August 13, 2026
10 min read
Table of Contents
By Kokil Thapa | Last reviewed: August 2026
Choosing the right payment processor is the single most critical technical decision for any online store in this region, yet documentation remains fragmented and outdated. This guide provides a practical breakdown of eCommerce payment gateway options for Nepal compared from the perspective of a full-stack developer who integrates these systems regularly. Whether you are building a custom Laravel application or configuring WooCommerce, understanding the real-world API limitations, settlement cycles, and verification requirements of eSewa, Khalti, ConnectIPS, and Fonepay is essential before writing a single line of code.
Quick answer: The best eCommerce payment gateway options for Nepal compared depend on your specific business model: eSewa offers the widest wallet reach for B2C retail, Khalti provides superior developer documentation and sandbox tools for custom apps, ConnectIPS dominates high-value banking transactions, and Fonepay enables QR interoperability across all major banks. Most production stores in 2026 integrate at least two providers to maximize conversion.
How do the major Nepal payment gateway APIs compare for developers?
When evaluating Laravel payment integrations for Nepali merchants, the quality of the API and the reliability of the sandbox environment matter more than marketing claims. In my experience shipping platforms like Nepal Gift Card and various legal-tech portals, the developer experience varies significantly between providers. You need to know which gateway will fight you during integration and which one lets you ship confidently.
eSewa: The Ubiquitous Wallet with Legacy Quirks
eSewa remains the default choice for consumer-facing businesses because of its massive user base. However, developers must navigate two distinct API generations. The older EPAY interface uses simple form posts and MD5 signatures, while the newer EPG (eSewa Payment Gateway) v2 supports RESTful endpoints with HMAC-SHA256 verification. Always use EPG v2 for new projects in 2026; the legacy endpoint lacks proper idempotency and refund capabilities.
A common mistake I see on client projects is trusting the success redirect URL without verifying the transaction server-side. eSewa redirects can be spoofed or fail due to network issues. Your application must implement a dedicated verification endpoint that calls /api/epg/transaction/status using the transaction UUID before marking an order as paid. Settlement typically takes T+1 to T+3 days depending on your merchant agreement tier.
Khalti: Developer-Friendly with Robust Sandboxing
For custom applications built on frameworks like Laravel or Symfony, Khalti often provides the smoothest integration path. Their sandbox environment mirrors production accurately, and the API documentation includes working cURL examples that actually match the current specification. Khalti’s verification endpoint returns detailed metadata including fee breakdowns and source bank information, which simplifies reconciliation.
Their SDK support for PHP is community-maintained but generally reliable for standard flows. One advantage Khalti holds over competitors is the consistency of their webhook payloads. While other gateways occasionally change response structures without versioning, Khalti has maintained backward compatibility for their core verification responses since 2021. For eCommerce website development in Nepal, this stability reduces long-term maintenance burden.
ConnectIPS and Fonepay: Banking Infrastructure
ConnectIPS operates differently from wallets; it connects directly to bank accounts via the NCHL infrastructure. Integration requires stricter compliance checks and often involves manual paperwork that can take weeks. The API is designed for higher-value transactions with enhanced security tokens. Use ConnectIPS when your average order value exceeds NPR 50,000 or when serving B2B clients who prefer direct bank transfers.
Fonepay acts as a QR aggregator, enabling customers to scan a single dynamic QR code using any participating bank’s mobile app. The technical challenge here is the verification latency. Unlike wallet callbacks that fire instantly, Fonepay confirmations sometimes arrive via delayed webhooks or require active polling. Implement a background job in your queue system to poll for confirmation if the webhook hasn’t arrived within 30 seconds, ensuring orders don’t get stuck in pending state.
What are the actual fees and settlement times for Nepal merchants?
