QRIS Payment Integration for Your Website: An Owner's Guide

Customers in Indonesia are increasingly used to paying by scanning QRIS, opening an e-wallet, or transferring to a virtual account. If your website still asks people to transfer money and send a receipt over chat, every order needs a manual check. An admin has to match the amount, reply, then unlock access or process the order. It's slow, error-prone, and hard to keep up at night.

This article explains, in plain terms, how payment integration through a payment gateway works. The examples come from Numekara, the education business run by Lumekara's owner, which uses Midtrans in production and has already processed real transactions and refunds.

How a payment gateway works, briefly

A payment gateway sits between your website and the various payment methods, so you don't have to connect to every bank or e-wallet yourself. The flow looks roughly like this:

1. The customer picks a product and presses the pay button on your website.
2. Your server creates an order and asks the gateway to set up a transaction, using an amount calculated on the server.
3. The customer sees a QRIS code or a virtual account number, or is sent to an e-wallet app. In Midtrans, this ready-made payment page is called Snap.
4. Once the customer pays, the gateway sends a notification to your server.
5. Your server checks the notification, records the payment, then runs the next step, such as unlocking access or sending a confirmation email.

Step two matters most: prices must be calculated on the server, not sent from the customer's browser. If the price comes from the page, someone could edit it before paying.

QRIS, e-wallets, and virtual accounts

• QRIS: one QR code that can be scanned from many banking and e-wallet apps. Ideal for quick payments from a phone.
• E-wallets: the customer is sent to an app such as GoPay to approve the payment. At Numekara, GoPay sits alongside QRIS.
• Virtual accounts: an account number created for a single order. Customers can pay through mobile banking, internet banking, or an ATM, and the payment is recognised automatically.

You don't need every method at once. Start with what your customers ask for most and add more later. Per-transaction fees differ by method and by provider, so check them directly with the provider you choose.

Webhooks: how your system knows a payment is real

The notification a gateway sends to your server is called a webhook. It is the source of truth for payment status, not the “thank you” page the customer sees. That page might close before it loads, or be reopened without any payment at all.

Because a webhook can unlock access, your server must make sure it's genuine. At Numekara, every Midtrans notification has its signature checked: a code that only someone holding the account's secret key can produce. Notifications with a mismatched signature are rejected.

Duplicate notifications are another common blind spot. A gateway may send the same notification more than once, for instance when your server is slow to respond. A well-built system records each payment only once, so customers don't get double access and promo quotas aren't used up twice.

Automatic access and refunds

Once a payment is verified, the next steps can run without an admin. At Numekara, product access unlocks as soon as an order is paid, and the owner gets a Telegram alert when a payment arrives. Promo codes are supported too, including orders that drop to Rp0 after a promo, so the flow stays the same even when nothing is charged.

Plan refunds from day one. A typical problem: the money has gone back to the customer, but their access is still active because nobody remembered to close it. At Numekara, a full refund automatically trims the access period that came from that order, so no one has to hunt it down by hand.

Still accepting manual transfers, with unique codes

Some customers still prefer an ordinary bank transfer. You don't have to refuse it, but make it easy to match. Add a small unique code to the invoice amount so every order has a different total. When the transfer shows up in your bank statement, the admin just looks for the exact amount. Numekara uses this for manual transfers alongside Midtrans payments.

What you need to prepare

• A verified merchant account. Gateways usually ask for business and bank details before you can take real payments.
• Testing in sandbox mode. Nearly every provider has a test mode. Try the payment, the access unlock, and the refund there before going public.
• A written refund policy. Decide when refunds are given and what happens to the customer's access.
• Handling unpaid orders. Decide how long an order waits before it expires, so stale records don't pile up.
• Alerts for your team. Pick a channel people actually read, such as email or Telegram, so payment problems surface quickly.

Next steps

Write down how payments are received and confirmed in your business today, including who checks them and how long it takes. Then decide which payment methods your customers need most and what should happen automatically once an order is paid. With that picture, the integration can be designed clearly, and you won't have to wait for transfer receipts over chat any more.