Kokil Thapa - Professional Web Developer in Nepal
Freelancer Web Developer in Nepal with 15+ Years of Experience

Kokil Thapa is an experienced full-stack web developer focused on building fast, secure, and scalable web applications. He helps businesses and individuals create SEO-friendly, user-focused digital platforms designed for long-term growth.

eCommerce Payment Gateway Options for Nepal Compared

By Kokil Thapa | Last reviewed: September 2026

Picking the wrong ecommerce gateway costs you sales long before your first checkout bug appears. Documentation is scattered, sandbox behaviour differs from production, and merchant onboarding through Nepal Rastra Bank (NRB)-regulated aggregators can take weeks. This guide compares eCommerce payment gateway options for Nepal compared from a production developer's view—API quirks, NPR fee structures, settlement cycles, and verification patterns you need before writing integration code on custom eCommerce builds in Nepal.

How do the major Nepal ecommerce gateway APIs compare for developers?

When evaluating Laravel payment integrations, API quality and sandbox fidelity matter more than brand recognition. I've integrated eSewa, Khalti, ConnectIPS, and Fonepay on production Laravel stores and legal-tech portals. The developer experience varies sharply between providers.

Nepal Gateway PatternsWallet DirecteSewa / KhaltiHMAC verifyLow-value B2CBank IPSConnectIPSNCHL tokensHigh-value B2BQR AggregatorFonepayDynamic QRRetail / POSLaravel Backend LayerIdempotency • Webhook queue • Ledger sync
Three ecommerce gateway architecture patterns used in Nepal: wallet direct, bank IPS via NCHL, and QR aggregation

eSewa: widest reach, two API generations

eSewa remains the default consumer wallet in Nepal. Developers must distinguish the legacy EPAY form-post flow (MD5 signatures) from EPG v2 (REST with HMAC-SHA256). Always use EPG v2 for new projects in BS 2083 (2026 AD). The legacy endpoint lacks idempotency and proper refund APIs.

A common mistake is trusting the success redirect without server-side verification. Redirect URLs can be spoofed or fail on mobile networks. Call /api/epg/transaction/status with the transaction UUID before marking an order paid. See the dedicated eSewa integration guide for PHP apps for credential setup. Settlement runs T+1 to T+3 depending on your merchant tier.

Khalti: strongest sandbox for custom apps

For Laravel and Symfony builds, Khalti often ships fastest. The Khalti developer documentation includes working cURL examples that match current production behaviour. Sandbox mirrors live closely—switch environments via API key prefix only.

Verification responses include fee breakdowns and source-bank metadata. That simplifies monthly reconciliation against your order ledger. Webhook payload structure has stayed stable since 2021, which reduces long-term maintenance on eCommerce website development in Nepal. Pair this with the Khalti Laravel integration guide for Form Request validation patterns.

ConnectIPS and Fonepay: banking rails, different verification

ConnectIPS routes through NCHL (Nepal Clearing House Limited) infrastructure—not wallet balances. Onboarding involves manual KYC paperwork and often takes two to four weeks. Use it when average order value exceeds NPR 50,000 (~USD 375) or when B2B clients insist on direct bank debits. Flat per-transaction fees beat percentage MDR on high-ticket sales.

Fonepay aggregates dynamic QR codes scannable from any participating bank app. Confirmations sometimes arrive late via webhook or need active polling. Queue a background job to poll status if no webhook arrives within 30 seconds. Read the ConnectIPS bank payment integration guide before scoping timelines.

What are the actual fees and settlement times for Nepal merchants?

Published MDR rates rarely include 13% VAT that IRD applies to gateway service charges. Budget the full landed cost before pricing products. Domestic NPR transactions use the table below; foreign card processing requires a separate international stack.