Technical integration is only half the equation; profitability depends on understanding the true cost structure. Published rates often exclude VAT, setup fees, or volume-based tiers. Based on recent merchant agreements I’ve reviewed for clients, here is a realistic comparison table for 2026. Note that these rates apply to domestic NPR transactions; international card processing through these gateways carries significantly higher fees.
| Gateway | MDR (Standard) | Settlement Cycle | Setup Cost | Best For |
|---|---|---|---|---|
| eSewa | 1.5% – 2.0% | T+1 to T+3 | NPR 0 – 5,000 | Retail, Digital Goods |
| Khalti | 1.5% – 2.0% | T+1 to T+2 | NPR 0 | SaaS, Custom Apps |
| ConnectIPS | NPR 10 – 25 flat | T+1 (Real-time avail.) | NPR 5,000+ | High Value, B2B |
| Fonepay | 0.8% – 1.2% | T+1 | Varies by Bank | Retail, Physical Stores |
| Stripe (via Atlas) | 3.4% + $0.30 | 7-14 Days | $500+ (Atlas) | Global SaaS Only |
ConnectIPS stands out for high-ticket items like legal services or enterprise software licensing because the flat fee becomes negligible above NPR 10,000. Conversely, for a flower shop selling bouquets at NPR 1,500, Fonepay’s lower percentage rate preserves margin. Always negotiate based on projected monthly volume; gateways frequently discount MDR by 0.3–0.5% for merchants processing over NPR 1 million monthly.
How should you architect secure payment verification in Laravel?
Never trust client-side payment confirmation. A secure architecture treats every payment notification as untrusted input until cryptographically verified against the gateway’s server. This principle applies whether you’re building a simple WooCommerce plugin or a complex multi-vendor marketplace.
Implementing Idempotent Webhook Handlers
Gateways may send duplicate notifications due to network retries. Without idempotency, you risk fulfilling the same order twice or creating duplicate ledger entries. Store every incoming transaction ID in a dedicated payment_events table with a unique constraint. Process the webhook inside a database transaction:
<?php
// App\Http\Controllers\Webhook\KhaltiController.php
public function handle(Request $request)
{
$payload = $request->all();
$transactionId = $payload['transaction_id'];
// Atomic check-and-lock to prevent race conditions
return DB::transaction(function () use ($transactionId, $payload) {
$exists = PaymentEvent::where('gateway_txn_id', $transactionId)
->lockForUpdate()
->exists();
if ($exists) {
return response()->json(['status' => 'already_processed']);
}
// Verify signature BEFORE recording event
$verified = KhaltiService::verify($payload);
if (!$verified) {
Log::warning('Invalid Khalti signature', $payload);
abort(400);
}
PaymentEvent::create([
'gateway_txn_id' => $transactionId,
'payload' => $payload,
'verified_at' => now(),
]);
// Dispatch async job for fulfillment
ProcessSuccessfulPayment::dispatch($transactionId);
return response()->json(['status' => 'accepted']);
});
}Handling Currency and Precision
Nepalese Rupees (NPR) do not have subunits in digital transactions, yet some gateway APIs return amounts in paisa (cents) while others return whole rupees. Standardize internally: store all monetary values as integers representing paisa in your database, converting only at the presentation layer. This prevents floating-point rounding errors that cause reconciliation mismatches. When integrating ConnectIPS alongside eSewa, create an adapter interface that normalizes amount formats before passing data to your domain logic.
Which gateway works best for international sales and subscriptions?
This is where the landscape gets complicated. Domestic Nepali gateways (eSewa, Khalti, Fonepay) cannot process payments from foreign credit cards directly. If you sell digital products globally or run a subscription SaaS targeting international customers, you need a different strategy.
The Stripe Atlas Route
Many Nepali founders incorporate a US LLC via Stripe Atlas to access Stripe’s global payment infrastructure. This works well for pure digital SaaS but adds significant administrative overhead: US tax filings, registered agent fees (~$200/year), and complex fund repatriation to Nepal. Budget roughly NPR 80,000–100,000 annually just for compliance, excluding transaction fees. For subscription-based businesses with genuine global revenue, this investment pays off. For local-focused commerce, it’s overkill.
