). A hosted pattern does not remove your obligations but usually reduces them considerably; confirm the validation requirements that apply with your acquirer.
Designing for reliability
Payments fail untidily: timeouts, duplicate submissions, delayed notifications, partial captures. Weak mobile connections and power cuts make this more common (double submits, pages closed mid-payment).
Idempotency keys
On every request, so a retried payment is never charged twice.
Verified webhooks
Check signatures, store, acknowledge fast, process later; handle duplicates and out-of-order events.
A state machine
Pending, authorised, captured, partly or fully refunded, disputed; moves only on confirmed events.
Status checks
After a timeout, ask the gateway for the real outcome instead of guessing.
Honest messages
Never say a payment failed when unknown; a customer may retry while the first debit is pending.
Reconciliation and accounting
Checkout is the visible part; reconciliation is where problems surface.
- ImportSettlement reports from the gateway or acquirer, every day.
- MatchTo orders, invoices and deposits, with fees, VAT on fees, refunds, chargebacks, currency.
- PostTo your ERP or accounting system automatically; exceptions go to finance.
- TraceThe gateway's transaction ID on every order, invoice and refund.
Nigerian payment methods and change
Organisations often need more than cards:
- Instant transfers (NIP), often the first choice
- USSD and wallets (no card needed)
- QR payments (some settings)
- Direct debit mandates (recurring billing)
- Bank transfers (larger B2B payments)
Check which each provider supports, how a transfer is matched to its order (for example a dedicated account number per order) and how funds and reports reach you. Banks, switches and fintechs keep adding methods and the CBN updates its rules; a payments layer makes adopting them easier. With foreign-currency payments or dollar-priced suppliers, record the exchange rate at each transaction.
Future-proofing with a payments layer
Website, apps, POS and billing call one thin internal service, not the gateway:
- One place to add methods or a second provider (outages, cost)
- Consistent logging, reconciliation and reporting
- Routing by type, currency or amount
Switching providers gets easier too, especially if stored card tokens transfer: confirm that in the contract before signing.
Example: a distributor with two gateways
A hypothetical distributor takes web store cards through one gateway, recurring payments through another, and invoices by cheque and bank transfer. A payments service joins both gateways, stores every event against its ERP invoice and imports daily settlement files for automatic matching. Adding instant bank transfer later changes only that service.
Integration checklist
Provider and scope
- Payment methods needed, by channel, listed
- Provider licensing or approval status confirmed
- Integration pattern chosen and security scope confirmed with the acquirer
- Token portability and exit terms checked in the contract
Reliability
- Idempotency, webhook verification and duplicate handling designed
- Payment state model defined, including partial refunds and disputes
Finance
- Settlement report format and import schedule agreed
- Matching rules, fees and chargebacks mapped to accounts
- Exception handling owned by finance
Future changes
- Internal payments layer scoped
- Regulatory questions (for example CBN licensing and NDPA obligations) reviewed with advisers
Limitations
Provider features, fees and methods change often: check current documentation and contracts, not general comparisons. Connecting payments to an ERP, CRM or custom application is integration work; our business system integration service covers the design and build.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- PCI Data Security Standard (PCI DSS), PCI Security Standards Council
- Central Bank of Nigeria, CBN
- Nigeria Data Protection Commission, NDPC
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.