Payment Gateway Integration is where ERP discipline either begins or breaks.
Capture Payment via Online Payment Link / Gateway looks operational from far away. In a real finance team, it is a chain of assertions: the right actor started the work, the required records existed, the control policy was applied, the state change was preserved, and the outcome can be explained later without rebuilding the transaction from emails and spreadsheets.
The expected business outcome is specific: Customer can self-serve payment without contacting AR; payment is auto-applied in real time; DSO improves from reduced friction.
The control flow a finance team actually needs.
Step 1
Payment Link Be Invoice-Specific And...
Step 2
Gateway Webhook Be HMAC-Verified Before...
Step 3
Duplicate Webhook Delivery Be Idempotent
Step 4
Gateway Fees Be Recorded Separately
Step 5
Partial Payment Via Gateway Leave...
The ERP surface involved.
Module
Payment Gateway Integration
Actors
Customer, Payment Gateway (Stripe/Braintree), AR System
Tier
Tier 1
Finance area
Accounts Receivable & Order-to-Cash
Region lens
US and UK finance teams
Publication date
March 21, 2026
Payment link must be invoice-specific and expire after configurable period; gateway webhook must be HMAC-verified before processing; duplicate webhook delivery must be idempotent; gateway fees must be recorded separately (DR Bank Fees, CR Cash); partial payment via gateway must leave invoice open; payment link must support multiple currencies matching invoice currency; refund through gateway must sync back to AR credit memo; non-functional: webhook processing to invoice status update < 5 seconds; PCI DSS scope must be delegated entirely to the gateway (no raw card data stored).
US and UK teams have different compliance hooks, but the same control problem.
US teams usually care about clean evidence for audit support, vendor records, payment controls, tax reporting, and management review. UK teams usually care about VAT-ready records, approval evidence, digital-record discipline, and traceable postings. The country-specific details differ, but the operating pattern is the same: the ERP needs controlled records, explicit ownership, defensible state changes, and evidence that survives beyond the person who completed the task.
The control matrix.
| Control area | Requirement | Acceptance proof |
|---|---|---|
| Control 1 | Payment link must be invoice-specific and expire after configurable period | Given an open invoice with a payment link generated and sent to the customer |
| Control 2 | gateway webhook must be HMAC-verified before processing | when the payment gateway webhook delivers a successful payment event |
| Control 3 | duplicate webhook delivery must be idempotent | then system verifies HMAC signature, applies payment idempotently to the invoice, posts GL entry DR cash CR accounts_receivable, sets invoice status=PAID, and sends confirmation to customer within 5 seconds |
| Control 4 | gateway fees must be recorded separately (DR Bank Fees, CR Cash | negative) when the same webhook event_id is delivered twice then second delivery returns 200 with no duplicate posting. |
| Control 5 | partial payment via gateway must leave invoice open | Customer can self-serve payment without contacting AR; payment is auto-applied in real time; DSO improves from reduced friction. |
| Control 6 | payment link must support multiple currencies matching invoice currency | Customer can self-serve payment without contacting AR; payment is auto-applied in real time; DSO improves from reduced friction. |
Audit evidence is a chain, not a folder.
| Evidence layer | What should be preserved |
|---|---|
| Business event | AR system generates a unique payment link for an open invoice and includes it in the invoice email; customer clicks the link, is presented with the invoice details on a hosted payment page, and pays by credit card or ACH; the payment gateway processes the transaction and sends a webhook event to the AR system; the system auto-applies the payment to the invoice, posts the cash receipt journal entry (DR Cash/Clearing, CR Accounts Receivable), and sends a payment confirmation to the customer; the invoice status changes to Paid. |
| Control rules | Payment link must be invoice-specific and expire after configurable period; gateway webhook must be HMAC-verified before processing; duplicate webhook delivery must be idempotent; gateway fees must be recorded separately (DR Bank Fees, CR Cash); partial payment via gateway must leave invoice open; payment link must support multiple currencies matching invoice currency; refund through gateway must sync back to AR credit memo; non-functional: webhook processing to invoice status update < 5 seconds; PCI DSS scope must be delegated entirely to the gateway (no raw card data stored). |
| Acceptance proof | Given an open invoice with a payment link generated and sent to the customer; when the payment gateway webhook delivers a successful payment event; then system verifies HMAC signature, applies payment idempotently to the invoice, posts GL entry DR cash CR accounts_receivable, sets invoice status=PAID, and sends confirmation to customer within 5 seconds; (negative) when the same webhook event_id is delivered twice then second delivery returns 200 with no duplicate posting. |
| Data record | |
| System event | |
| Lifecycle state | |
The useful version of this workflow is not only fast. It is inspectable. A controller, auditor, or operator should be able to move from source event to system record to state transition to final business outcome without guessing.
Implementation contracts.
Reference data model
`payment_gateway_event` { id: string, gateway_provider: string, event_type: string, invoice_id: invoice_*, amount_minor: int64, currency_code: char(3), gateway_fee_minor: int64, processed_at: timestamp, idempotency_key: string }; `payment_link` { id: string, invoice_id: invoice_*, expires_at: timestamp, status: enum }; (reference, product may differ).API and events
`POST /v1/payment-links` { invoice_id, expires_at } -> 201 { id, url }; `POST /v1/webhooks/payment-gateway` { event_type, event_id, invoice_id, amount_minor, currency_code, gateway_fee_minor } -> 200; emits `ar.payment.gateway.received`; idempotent via gateway `event_id`.State transitions
payment_link: `ACTIVE -> EXPIRED | USED`; invoice: `OPEN -> PAID`; guard: HMAC verification required before any processing; duplicate event_id is a no-op.Common implementation traps.
Treating the workflow as data entry
If the ERP only stores the final record, the team loses the decision trail that explains how the record became valid.
Hiding exception logic
Exceptions need owners, reason codes, and time stamps. A vague pending state is not a control.
Posting without recovery design
Retries, duplicate submissions, and partial failures must be explicit so the system does not create inconsistent records.
Skipping evidence design
A workflow that cannot produce evidence on demand will eventually push finance teams back into manual screenshots and spreadsheets.
Where Rivane fits.
Rivane is built for finance workflows where automation must stay tied to source documents, approvals, state transitions, ledger impact, reporting, and audit evidence. Use this guide as a checklist for evaluating whether an ERP workflow is merely digitized or actually controlled.
References and source basis.
These sources provide the standards, regulatory, or government context around the flow. They are included so the guide is useful to finance operators, auditors, and implementation teams, not only buyers reading software copy.