Hybrid Approach for Mixed Audiences
On projects serving both Nepali and international users, I implement a dual-gateway strategy. The checkout page detects the user’s IP or billing country and presents appropriate options: eSewa/Khalti/Fonepay for NPR transactions, and Stripe/PayPal for USD/EUR transactions. This requires maintaining separate order ledgers or a unified currency-normalized schema. Laravel’s polymorphic relationships work well here, linking an Order model to either a DomesticPayment or InternationalPayment model depending on the gateway used.
What compliance and testing requirements must you meet before going live?
Nepal Rastra Bank regulations require all payment aggregators to perform KYC on merchants before activating live credentials. Prepare these documents early to avoid launch delays:
- Company registration certificate (Ward office or OCR)
- PAN/VAT registration certificate
- Board resolution authorizing digital payments (for Pvt Ltd companies)
- Director citizenship copies and photos
- Bank account verification letter
Testing protocols vary by provider. eSewa’s sandbox requires separate test credentials that don’t carry over to production. Khalti allows switching environments via API key prefix changes. ConnectIPS demands UAT sign-off from their technical team before production keys are issued. Budget 2–4 weeks for the entire approval cycle.
A critical testing step many developers skip is simulating failure scenarios. Gateways provide success cases easily, but you must verify your system handles timeouts, partial payments, expired sessions, and declined transactions gracefully. Write automated tests that mock gateway responses for each failure mode. On one legal-tech portal I built, we discovered during UAT that our order confirmation email fired even when the ConnectIPS token exchange failed silently. Catching this before launch prevented hundreds of confused customer support tickets.
Making the Final Decision for Your Nepal Store
The landscape of eCommerce payment gateway options for Nepal compared in this guide reflects production reality, not marketing brochures. For most Nepali businesses starting out in 2026, begin with Khalti for its developer experience and eSewa for market coverage. Add Fonepay once you have physical retail presence or want to capture bank-app users. Reserve ConnectIPS for high-value service businesses. International sellers should evaluate Stripe Atlas only after validating sufficient foreign demand to justify compliance costs.
Integration quality matters as much as gateway selection. A poorly implemented verification flow loses more revenue through abandoned carts and support overhead than any MDR difference. Invest time in building a robust, idempotent payment service layer that abstracts gateway-specific quirks behind a clean interface. Your future self debugging production issues at midnight will thank you.
If you need help architecting a secure payment integration for your Laravel or WooCommerce store, or want a second opinion on your current gateway setup, reach out to discuss your project requirements. I’ve helped dozens of Nepali businesses navigate these exact decisions and can help you avoid the costly mistakes I’ve seen repeatedly in production.
Frequently Asked Questions
eSewa, Khalti, IME Pay, and ConnectIPS currently support domestic Visa, Mastercard, and UnionPay cards for Nepali merchants. International Stripe or PayPal accounts cannot legally process NPR transactions from Nepal-based businesses due to NRB regulations.
Development integration typically costs NPR 25,000 to 45,000 (USD 190–340) depending on complexity. eSewa charges no setup fee but takes 1.5% to 2% per transaction. Annual maintenance contracts for payment modules usually run NPR 15,000 to 25,000 separately.
No. Nepal Rastra Bank restricts outward capital transfers, preventing Nepali entities from holding standard Stripe or PayPal merchant accounts. You must use NRB-approved domestic gateways like eSewa, Khalti, or ConnectIPS for NPR transactions. Foreign currency collection requires special export permits.
You need WooCommerce 9.x, PHP 8.2+, and SSL enabled. Install the official Khalti plugin or a verified third-party adapter. Configure your Merchant ID and Secret Key from the Khalti dashboard. Ensure your server allows outbound HTTPS requests to api.khalti.com and that webhook endpoints are publicly accessible without authentication barriers blocking verification callbacks.
ConnectIPS links directly to bank accounts with lower fees (0.5%–1%) but has a stricter KYC process and slower settlement times compared to wallets. eSewa offers faster integration, better documentation, and instant wallet settlements but charges higher transaction fees. For high-volume stores, ConnectIPS reduces costs; for quick launches and user convenience, eSewa remains the default choice in my experience.
