Payment Gateway Integration in Sri Lanka: Providers, Fees & Setup (2026)
At a Glance - Payment Gateway Integration Sri Lanka (2026)
- Most common local: PayHere - cards, wallets, bank transfer · ~3% cards · T+1 settlement
- Wallet-focused: FriMi, Genie - lower MDR · same-day wallet settlement
- Enterprise / B2B: iPay - bank-grade · negotiable volume rates
- International: Stripe - USD/EUR cards · best API developer experience
- Fastest integration: PayHere hosted checkout · 1–2 weeks dev · LKR 80K–200K
- Non-negotiable: Server-side webhook verification · HTTPS · never store card numbers
Introduction
Payment gateway integration Sri Lanka is the technical layer between your checkout page and money in your bank account. Whether you run an e-commerce store, booking platform, SaaS product, or mobile app, customers expect to pay with Visa/Mastercard, FriMi, Genie, eZ Cash, and bank transfers - on mobile, without errors.
This guide covers provider comparison (fees, cards/wallets, settlement), PayHere integration, FriMi integration, and iPay integration requirements, a step-by-step workflow, security checklist, and development costs. For the broader fintech landscape (LankaQR, wallets, regulation), see our digital payments Sri Lanka guide.
Hashtag Coders has delivered online payment integration Sri Lanka across 40+ projects - e-commerce, booking engines, SaaS, and mobile apps. We build through our web development and mobile app development services.
Provider Comparison: Fees, Methods & Settlement
Fees below are typical published or market rates - your merchant agreement may differ by volume and category. Confirm current tariffs directly with each provider before signing.
| Provider | Cards | Wallets / Local | Setup Fee | Settlement | Approval Time |
|---|---|---|---|---|---|
| PayHere | Visa, MC, Amex · ~2.99–3.5% + LKR 5 | Genie, eZ Cash, mCash, FriMi, bank · ~1.5% | ~LKR 5,000 one-time | T+1 cards · instant wallets | 3–7 business days |
| FriMi | Limited / partner-dependent | FriMi wallet, LankaQR · ~1.5–2.5% | Varies | Same-day to T+1 | 5–10 business days |
| iPay | Visa, MC · ~2.5–3.5% + LKR 10 | Bank transfer, select wallets | Varies by bank partner | T+1 to T+2 | 5–14 business days |
| Genie | Limited | Genie wallet, QR · ~2.0–3.0% | Low / waived promotions | Instant to T+1 | 3–7 business days |
| Stripe | Global cards · 2.9% + $0.30 | Limited LK wallets | None | Rolling 2–7 day payouts | 1–3 business days |
| PayPal | PayPal balance / cards · 3.4–4.4% | N/A locally | None | 3–5 days to withdraw | 1–2 business days |
Supported Payment Methods by Provider
| Method | PayHere | FriMi | iPay | Stripe |
|---|---|---|---|---|
| Visa / Mastercard | ✓ | Limited | ✓ | ✓ |
| Amex | ✓ | - | Partner | ✓ |
| Genie / eZ Cash / mCash | ✓ | FriMi | Varies | - |
| Bank transfer / online banking | ✓ | ✓ | ✓ | - |
| LankaQR | Via wallets | ✓ | Partner | - |
| USD / international | LKR primary | LKR | LKR | ✓ 135+ currencies |
Which Gateway Should You Choose?
- Sri Lankan e-commerce (local customers): PayHere - widest method coverage, most documentation
- Wallet-heavy mobile audience: PayHere + FriMi or Genie direct
- Enterprise / bank partnership: iPay
- International SaaS / USD billing: Stripe
- Hybrid store: PayHere (LKR) + Stripe (international) - route by customer geo
Building a new store? See our e-commerce development Sri Lanka guide for platform + payment stack decisions.
Integration Methods & PCI Scope
| Method | How It Works | PCI Burden | Dev Time |
|---|---|---|---|
| Hosted redirect | Customer sent to PayHere/iPay payment page | Lowest (SAQ A) | 1–2 days |
| Embedded / JS SDK | Payment form on your domain via iframe/JS | Moderate (SAQ A-EP) | 3–5 days |
| Server API + custom UI | Your backend calls gateway API; custom checkout | Highest (SAQ D) | 1–3 weeks |
Recommendation: Start with hosted redirect for MVP; upgrade to embedded once conversion data justifies the UX investment.
Real Integration Workflow (PayHere Example)
This is the production flow Hashtag Coders implements for most PayHere integration e-commerce projects. FriMi and iPay follow the same pattern with provider-specific endpoints.
| Step | Action | Owner |
|---|---|---|
| 1 | Apply for merchant account (BR, bank details, live HTTPS site) | Business |
| 2 | Receive sandbox merchant_id, merchant_secret |
Gateway |
| 3 | Customer clicks Pay → server creates order (status: pending) |
Your backend |
| 4 | Server generates payment hash → redirect/POST to PayHere checkout URL | Your backend |
| 5 | Customer pays on gateway page (3DS if card) | Gateway |
| 6 | Gateway calls your notify_url webhook with payment status |
Gateway → your API |
| 7 | Server verifies hash signature → updates order to paid (idempotent)
|
Your backend |
| 8 | Customer redirected to return_url - show confirmation (verify
server status, not URL params alone) |
Frontend |
| 9 | Daily reconciliation: gateway report vs database | Finance / ops |
API Requirements (All Providers)
- HTTPS production site - valid TLS certificate; no payment pages on HTTP
- Server-side secret storage - merchant secrets in environment variables, never in frontend code
- Webhook endpoint - publicly reachable
POST /api/payments/webhookwith signature verification - Idempotency - duplicate webhooks must not double-fulfil orders (use payment ID as unique key)
- Order reference - unique
order_idper transaction passed to gateway - Amount & currency - LKR for local gateways; match exactly what customer sees at checkout
- Sandbox testing - test success, failure, timeout, and duplicate callback before go-live
PayHere Integration - Key Fields
Hosted checkout POST to PayHere requires:
merchant_id, return_url, cancel_url, notify_url,
order_id, items, amount, currency, hash (MD5 of
sorted fields + secret). Hash validation on webhook is mandatory - reject any callback with invalid signature.
