What Is the Best Payment Gateway for a Bangladesh-Based Website?
For most web developers in Bangladesh, SSLCommerz is the best starting point because it aggregates bKash, Nagad, debit cards, credit cards, and internet banking into a single API. You integrate once, and your customers can pay with whichever method they already use. That matters in a market where cash on delivery still dominates but digital payments are growing fast.
If you need direct integration with bKash or Nagad specifically, you can do that too. But you will need separate merchant accounts and separate technical setups. The choice depends on your project’s requirements, your client’s business model, and how much control you want over the checkout flow.
Why Use SSLCommerz Instead of Direct bKash or Nagad APIs?
SSLCommerz acts as a payment orchestration layer. It handles the messy parts: redirects, callbacks, validation, and reconciliation. You send a single request, and SSLCommerz decides which payment method the customer picks. This saves you from maintaining multiple integrations and keeping up with each provider’s changing API.
Direct bKash payment gateway integration gives you a more branded checkout experience, but it comes with extra work. You need to handle the bKash tokenized API, manage OTP flows, and deal with refunds yourself. The same applies to Nagad API. For most small and medium e-commerce sites, SSLCommerz is the pragmatic choice.
That said, there are scenarios where direct integration makes sense. Large merchants with high transaction volumes might negotiate better rates directly with bKash or Nagad. Or you might be building a custom wallet app that needs deep bKash integration. In those cases, you skip SSLCommerz and work directly with the provider’s technical team.
SSLCommerz Integration Step by Step for Web Developers
SSLCommerz’s flow is straightforward: initiate a payment session, redirect the customer to their chosen payment method, and receive a confirmation via webhook. The official documentation is decent, but it assumes you already know how to handle server-side callbacks securely.
1. Get Your Credentials
You need a store ID and a store password from SSLCommerz. You get these when you sign up for a merchant account. For testing, SSLCommerz provides a sandbox environment with test credentials. Do not hardcode these in your frontend code. Store them in environment variables or a config file outside your public directory.
2. Create the Payment Initialization Request
Your server sends a POST request to https://sandbox.sslcommerz.com/gwprocess/v4/api.php (sandbox) or https://secure.sslcommerz.com/gwprocess/v4/api.php (live). The request includes your store ID, transaction ID, amount, currency (BDT), customer name, phone, email, and the success, fail, and cancel URLs.
// Example request body (simplified)
{ "store_id": "your_store_id", "store_passwd": "your_store_password", "total_amount": 1500, "currency": "BDT", "tran_id": "unique_transaction_id", "success_url": "https://yourdomain.com/payment/success", "fail_url": "https://yourdomain.com/payment/fail", "cancel_url": "https://yourdomain.com/payment/cancel", "cus_name": "Customer Name", "cus_phone": "01712345678", "cus_email": "[email protected]"
}
The response contains a GatewayPageURL. Redirect the customer to that URL. That is it. The customer completes payment on SSLCommerz’s hosted page.
3. Handle the Callback (Success, Fail, Cancel)
After payment, SSLCommerz redirects the customer to your success, fail, or cancel URL. But do not trust that redirect alone. The customer might close the browser before the redirect, or they might refresh the success page. Always verify the payment status on your server.
SSLCommerz sends a server-to-server notification to your success URL before or after redirecting the customer. This is called the IPN (Instant Payment Notification) or webhook. In your IPN handler, call SSLCommerz’s validation API with the val_id you received. That API returns the transaction status. Only update your order status if the validation says the transaction was successful.
4. Test with the Sandbox
SSLCommerz provides test cards and test wallets. Use them to run through the entire flow. Test the success path, the fail path, and the cancel path. Also test what happens when the IPN arrives after the customer has already closed the browser. Your IPN handler should be idempotent, meaning it can run multiple times without causing duplicate order updates.
