WooCommerce Payment Gateway Integration: Stripe, PayPal, Razorpay

class WC_Gateway_MyPay extends WC_Payment_Gateway {
    public function __construct() {
        $this->id                 = 'mypay';
        $this->has_fields         = true;
        $this->supports           = [ 'products', 'refunds', 'tokenization', 'add_payment_method' ];
        $this->init_form_fields();
        $this->init_settings();
        $this->title = $this->get_option( 'title' );

        add_action( 'woocommerce_update_options_payment_gateways_' . $this->id, [ $this, 'process_admin_options' ] );
        add_action( 'woocommerce_api_wc_gateway_mypay', [ $this, 'handle_return' ] );
    }

    public function process_payment( $order_id ) {
        $order = wc_get_order( $order_id );

        $response = wp_remote_post( $this->api_base . '/payments', [
            'timeout' => 20,
            'headers' => [ 'Authorization' => 'Bearer ' . $this->secret_key ],
            'body'    => [
                'amount'   => (int) round( $order->get_total() * 100 ),
                'currency' => $order->get_currency(),
                'order_id' => $order->get_id(),
            ],
        ] );

        if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) ) {
            wc_add_notice( __( 'Payment could not be initiated.', 'my-textdomain' ), 'error' );
            return [ 'result' => 'failure' ];
        }

        $body = json_decode( wp_remote_retrieve_body( $response ), true );

        // 3DS / SCA: do NOT complete the order yet.
        if ( ! empty( $body['next_action']['redirect_url'] ) ) {
            $order->update_status( 'on-hold', __( 'Awaiting 3DS authentication.', 'my-textdomain' ) );
            return [
                'result'   => 'success',
                'redirect' => esc_url_raw( $body['next_action']['redirect_url'] ),
            ];
        }

        $order->payment_complete( sanitize_text_field( $body['id'] ) );
        WC()->cart->empty_cart();
        return [ 'result' => 'success', 'redirect' => $this->get_return_url( $order ) ];
    }

    public function process_refund( $order_id, $amount = null, $reason = '' ) {
        $order = wc_get_order( $order_id );
        $txn   = $order->get_transaction_id();

        if ( ! $txn ) {
            return new WP_Error( 'mypay_no_txn', __( 'No transaction ID on this order.', 'my-textdomain' ) );
        }

        $response = wp_remote_post( $this->api_base . '/refunds', [
            'timeout' => 20,
            'headers' => [ 'Authorization' => 'Bearer ' . $this->secret_key ],
            'body'    => [
                'payment_id' => $txn,
                'amount'     => (int) round( $amount * 100 ),
            ],
        ] );

        if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) ) {
            return new WP_Error( 'mypay_refund_failed', __( 'Gateway rejected the refund.', 'my-textdomain' ) );
        }

        $order->add_order_note( sprintf(
            __( 'Refunded %1$s via MyPay. Reason: %2$s', 'my-textdomain' ),
            wc_price( $amount ),
            $reason ?: __( 'none', 'my-textdomain' )
        ) );

        return true; // false/null = WooCommerce treats it as a failure.
    }
}

The 3DS branch is the important part: completing the order before authentication is how you get "paid" orders that later reverse.

// Checkout return: HMAC over order_id|payment_id — in that order.
$expected = hash_hmac(
    'sha256',
    $razorpay_order_id . '|' . $razorpay_payment_id,
    $key_secret
);
if ( ! hash_equals( $expected, $razorpay_signature ) ) {
    wp_die( 'Invalid signature', 400 );
}

// Webhook: verify the RAW body, before json_decode.
$raw       = file_get_contents( 'php://input' );
$signature = $_SERVER['HTTP_X_RAZORPAY_SIGNATURE'] ?? '';
if ( ! hash_equals( hash_hmac( 'sha256', $raw, $webhook_secret ), $signature ) ) {
    status_header( 400 );
    exit;
}
$event = json_decode( $raw, true );

php://input can only be read once, so read it before any $_POST access, and use hash_equals to avoid timing leaks.

add_filter( 'woocommerce_available_payment_gateways', function ( $gateways ) {
    $currency = WC()->session ? WC()->session->get( 'currency' ) : get_woocommerce_currency();

    $unsupported = [
        'razorpay' => [ 'INR' ],
        'paystack' => [ 'NGN', 'GHS', 'ZAR', 'KES' ],
    ];

    foreach ( $unsupported as $gateway_id => $currencies ) {
        if ( isset( $gateways[ $gateway_id ] ) && ! in_array( $currency, $currencies, true ) ) {
            unset( $gateways[ $gateway_id ] );
        }
    }

    return $gateways;
} );

Without this the shopper picks a gateway, reaches the last step and the charge fails, which is the worst place to lose a conversion.