FriMi Integration - Notes
FriMi integration suits mobile-first checkouts. Merchant onboarding through NTB; API provides payment initiation and status polling. Lower wallet MDR makes FriMi attractive when your audience already uses the app - pair with PayHere for card coverage if FriMi alone is insufficient.
iPay Integration - Notes
iPay integration is common for bank-affiliated and enterprise merchants. Strong fraud tooling; slightly longer onboarding. Best for high-ticket B2B invoices, hospitality, and education fee portals where bank trust matters.
Security Checklist (Before Go-Live)
- ☐ HTTPS on all checkout and webhook routes
- ☐ Merchant secrets in server env vars - not in Git, not in client bundle
- ☐ Webhook signature/hash verified on every callback
- ☐ Order fulfilled only after server-verified
paidstatus - ☐ Idempotent webhook handler (duplicate-safe)
- ☐ 3D Secure enabled for card payments
- ☐ No raw card numbers stored - tokens only if using saved cards
- ☐ Refund API implemented and tested in sandbox
- ☐ Failed payment UX - actionable error messages, retry option
- ☐ Mobile checkout tested on Android + iOS (75%+ SL e-commerce is mobile)
- ☐ Transaction log table for reconciliation and dispute evidence
- ☐ PCI scope documented (hosted vs embedded vs custom)
Development Costs & Timelines
| Integration Scope | LKR | Timeline |
|---|---|---|
| PayHere hosted checkout (existing site) | 80,000 – 200,000 | 1–2 weeks |
| Embedded checkout (single gateway) | 150,000 – 400,000 | 2–3 weeks |
| PayHere + Stripe (local + international) | 300,000 – 700,000 | 3–5 weeks |
| Subscriptions / recurring billing | 500,000 – 1,500,000 | 4–8 weeks |
| Full e-commerce + payments (new build) | 800,000 – 3,000,000 | 6–14 weeks |
Payment integration is often part of a broader build. Explore our web development service for e-commerce platforms and API development, or mobile apps for in-app payment SDKs.
Common Integration Mistakes
- Trusting return URL params - customer can manipulate query strings; only webhook verification counts
- No idempotency - duplicate webhooks double-ship orders
- Client-side amount - always compute charge amount server-side from cart, never trust frontend
- Skipping mobile test - wallet redirects behave differently on mobile browsers
- Single gateway - downtime = zero revenue; consider backup for high-volume stores
- No reconciliation - gateway report vs DB mismatches go unnoticed until month-end
Conclusion
Payment gateway integration Sri Lanka succeeds when you match provider to audience (PayHere for breadth, FriMi for wallets, Stripe for international), implement server-side webhook verification, and test on mobile. Use hosted checkout for speed; upgrade UX once revenue justifies it.
Hashtag Coders integrates PayHere, FriMi, iPay, Stripe, and PayPal into e-commerce stores, booking platforms, and mobile apps. Get a payment integration quote or explore our web development and mobile app services.
Frequently Asked Questions
How long does PayHere merchant approval take?
Typically 3–7 business days. You need business registration (BR), bank account in the business name, and a live HTTPS website with product/service pages. Hashtag Coders assists clients with application preparation.
Can I accept USD with PayHere?
PayHere primarily settles in LKR. For USD/EUR international cards, use Stripe alongside PayHere - route international customers to Stripe and local customers to PayHere.
What is the difference between notify_url and return_url?
notify_url is a server-to-server webhook the gateway
calls with payment result - this is your source of truth. return_url is where the customer's browser
lands after payment - use it for UX only; always confirm status from your database.
Do I need PCI DSS certification?
If you use hosted checkout and never touch card data, PCI scope is minimal (SAQ A). Embedded or custom card forms increase scope significantly. Never store raw card numbers on your servers.
FriMi vs PayHere - can I use only FriMi?
Only if your customers are predominantly FriMi wallet users. For general e-commerce, PayHere covers cards plus multiple wallets. Many merchants offer both at checkout.
How do I integrate payments into a mobile app?
PayHere and Stripe offer mobile SDKs. Digital goods sold through iOS/Android may require platform in-app purchase rules - physical goods and services can use external gateways. See our mobile app development service.
Need Payment Gateway Integration?
40+ PayHere, FriMi, iPay & Stripe integrations - e-commerce, booking, SaaS & mobile apps.
Get Integration Quote Web Development ServicesDisclaimer: This article is based on information obtained from publicly available online sources and is provided for general informational purposes only. Although reasonable efforts have been made to ensure accuracy, some information may be incomplete, outdated, or incorrect. This article does not constitute legal or financial advice and has not been presented as legally reviewed. Before relying on or publishing this information, please consult a qualified Sri Lankan lawyer or payments compliance specialist and verify the latest requirements with your payment gateway provider, acquiring bank, and the Central Bank of Sri Lanka.