Direct bKash Payment Gateway Integration
If you decide to integrate bKash directly, you are dealing with the bKash Tokenized Checkout API. It is a REST API that works in two main phases: create a payment and execute a payment. The flow is more involved than SSLCommerz, but it gives you a custom checkout button that says “Pay with bKash” right on your site.
Prerequisites for bKash API Integration
You need a bKash merchant account and then you must apply for API access. bKash approves API credentials on a case-by-case basis. They usually require a live website and a clear business model. The credentials include a username and password, plus an app key and app secret. You use these to get an access token.
The bKash Tokenized Checkout Flow
Here is the sequence:
- Your server gets an access token from bKash using your app key and secret.
- Your server creates a payment with the customer’s phone number and amount. bKash returns a payment ID.
- Your server executes the payment. This sends a push notification to the customer’s bKash app.
- The customer approves the payment in the app. bKash sends a callback to your server with the transaction status.
You must store the access token securely and refresh it regularly. Tokens expire after a certain period, typically an hour. Your code needs to handle token expiry gracefully, which means retrying the request with a fresh token.
Common bKash Integration Pitfalls
One issue developers hit is using the wrong base URL. Sandbox and production URLs are different. Another is not validating the callback signature. bKash sends a callback with a status field, but you should always verify the payment amount and transaction ID against your own records before confirming the order.
Also, bKash requires that your server’s callback URL be publicly accessible and HTTPS. Localhost testing will not work. You will need a tunneling tool like ngrok or a staging server.
Direct Nagad API Integration
Nagad’s API is similar in spirit to bKash’s but with different endpoints and authentication. Nagad also offers a tokenized checkout option. The documentation is less mature than bKash’s, so be prepared to work with their support team more actively.
Nagad API Setup
You need a Nagad merchant number and a wallet. After approval, you get merchant ID and a public key. Nagad uses a signing mechanism where you create a sensitive data payload, encrypt it, and send it with a signature. It is not as simple as a basic API key.
The flow involves creating an order, getting a payment URL, and then handling the callback. Nagad’s callback sends a status and a reference number. You must verify the reference number against your order before marking it paid.
Nagad Integration Headaches
Developers often struggle with Nagad’s encryption requirements. The documentation gives examples, but they are easy to miss if you are not familiar with RSA encryption. Make sure your server clock is accurate, because Nagad uses timestamps in the signature. A few minutes of drift can cause authentication failures.
Comparing bKash, Nagad, and SSLCommerz: Which One to Choose?
Here is a practical comparison to help you decide for your next project.
| Factor | SSLCommerz | bKash Direct | Nagad Direct |
|---|---|---|---|
| Integration complexity | Low to medium | Medium to high | High |
| Payment methods covered | bKash, Nagad, cards, internet banking | bKash only | Nagad only |
| Checkout experience | Hosted page (redirect) | Embedded on your site | Embedded or redirect |
| Approval time | Fast (often within days) | Can take weeks | Can take weeks |
| Support quality | Good, with clear docs | Varies, requires relationship | Documentation is thinner |
| Best for | Most e-commerce sites | High-volume merchants | Nagad-focused businesses |
How to Handle Refunds and Reconciliation
Refunds are a fact of e-commerce life. SSLCommerz has a refund API that lets you initiate a refund to the original payment method. bKash also has a refund API, but it requires the original transaction ID and you must initiate it within a certain time frame. Nagad’s refund process is less standardized, so you may need to work with their support team.
Reconciliation is about matching your internal order records with the payment provider’s transaction records. Build a daily reconciliation script that pulls all transactions from the provider’s API and compares them with your orders. This catches discrepancies early and saves you from painful manual audits.
Security Best Practices for Payment Integration
Payment data is sensitive. Do not store raw payment details unless you absolutely must. Use HTTPS everywhere. Validate all callbacks on the server side, never trust the client side.
For SSLCommerz, always verify the val_id with their validation API. For bKash and Nagad, check the transaction status and amount in the callback. Also, log all payment events. Logging helps you debug issues and provides an audit trail.
