Extractable Direct Answer: E-commerce payment gateway integration in Bangladesh connects online stores to local payment channels like Mobile Financial Services (bKash, Nagad, Rocket) and card networks (Visa, Mastercard, UnionPay). By integrating gateways such as SSLCommerz, bKash Merchant API, or Shurjopay via secure REST APIs, online businesses can automatically accept digital payments, verify Instant Payment Notifications (IPN), and process automated order checkouts.
Digital commerce in Bangladesh is experiencing rapid growth, driven by widespread smartphone adoption and mobile financial services. For any online store or SaaS platform operating in Bangladesh, offering seamless, secure payment options is essential for maximizing checkout conversion.
Integrating local payment gateways involves establishing secure API communication, handling payment callbacks, managing Instant Payment Notifications (IPN), and maintaining strict PCI-DSS security compliance.
This practical developer and business guide covers the payment gateway landscape in Bangladesh, compares leading payment aggregators, details API integration architecture, and outlines transaction fee structures.
E-Commerce Payment Gateway Landscape in Bangladesh
The digital payments ecosystem in Bangladesh comprises three main payment methods: 1. Mobile Financial Services (MFS): Dominated by bKash, Nagad, and DBBL Rocket. MFS accounts for over 70% of digital checkout volume in Bangladesh due to ease of mobile access. 2. Debit & Credit Cards: Local and international Visa, Mastercard, AMEX, and UnionPay cards issued by local commercial banks (EBL, City Bank, Brac Bank, Mutual Trust Bank). 3. Internet Banking: Direct bank transfer portals (City Touch, EBL Skybanking, MTM SmartBanking).
To accept all these channels under a single API checkout interface, e-commerce businesses utilize payment gateway aggregators or direct MFS merchant APIs.
BANGLADESH PAYMENT INTEGRATION
[ Customer Checkout ]
│
▼
[ Payment Gateway Aggregator API ]
(SSLCommerz / Shurjopay / etc.)
│
┌───────────────────────────┼───────────────────────────┐
│ │ │
▼ ▼ ▼
┌─────────────┐ ┌─────────────┐ ┌─────────────┐
│ MFS Channel │ │ Card Net │ │ Internet │
│ bKash/Nagad │ │ Visa/Master │ │ Banking │
└─────────────┘ └─────────────┘ └─────────────┘
Top Payment Gateways in Bangladesh Compared
Selecting the right payment provider depends on business model, setup costs, and transaction fees:
| Payment Gateway | Supported Channels | Transaction Charges (Approx.) | Settlement Time | Key Advantage |
|---|---|---|---|---|
| SSLCommerz | All MFS, Cards, Internet Banking | 2.0% – 3.5% (Cards) / 1.5% (MFS) | T+1 to T+2 Days | Industry leader, extensive documentation, robust developer SDKs |
| bKash Direct Merchant API | bKash Wallet Only | 1.2% – 1.5% (Tokenized API) | T+1 Days | Highest conversion rate, seamless 1-click tokenized checkout |
| Shurjopay | All MFS, Cards, Internet Banking | 1.8% – 2.5% | T+2 Days | Lower setup cost, specialized Bangladesh SME developer support |
| Nagad Merchant API | Nagad Wallet Only | 1.0% – 1.5% | T+1 Days | Competitive MFS transaction rates |
| Foster Payments | All MFS, Cards, Internet Banking | 2.0% – 3.0% | T+2 Days | Tailored corporate & enterprise API integrations |
Explore custom e-commerce checkout engineering at Mezbaul.com E-Commerce Website Design.
