Topic Guide
Payment Gateway Integration
Stripe and Authorize.Net are the two gateways this platform has actually shipped, and they don't share a flow shape. One expects your landing page to capture the charge. The other, Authorize.Net's DPM flow, settles before your page ever sees it. Build one handler and copy it for the other, and the failure is silent: no error, no exception, just a receipt that never generates or a transaction ID confused for an invoice number.
Every post here is a real integration bug or a real hardening decision from running both gateways in production. Some are pure debugging: a gateway callback that fed a raw POST field straight into a SQL WHERE clause, an x_trans_id treated as an invoice number because an OR fallback made them look interchangeable. Some are process: a tokenization feature that passed every sandbox test and then hit a vendor capability flag that was never enabled in production. One is a debugging technique worth stealing on its own, shipping a throwaway relay page to prod on purpose because a gateway won't POST to localhost.
The throughline: a payment gateway callback is still a public endpoint, sandbox passing is not proof, and the two flow shapes are not interchangeable no matter how similar the code looks.
8 posts in this guide, by DX
Start here
Stripe Needs a Post-Back, Authorize.Net Doesn't: One Page, Two Flow Shapes
Stripe expects your landing page to capture the charge; Authorize.Net DPM settled before the redirect. Copying one handler for the other fails silently in prod.
The two flow shapes, and what breaks when you conflate them
-
Server-Side JavaScript on Classic ASP in 2026: Prototype Pages and the DB Helper Pattern
A production payment flow in server-side JScript on classic ASP, and the OR-fallback bug that read the gateway's transaction ID instead of the invoice ID I sent.
-
x_trans_id Is Not Your Invoice Number: An Authorize.Net Direct-Post Bug
An OR fallback treated x_trans_id and x_invoice_num as the same identifier, so every prod receipt failed while tests passed. The fix was deleting half a line.
A gateway callback is still a public endpoint
Debugging a gateway you can't run on localhost
Sandbox passing is not proof
Payment data and the systems built around it
-
The Auto-Approval Feature That Quietly Rewrote Curated Data
A payment-confirmation automation overwrote a status that some administrators managed by hand. The remediation separated payment evidence from approval, added explicit tenant controls, and used a narrowly scoped, audited recovery process.
-
The reuse story died, so I shipped a new cart instead
I went in expecting to wire tournament registration onto the existing cart. One grep later, the premise was dead and I was designing from scratch. The new cart shipped the same day.
Hitting one of these walls in your own codebase or your own machine? Talk it through with us, or read the rest of the Build Log.