Another practice is to use a unique transaction ID for each order. Do not reuse the same ID across retries. If a payment fails, generate a new transaction ID for the retry.
Common Mistakes Developers Make with Payment Gateways in Bangladesh
Here are the mistakes I see most often in code reviews and forums.
- Hardcoding credentials in the frontend or committing them to public repositories.
- Not verifying the webhook signature or status before updating the order.
- Using a single callback URL for all environments, which mixes sandbox and live data.
- Assuming the redirect from the provider is enough to confirm payment.
- Not handling the case where the IPN arrives before the redirect or after a page refresh.
- Ignoring timeouts. Payment gateways can be slow, especially during peak hours.
Testing Your Payment Integration Like a Professional
Set up a separate testing environment with the sandbox credentials. Use a staging database so you do not pollute production data with test orders. Write automated tests that simulate the callback from the provider. You can use a tool like Postman to manually test the validation APIs.
Also, test with real devices if possible. bKash and Nagad both have mobile apps. The push notification flow behaves differently on a real phone than in a simulator. If you cannot test with a real device, at least test the callback handling thoroughly.
How to Go Live with Your Payment Integration
Before going live, switch your credentials from sandbox to live. Make sure your live URLs are HTTPS and publicly accessible. Run a small live transaction with a real amount, like 10 BDT, to verify the end-to-end flow. Then refund that amount to confirm the refund path also works.
Update your error handling. In production, you want to show friendly messages to customers but log detailed errors for yourself. Also, set up monitoring on your payment endpoints. Use a logging service or a simple cron job that checks if the payment API is responsive.
When to Use a Payment Gateway vs. a Full Payment Platform
If you only need to accept payments on a standard e-commerce site, SSLCommerz is enough. If you need subscriptions, invoicing, or multi-vendor payouts, you might look at a more full-featured platform. But for the majority of projects in Bangladesh, a single gateway integration covers the need.
There is also the option of using a payment aggregator like Shurjopay or a bank’s own gateway. But SSLCommerz remains the dominant player because of its wide coverage and developer-friendly documentation.
Conclusion: Start with SSLCommerz, Expand Later
Start with SSLCommerz for almost any new project in Bangladesh. It gives you bKash, Nagad, and card payments with one integration. You can always add a direct bKash or Nagad integration later if your client’s business demands it.
Before you write a single line of code, read the SSLCommerz documentation and set up your sandbox. Then build a small proof of concept with a test product. That will teach you more than any guide.
Frequently asked questions
Is SSLCommerz suitable for small e-commerce sites in Bangladesh?
Yes. SSLCommerz is designed for small and medium businesses. It supports bKash, Nagad, cards, and internet banking through one API. The setup is straightforward, and the sandbox lets you test without a merchant account.
Can I integrate bKash directly without SSLCommerz?
Yes, you can. You need to apply for a bKash merchant account and API access. The integration is more complex than using SSLCommerz, but it gives you a branded checkout. You must handle token management and callback verification yourself.
Does Nagad have a public API for developers?
Nagad offers API integration for merchants, but access is not fully public. You must apply for a merchant account and receive API credentials. The documentation exists but is less detailed than bKash's. You will likely need to contact support for clarifications.
What are the fees for SSLCommerz, bKash, and Nagad?
Fees vary by plan and transaction volume. SSLCommerz charges a per-transaction fee that depends on the payment method and your business category. bKash and Nagad also charge merchant fees. Contact each provider for current rates because they change.
How do I test SSLCommerz integration without a live merchant account?
SSLCommerz provides a sandbox environment with test credentials. You can obtain these by signing up on their developer portal. Use the test URLs and test payment methods to simulate transactions and callbacks.
What is the IPN and why is it important in SSLCommerz?
IPN stands for Instant Payment Notification. It is a server-to-server HTTP request that SSLCommerz sends to your success URL after a payment. It carries the payment status. You must validate it with SSLCommerz's API to confirm the transaction before updating your order.