Webhooks often fail because Laravel's CSRF middleware blocks external POST requests. Exclude your webhook route from VerifyCsrfToken middleware. Also check if your server firewall or Cloudflare blocks non-browser user agents. In one production deployment, I found that opcache was caching an old secret key after rotation, causing signature validation failures until I restarted PHP-FPM to clear the opcode cache.
Full PCI DSS certification is generally not required when using hosted payment pages or tokenized APIs from eSewa, Khalti, or ConnectIPS, as they handle sensitive card data. However, you must still maintain basic security hygiene: SSL everywhere, secure secret storage in environment variables, and regular dependency updates. If you store raw card numbers locally, which I strongly advise against, full compliance becomes mandatory.
eSewa and Khalti merchant approval typically takes 3 to 7 business days after submitting complete KYC documents including PAN/VAT registration and company incorporation papers. ConnectIPS can take 2 to 4 weeks due to banking verification layers. Delays usually stem from incomplete documentation or mismatched business names between tax filings and bank accounts. Start the application before development begins to avoid launch delays.
This usually indicates a failed webhook delivery or incorrect callback URL configuration. Check your gateway dashboard for webhook retry logs. Verify the callback endpoint returns HTTP 200 within 5 seconds; slow responses cause timeouts. Implement idempotent order processing using the transaction reference ID to prevent duplicate fulfillment. On a legal-tech portal I built, adding a manual sync command resolved edge cases where network issues prevented automatic confirmation.
Most domestic gateways charge zero monthly subscription fees for standard merchant accounts. Revenue comes entirely from per-transaction commissions ranging from 0.5% to 2%. Some enterprise plans with dedicated support or custom SLAs may have fixed monthly costs around NPR 5,000 to 10,000. Always confirm current rate sheets directly with the provider, as pricing structures change frequently based on NRB directives and market competition.
Refund APIs vary significantly. eSewa supports programmatic refunds via their API with original transaction IDs, while Khalti requires dashboard-initiated refunds for most merchant tiers. ConnectIPS refund processing is batch-based and slower. Always implement refund tracking in your database separate from the gateway. In practice, I build admin interfaces that initiate refund requests and reconcile statuses daily, since real-time refund confirmation is unreliable across all local providers.
Accepting foreign currency requires special permission from Nepal Rastra Bank under export promotion schemes. Approved IT exporters can open dollar accounts and integrate international processors. For typical domestic eCommerce, this is not feasible. Instead, offer NPR pricing and let international customers use remittance channels or ask them to pay via local contacts. Several travel booking sites I've worked on use hybrid models where foreign inquiries get custom invoice workflows outside automated checkout.
Enable OTP verification for all transactions above NPR 5,000. Store only transaction references, never raw credentials. Use HMAC signature verification on every webhook. Rate-limit payment endpoints to prevent brute-force testing. Monitor for velocity patterns like multiple failed attempts from single IPs. On client projects, I've seen fraud drop significantly after implementing device fingerprinting and requiring registered mobile numbers to match gateway KYC records.
eSewa and Khalti provide sandbox environments with test credentials and simulated success/failure scenarios. Use these exclusively during development. Never test with live keys. Create test orders with specific amounts that trigger different response codes. Document sandbox limitations; some features like partial refunds or dispute handling aren't available in test mode. Before going live, perform at least three real transactions with minimal amounts to verify end-to-end flow including webhook delivery and email notifications.
eSewa currently offers the most comprehensive API documentation with Postman collections, SDK examples, and clear error codes. Khalti's docs have improved significantly in 2025 but still lack detailed webhook payload schemas. ConnectIPS documentation remains sparse and often outdated, requiring direct support contact for implementation details. When choosing a gateway for custom Laravel builds, I prioritize documentation quality alongside fees because poor docs add 20 to 40 hours of debugging time per integration.
