Technologies / Payments
Payment gateway integration for mobile apps, done to store rules
Payment gateway integration for mobile apps is where engineering, App Store policy and compliance meet, and where a wrong early decision is expensive to undo. Pick the wrong payment method for digital goods and Apple or Google rejects the build. Handle card data on your own servers and your PCI scope balloons. Choose a gateway that does not support your business’s country and you discover it at onboarding.
This page is for founders and CTOs planning checkout, subscriptions or wallets. For a hands-on walkthrough with code-level steps, read our guide to integrating Stripe, PayPal, JazzCash and Easypaisa in an app.
- Card data tokenised by the provider
- IAP vs external payment decided up front
- Webhooks with idempotency and reconciliation
- Merchant accounts in your company’s name
First decision: in-app purchase or a payment gateway?
The store rules decide which payment method you are allowed to use before any gateway is chosen. Get this wrong and the app is rejected.
| What the user pays for | Apple App Store | Google Play |
|---|---|---|
| Digital content, features, subscriptions, in-game currency | Must use in-app purchase (Guideline 3.1.1) | Play billing required for digital items and subscriptions |
| Physical goods and services used outside the app (food, rides, e-commerce, bookings) | Must use other methods such as Apple Pay or card entry (3.1.3(e)) | Play billing must not be used; use your gateway |
| Bill payments, P2P transfers and donations | Optional gifts between individuals may skip IAP if 100% reaches the receiver (3.2.1(vii)); money-management apps must be submitted by the licensed institution (3.2.1(viii)); in-app charity collection is for approved nonprofits with Apple Pay (3.2.1(vi)) | Play billing must not be used |
| Real-time one-to-one services (tutoring, consultations, fitness training) | May use payment methods other than IAP (3.1.3(d)) | We confirm the category against the current Payments policy |
| Crypto wallets and exchanges | Wallets only from developers enrolled as an organisation; exchanges only where the app is licensed (3.1.5) | Country-specific licensing under Play’s crypto policy, e.g. FCA registration in the UK |
Sources: Apple App Review Guidelines and Google Play Payments policy. Rules change; we check the current text at build time.
Store fees: what applies when you use a gateway
Physical goods and real-world services paid through your own gateway pay no store commission, only the gateway’s fees, which is why the table above decides margins as much as engineering, for example in food delivery apps and e-commerce apps. Guideline numbers in the table refer to Apple’s App Review Guidelines.
Digital goods sold through the stores pay Apple’s and Google’s fees, which vary by storefront, earnings tier and billing method, and US rules on external payment links are changing. Our page on in-app purchases and subscriptions for mobile apps keeps the current rates, Google’s alternative billing programmes and the US link-out position in one place. We design to the current rules at build time and keep the payment entry point easy to change.
Gateways and wallets we integrate
We pick the gateway based on where your company is registered, where your customers are and what they pay for.
Stripe
Strong mobile SDKs, Payment Sheet, subscriptions and Connect for marketplaces. Available to businesses in 51 countries per Stripe’s global availability page, including the US, UK and UAE. Pakistan is not on the list.
Braintree and PayPal
PayPal checkout and wallet for buyers who prefer it, plus Braintree for cards, often added alongside another gateway to lift conversion in some markets.
Adyen
Common for larger merchants that need many local payment methods across regions under one contract and one reconciliation feed.
Apple Pay and Google Pay
Wallet buttons on top of your gateway for physical goods and services. They cut checkout steps and typically run through the same provider as cards.
In-app purchases
StoreKit 2 and Google Play Billing for digital goods and subscriptions, with server-side receipt validation and restore flows.
Pakistan: JazzCash, Easypaisa, Raast
Local wallets and bank transfers for apps serving Pakistani customers. Details below.
Reducing PCI DSS scope: keep card data off your servers
The PCI Data Security Standard applies to anyone who stores, processes or transmits card data. The current version is PCI DSS v4.0.1, published in June 2024; v4.0 was retired at the end of 2024, and requirements that were future-dated became mandatory after 31 March 2025.
The cheapest way to stay compliant is to never touch card numbers. With Stripe’s Elements, Checkout or mobile SDKs, card data goes straight to Stripe and is tokenised, so it never reaches your servers, and merchants typically qualify for SAQ A, which Stripe calls “the lowest-burden option”. Stripe is also clear that this does not make you PCI compliant by default: you still complete the questionnaire and secure your own systems.
What we never do
Collect card numbers in our own text fields, log full payment payloads, or store card data in the app or backend. Every integration uses the provider’s SDK or hosted fields, and only tokens and references reach your database. For the wider picture, including KYC and AML, see our guide to fintech app compliance and our fintech banking app development page.
