Payment Gateway Integration in Australia: Checkout Flows, Webhooks and the 2026 Changes
Integrating a payment gateway in Australia: hosted vs embedded checkout, webhooks, refunds, reconciliation, surcharging removal, least-cost routing and PayTo.
How should an Australian business integrate a payment gateway?
Use the provider's hosted checkout or secure fields so card data never touches your servers, treat the gateway's signed webhooks as the source of truth for payment status, handle failures, refunds and disputes deliberately, reconcile settlements with your accounts, and test every path. In Australia, also remove card surcharges on eftpos, Visa and Mastercard (from 1 October 2026), ask about least-cost routing for debit cards, and consider PayTo for account-to-account and recurring payments.
This guide is for businesses and developers adding payments to a website, app, SaaS product, booking system or custom checkout. It covers hosted versus embedded flows, payment status and webhooks, refunds and failed payments, reconciliation, testing, security and mobile, plus the Australian payment changes that affect design. For the generic version, see how to integrate payment gateways.
We do not quote gateway fees or recommend one provider for every business; pricing and capabilities change and depend on your volume.
Key takeaways
- Keep card data off your servers with hosted checkout or secure fields.
- Make webhooks, not browser redirects, the source of truth for order status.
- Process events idempotently; providers retry, and duplicates happen.
- Remove surcharges on eftpos, Visa and Mastercard cards (from 1 October 2026).
- Ask whether the provider supports least-cost routing online.
- Plan refunds, partial refunds, failed payments and disputes before launch.
- Reconcile payouts, fees and refunds with your accounting system.
Hosted, embedded or custom?
| Approach | How it works | Trade-offs |
|---|---|---|
| Hosted checkout page | Customer is redirected to the provider's page, then returns | Fastest and smallest PCI scope; less control over design |
| Embedded secure fields | Provider's fields or elements sit inside your page; card data goes straight to the provider | Integrated look and feel with reduced scope; more integration work |
| Wallets (Apple Pay, Google Pay) | Device wallet supplies a token | Fast on mobile; needs domain or app setup per wallet |
| Platform checkout | Ecommerce platform's own checkout and payments | Least work; limited to platform capabilities |
| Custom card form via your servers | Card data passes through your systems | Large PCI DSS burden; rarely justified |
Worth noting
PCI DSS applies to anyone who stores, processes or transmits cardholder data. Using hosted pages or secure fields keeps most of that with the provider, but you still have responsibilities, such as protecting the page that loads the payment form. Check your obligations with your provider and the PCI Security Standards Council (PCI SSC).
Australian payment changes that affect your integration
Surcharging. The Reserve Bank's March 2026 decision removed surcharging on eftpos, Mastercard and Visa debit, prepaid and credit cards from 1 October 2026; the RBA reports that American Express and UnionPay also removed surcharging from 1 October 2026, and PayPal from 5 October 2026, by their own decision rather than RBA regulation; buy now pay later and other methods remain under review (RBA FAQs; RBA). Remove surcharge lines for those networks from checkout, invoices and receipts, and build costs into prices.
Least-cost routing. Around nine in ten Australian debit cards are dual-network cards that can be processed through eftpos or an international network, and least-cost routing lets merchants send transactions through the cheaper one. The RBA expects providers to offer least-cost routing, but has reported that online enablement lags in-person; it planned further consultation on online and mobile wallet routing from mid-2026 (RBA). Ask your provider whether it is available for your online payments and how it is enabled.
PayTo. PayTo, on the New Payments Platform, lets customers approve payment agreements in their banking app and manage them there, which can suit recurring and account-to-account payments (NPP Australia). Provider support varies.
Buy now pay later. From 10 June 2025, buy now pay later contracts are regulated credit, and providers need an Australian credit licence (ASIC). Merchants integrate BNPL through providers' own checkouts or a gateway that supports them, and should display BNPL terms accurately. For marketplaces that split payments between sellers, see marketplace development in Australia.
Currency and GST. Show prices in AUD including GST for consumers (see Shopify development in Australia for platform settings), make sure the amounts sent to the gateway match displayed totals, and record GST correctly in reconciliation.
Payment status and webhooks
The redirect back to your site after payment is not proof of payment: customers close tabs, networks drop and some outcomes arrive later. Let the gateway's signed webhooks drive order status, and show a 'processing' state until the webhook arrives.
