Posts tagged #payments on Dynamo Geeks: 11 posts from the community, most useful first.
timeouts are not failures. if the bank API times out you dont know whether money moved. mark it UNKNOWN, then query status or retry with the same idempotency key. never show 'payment failed, try again' on a timeout, thats how double charges happen
Every Friday deploy story starts with "it was just a config change". So here is mine. Our partner bank rotates the public key they use to sign payment callbacks once a year. They emailed us the new key, I updated the config and deployed at 6pm on Friday because the old key was expiring on Saturday. Felt responsible. Was not. We run the callback service on 2 pods. The config came from a mounted secret, one pod picked…
my app takes payments through stripe billing, and stripe tells my app what happened (paid, failed, cancelled) through webhooks. webhooks look simple. a POST request arrives, you update a row. i have now shipped five different bugs in roughly 80 lines of code, so here they are, in the order they hurt me. 1. parsing the body before verifying the signature stripe signs every webhook and you should check that signature,…
Every payment gateway webhook doc says some version of "we may send the same event more than once". What they say less loudly: events can arrive out of order, and sometimes they dont arrive at all. Our first webhook handler assumed none of this. Here is the version that survived. 1. Twice: store the event id Every event has an id. Insert it into a processed_events table with a unique constraint before doing anything…
We have a payouts table and 4 worker processes that pick pending payouts and call the bank API. Right now each worker does this: begin; select * from payouts where status = 'pending' order by created_at limit 10 for update skip locked; -- call bank API for each row (can take up to 30s) update payouts set status = 'sent' where id = ...; commit; It works, no double picks. But the transaction stays open during the HTTP…
If you move money, at some point finance will ask "does our ledger match the bank". The honest answer at most startups is "mostly". This post is how we went from "mostly" to a daily report that finance actually trusts. It took us around 4 months, so dont feel bad if yours is still a spreadsheet. Three sources, not two For card and UPI payments you have three views of the same money: Your ledger: what you think…
PSA from someone who has seen it in prod: 0.1 + 0.2 in javascript is 0.30000000000000004. if your checkout total is calculated with floats in the browser, recalculate it on the server in paise/cents. never trust the total the client sends
Partner bank sends us a settlement file every morning. We compare it with our ledger and the totals should match to the paisa. One Monday it was off by ₹410.37. Not a lot of money. But a mismatch is a mismatch and finance will not close the day with it. First day we checked the obvious things. Missing transactions, duplicates, refunds settled on a different day. Everything matched row by row on the transaction…
Threat modelling has a reputation for being a heavy process with special tools and a 40 page document nobody reads. It does not have to be. For most features, a 45 minute session with the people who built it finds the important problems. This is the format I use with product teams at the bank. Before the session (10 minutes, one person) Draw the data flow on one page. Boxes for components, arrows for data, and…
Every fintech I have worked at started with a balance column on the users table. And every one of them later spent months moving away from it. If you are building anything where money moves between parties, wallets, marketplaces, lending, start with a ledger. It is less work than it sounds and Postgres gives you almost everything you need. This is the design we run in production now. Nothing fancy. Boring is the…
Last year we had a customer charged twice for the same EMI. Not a big amount, but the customer was right to be angry and our support team spent one full day itself on it. The root cause was not the bank, not the gateway. It was us, and the way we did idempotency keys. Sharing what we got wrong, because since then I have seen the same mistakes in two other codebases. What an idempotency key is supposed to do The…