Planning checkout, subscriptions or a wallet?
Tell us what users pay for and where your company is registered. Within one business day you get our recommendation on IAP vs gateway, which providers fit, and the compliance steps involved.
Payments for Pakistan-based merchants
Stripe does not list Pakistan as a supported country, so a merchant registered in Pakistan cannot open a Stripe account for that entity. Pakistani businesses serving local customers use local rails instead:
- JazzCash: an online gateway with Card API (Visa/Mastercard), Mobile Wallet API and voucher payments, hosted checkout, 3D Secure, IPN webhooks and a sandbox, per the JazzCash documentation.
- Easypaisa: an online gateway accepting Easypaisa Mobile Account and over-the-counter token payments, open to businesses with a live website or mobile app.
- Raast: the State Bank of Pakistan’s instant payment system. Its person-to-person phase launched in February 2022, using an IBAN or a Raast ID (mobile number), and is free for end customers. How it fits a merchant checkout depends on your bank’s offering.
Companies registered abroad that serve customers in several countries often combine an international gateway with these local methods. Our e-wallet and payment app development work covers wallets built on these rails.
How we deliver payment gateway integration for mobile apps
The same sprint process as all our work, with the payment-specific steps made explicit.
Map money flows
Who pays whom, for what, in which currency, and whether it counts as digital or physical under store rules. Marketplaces also need split payments and payouts.
Choose providers and open accounts
You open merchant accounts in your company’s name; we prepare the technical answers onboarding teams ask for.
Build server-side first
Payment intents, webhooks, idempotency keys and a ledger table on your backend, tested against the provider’s sandbox. This sits in your mobile app backend, usually Node.js or Laravel.
Integrate the app SDKs
Native payment sheets, Apple Pay and Google Pay, 3D Secure and Strong Customer Authentication challenges where they apply.
Test failure paths
Declines, timeouts, duplicate taps, app killed mid-payment, refunds and disputes, on real devices.
Reconcile and monitor
Daily reconciliation of provider reports against your ledger, with alerts on webhook failures.
Payment integration checklist
What we confirm before a payment build goes to App Review.
- Correct method per item type: IAP for digital, gateway for physical goods and services
- No raw card data on our servers or in logs
- Webhooks verified by signature and processed idempotently
- Strong Customer Authentication handled for UK and EU cards
- Refunds, partial refunds and disputes handled in the admin panel
- Receipt validation server-side for subscriptions
- Review notes and a sandbox test account for Apple and Google reviewers
Payment gateway integration: frequently asked questions
Can we use Stripe instead of Apple in-app purchase?
Only for the right items. Apple requires in-app purchase for digital content, features and subscriptions unlocked in the app. Physical goods and services used outside the app, such as food, rides or retail orders, must use other methods like Stripe or Apple Pay. US storefront rules on external purchase links are changing, so we confirm the current rules at build time.
Does using Stripe make our app PCI compliant?
Not automatically. Using Stripe’s mobile SDKs, Elements or Checkout keeps card data off your servers and typically qualifies you for SAQ A, the lowest-burden questionnaire. You still need to complete it and secure your own systems. Stripe says this itself. The big win is scope: your backend never handles raw card numbers.
Can a Pakistan-based company use Stripe?
Not for a Pakistan-registered entity. Stripe’s availability page lists 51 countries and Pakistan is not among them, while the US, UK and UAE are. Pakistani merchants serving local customers typically use JazzCash, Easypaisa or bank transfers via Raast. Companies registered abroad can use Stripe for that entity and add local methods where needed.
Do we need Strong Customer Authentication?
If you charge cards issued in the UK or EU, yes in most cases. SCA under PSD2 requires two independent factors from different categories, such as a password plus a device, or a device plus a biometric. Modern gateway SDKs handle the 3D Secure challenge inside the app; we test it on real devices with the provider’s test cards.
How do marketplace apps split payments?
Through a marketplace product from the gateway, such as Stripe Connect, which collects from the buyer and pays out to sellers or drivers after your commission. That adds seller onboarding and identity checks, payout schedules and refund rules. We design the money flow and the admin tooling together so finance can reconcile every payout.
How long does payment integration take?
It depends on the number of providers, item types and whether you need subscriptions, marketplace payouts or wallets. A single gateway with cards and Apple Pay or Google Pay is a contained piece of work; marketplaces and multi-provider setups take longer. We estimate it inside your project backlog after discovery, as part of the fixed price.
Plan your payment flow before you build it
Book a 30-minute scoping call. We will map what your users pay for, which store rules apply, and which gateways fit your company and markets.