Checkout -> create order (pending_payment)
-> create payment intent / session
Customer -> pays on hosted page or fields
Redirect -> show 'processing' (not proof)
Webhook -> verify signature
-> payment_succeeded: order = paid
-> payment_failed: order = failed
-> refunded / disputed: update order
Every event: store event ID, ignore repeatsRefunds, failed payments and disputes
- Support full and partial refunds from your admin, with reasons recorded.
- Reflect refunds from the provider's dashboard via webhooks, so systems stay in sync.
- Show clear, specific messages for declined payments and let customers retry or use another method.
- For subscriptions, retry failed renewals on a schedule and notify customers with a secure update link; see subscription ecommerce in Australia.
- Handle disputes: notify staff, gather evidence (order, delivery, communication) and respond within the provider's deadline.
- Use 3-D Secure where risk or rules call for it; see 3D Secure.
Reconciliation
Payments are not finished when the customer pays. Providers settle funds in batches, net of fees and refunds. Reconcile each payout with the orders, refunds and fees it contains, and post them correctly to Xero, MYOB or your ERP. Store the provider's transaction IDs on orders and invoices so every amount can be traced. See API integration for Australian businesses.
Testing checklist
- Successful payments for each method and card type you support.
- Declines, insufficient funds, expired cards and 3-D Secure challenges, using provider test cards.
- Customer closes the tab after paying: does the order still complete via webhook?
- Duplicate and out-of-order webhooks.
- Full and partial refunds from both your admin and the provider dashboard.
- Disputes in test mode, if the provider supports them.
- Wallet payments on real iOS and Android devices.
- Checkout totals with GST, discounts and delivery match the amount charged.
- No surcharge shown for eftpos, Visa or Mastercard.
Security and mobile
Keep API keys in a secrets manager, use restricted keys where the provider offers them, verify webhook signatures, and never log card data. Protect the pages that load payment forms against script injection, for example with a Content Security Policy and monitoring of scripts. On mobile, use the provider's native SDKs and wallet support rather than web views where possible. See mobile app payments and payment security.
Choosing a provider: questions to ask
- Does it support our platform, and our payment methods (cards, wallets, BNPL, PayTo)?
- Is least-cost routing available for online debit payments, and how is it enabled?
- What are settlement times and payout reporting like?
- Does it support recurring billing, card updater and retries?
- Does it support marketplaces or split payments, if we need them?
- What fraud and dispute tools are included?
- What does pricing look like for our actual transaction mix? (Ask for a written quote.)
Hypothetical example: a SaaS adding card and PayTo payments
This example is hypothetical. An Australian SaaS for sports clubs bills monthly by card through a gateway and has been adding a card surcharge. Before 1 October 2026 it removes the surcharge from checkout and invoices for eftpos, Visa and Mastercard, adjusts prices, and confirms with its provider how least-cost routing applies to its online debit payments. It adds PayTo as an option for clubs that prefer bank payments, moves order status to webhooks after finding orders stuck when users closed the tab, and reconciles payouts to Xero daily.
Common mistakes
- Marking orders paid on the redirect instead of the webhook.
- Not verifying webhook signatures or handling duplicates.
- Leaving card surcharges in templates after 1 October 2026.
- Assuming least-cost routing is on without asking.
- Card data passing through your servers unnecessarily.
- No reconciliation between payouts and accounts.
Sources
Australian payments: RBA, surcharging conclusions; RBA, least-cost routing; NPP Australia, PayTo; ASIC, BNPL credit licensing.
Security: PCI Security Standards Council.
Least-cost routing and PayTo points were confirmed via search summaries of official and provider material. Tables, checklists and example are ours. No fees are quoted. Nothing here is financial or legal advice or ZSpace client data.
Conclusion
A good payment integration is mostly about the unglamorous paths: webhooks, retries, refunds, disputes and reconciliation. In Australia, update for the October 2026 surcharging change, ask about least-cost routing, and consider PayTo where bank payments suit your customers. Choose a provider for your platform and transaction mix, keep card data off your servers, and test every path before launch.
Integrating payments?
ZSpace Labs is an India-based, remote-first technology studio working with Australian and international businesses on payment integrations, Shopify checkouts and in-app payments. If it would help to review your payment flows, we are happy to talk it through.
Common questions.
There is no single best gateway. The right choice depends on your platform, payment methods your customers use, recurring billing needs, marketplace or split payments, least-cost routing support, reporting, settlement times, fraud tools, support and pricing for your volume. Shortlist providers that support your platform and requirements, and compare quotes on the same transaction mix.