Technical Integration Architecture: API & Webhooks
Integrating a payment gateway into a custom web application (Node.js, Python, PHP, or Next.js) follows a strict 4-step execution flow:
1. Initiate Payment Request (Server -> Gateway)
└── Store posts Order ID, Amount, Currency (BDT), & Success/Fail Redirect URLs
2. Customer Checkout Redirection
└── Browser redirects to Secure Hosted Payment Page to enter PIN/Card details
3. Payment Callback Handling
└── Gateway redirects user back to Success/Fail URL with Payment Transaction ID
4. Instant Payment Notification (IPN / Webhook)
└── Gateway server makes direct server-to-server POST call to verify transaction
Step-by-Step Server API Workflow (Node.js Example)
Step 1: Initiating Session POST Request
Your web server sends a secure server-side API call to the gateway endpoint containing payment credentials:
// Server-side payment session initialization (Node.js)
const axios = require('axios');
async function initiatePayment(orderData) {
const payload = {
store_id: process.env.SSLCOMMERZ_STORE_ID,
store_passwd: process.env.SSLCOMMERZ_STORE_PASSWORD,
total_amount: orderData.amount,
currency: 'BDT',
tran_id: orderData.transactionId, // Unique order ID
success_url: 'https://yourdomain.com/api/payment/success',
fail_url: 'https://yourdomain.com/api/payment/fail',
cancel_url: 'https://yourdomain.com/api/payment/cancel',
cus_name: orderData.customerName,
cus_email: orderData.customerEmail,
cus_phone: orderData.customerPhone,
};
const response = await axios.post('https://sandbox.sslcommerz.com/gwprocess/v4/api.php', payload);
return response.data.GatewayPageURL; // Redirect user to this URL
}
Step 2: Verifying Server-to-Server IPN (Webhook)
Never trust front-end browser redirects alone to mark an order as paid. Always validate the background Instant Payment Notification (IPN) server-to-server webhook:
// Server-side IPN verification endpoint
app.post('/api/payment/ipn', async (req, res) => {
const { val_id, tran_id, status, amount } = req.body;
if (status === 'VALID' || status === 'VALIDATED') {
// Validate transaction against Gateway Verification API
const verifyUrl = `https://sandbox.sslcommerz.com/validator/api/validationserverAPI.php?val_id=${val_id}&store_id=${process.env.SSLCOMMERZ_STORE_ID}&store_passwd=${process.env.SSLCOMMERZ_STORE_PASSWORD}`;
const verification = await axios.get(verifyUrl);
if (verification.data.status === 'VALID' && parseFloat(verification.data.amount) === parseFloat(amount)) {
// Update order status to 'PAID' in your database
await updateOrderStatus(tran_id, 'PAID');
return res.status(200).send('IPN Processed Successfully');
}
}
return res.status(400).send('Invalid Payment Notification');
});
Security, PCI-DSS Compliance & Data Encryption
Handling financial transactions in Bangladesh requires strict security protocols: - HTTPS & TLS 1.3 Encryption: All payment communication must occur over encrypted SSL/TLS channels. - Never Store Raw Card Data: Hosted gateway checkout pages isolate card data handling from your web server, fulfilling PCI-DSS compliance requirements without complex security audits. - Checksum & Hash Validation: Verify request signature hashes (MD5/SHA256) on all incoming callbacks to prevent request tampering or forged payment validations.
If you are developing custom software requiring secure payment integrations, explore custom backend architectures at Mezbaul.com Custom Software Development.
Transaction Charges, Settlement & Refund Protocols
Merchant Account Requirements in Bangladesh
To open a live merchant payment gateway account in Bangladesh, businesses must submit: - Trade License (Up to date). - Company TIN & BIN Certificate. - Corporate Bank Account details with a Bank Solvency Certificate. - National ID (NID) of company directors/owners.
Settlement & Refund Processing
- Settlement Cycles: Funds collected through MFS and cards are automatically disbursed to your corporate bank account within T+1 to T+2 business days.
- Automated Refunds: Major gateways provide merchant portal dashboards and API endpoints to initiate full or partial transaction refunds directly back to the customer's original MFS wallet or credit card.
Learn more about structuring online stores by reading our E-Commerce Website Development Guide.
Frequently Asked Questions (FAQ)
Can an individual or startup without a trade license integrate a payment gateway in Bangladesh?
No. Commercial payment aggregators (SSLCommerz, Shurjopay) and direct MFS APIs (bKash, Nagad) legally require a valid Bangladesh Trade License and corporate bank account to issue live API keys. Personal accounts cannot obtain merchant checkout APIs.
What is the difference between bKash Direct API and SSLCommerz bKash integration?
Direct bKash Merchant Tokenized API allows customers to save their bKash account for 1-click pin-only checkout directly inside your app or website. SSLCommerz includes bKash inside a multi-channel payment selection menu.
How are failed transactions and double-debits handled?
If a customer's wallet is debited but the transaction times out, the automated IPN system reconciles the transaction within 24 hours, either completing the order or executing an automated refund to the customer.
Conclusion & Next Steps
Integrating payment gateways in Bangladesh empowers your e-commerce platform to deliver fast, trusted digital checkout experiences. By selecting the appropriate payment aggregator and engineering robust, server-verified API webhooks, your business ensures frictionless transaction processing and scalable growth.
Need expert assistance integrating payment gateways or engineering a custom e-commerce platform? Consult with senior developers at Mezbaul.com Contact Us.
Author Notes
[VERIFY: Current SSLCommerz setup fee schedules for Bangladesh merchants][VERIFY: Direct bKash tokenized merchant API approval timeline details]