Payments are the part most business owners fear, even though they are now among the easiest parts technically. The real complexity is administrative: paperwork, a bank account, and a review by the provider.
Here are the steps in order, along with what usually holds approval up.
You need a commercial registration, a bank account in the business name, and a local payment provider supporting mada and Apple Pay — and never put your API keys in the code; their place is the secret store.
What you need before you start
Most payment providers in Saudi Arabia ask for:
- A valid commercial registration covering e-commerce activity.
- A bank account in the business name, not a personal one.
- A working site or app with pages for: about, contact, terms and conditions, and exchange and returns policy.
- A clear description of your products or services and their prices.
mada, cards and wallets
mada is the local payment network and the most used in Saudi Arabia, and its fees are usually lower than credit cards. Apple Pay runs through the same gateway and noticeably raises checkout completion on iPhone because it removes card entry entirely.
Fees differ between providers, and are usually a percentage of the transaction plus a fixed amount. Ask explicitly about three things: the transaction fee, the refund fee, and the bank settlement period — the settlement period in particular affects your cash flow.
How the integration works
The provider gives you two keys: a test key and a live key. You build the payment flow, test it with test cards, then swap the key after approval. The part many people miss is the webhook: the gateway sends your system a confirmation of the result, and you must rely on that to confirm the order rather than on the user returning to the page.
Security: your API keys
Never put a payment key inside the code, in the project files, or in the browser. Its place is the secret store, read only on the server. An exposed key in the frontend or in a public repository is the most common vulnerability in small stores.
When you build with Uttra, add the payment key to the secret store and say in your description that the integration reads the key from there — that keeps it out of the published code.