GatewayMDR (Standard)VAT on FeeSettlementSetup CostBest For
eSewa1.5% – 2.0%+13% VATT+1 to T+3Rs 0 – 5,000Retail, digital goods
Khalti1.5% – 2.0%+13% VATT+1 to T+2Rs 0SaaS, custom apps
ConnectIPSRs 10 – 25 flatIncludedT+1Rs 5,000+High value, B2B
Fonepay0.8% – 1.2%+13% VATT+1Bank-dependentRetail, POS hybrid
IME Pay1.5% – 2.0%+13% VATT+1 to T+2Rs 0 – 3,000Wallet alternative
Stripe (Atlas)3.4% + $0.30US tax rules7–14 days$500+ AtlasGlobal SaaS only

ConnectIPS wins on legal-service invoices above Rs 10,000 where a Rs 25 flat fee beats 2% MDR. For a florist selling Rs 1,500 bouquets, Fonepay's lower percentage preserves margin. Gateways often discount MDR by 0.3–0.5% above Rs 1 million monthly volume—negotiate before signing. Track USD equivalents with the Nepal forex rates tool when reporting mixed-currency revenue.

VAT registration through IRD is mandatory once turnover crosses the statutory threshold. Gateway fees are input costs you document for quarterly filing. The eCommerce VAT registration guide covers PAN setup and invoice requirements gateways expect during KYC.

How should you architect secure payment verification in Laravel?

Never trust client-side confirmation. Treat every redirect and webhook as untrusted until cryptographically verified against the gateway server. This applies equally to WooCommerce plugins and custom Laravel carts on projects like Quick And Easy Nepalese Grocery.

BrowserYour ServerGatewayDatabase1. Checkout2. Create txn3. Redirect pay4. Webhook5. Verify sig6. Confirm7. Update ledgerIdempotency check first
Secure ecommerce gateway flow: verify every webhook server-side before updating order status in your database

Implementing idempotent webhook handlers

Gateways retry webhooks on timeout. Without idempotency you risk double fulfillment. Store every transaction ID in a payment_events table with a unique constraint. Process inside a database transaction:

<?php
// App\Http\Controllers\Webhook\KhaltiController.php
public function handle(Request $request)
{
    $payload = $request->all();
    $transactionId = $payload['transaction_id'];

    return DB::transaction(function () use ($transactionId, $payload) {
        $exists = PaymentEvent::where('gateway_txn_id', $transactionId)
            ->lockForUpdate()
            ->exists();

        if ($exists) {
            return response()->json(['status' => 'already_processed']);
        }

        $verified = KhaltiService::verify($payload);

        if (!$verified) {
            Log::warning('Invalid Khalti signature', $payload);
            abort(400);
        }

        PaymentEvent::create([
            'gateway_txn_id' => $transactionId,
            'payload'        => $payload,
            'verified_at'    => now(),
        ]);

        ProcessSuccessfulPayment::dispatch($transactionId);

        return response()->json(['status' => 'accepted']);
    });
}

The webhooks guide for Khalti and eSewa covers signature algorithms per provider. The combined Laravel Khalti and eSewa integration walkthrough shows adapter interfaces when running both wallets behind one checkout service.

Handling currency and precision

NPR digital transactions use whole rupees, yet some APIs return paisa while others return rupees. Store amounts as integer paisa internally. Convert only at the presentation layer. Floating-point math causes reconciliation gaps that show up during month-end audits. When mixing ConnectIPS with eSewa, normalize through a gateway adapter before domain logic runs.

Which ecommerce gateway works best for WooCommerce and platform stores?

Not every store runs custom Laravel. WooCommerce and Shopify dominate SMB ecommerce in Nepal. Plugin quality varies—test checkout on real mobile devices before launch.

WooCommerce merchants should enable WooCommerce NPR localization first, then add Khalti or eSewa plugins from verified publishers. Avoid nulled plugins; they leak merchant keys. For platform selection trade-offs, see the Magento vs Shopify vs WooCommerce comparison.

On WooCommerce florist builds like Sagun Blossom Flower, dual wallet buttons at checkout reduced abandoned-cart rates noticeably. Shopify sellers face tighter constraints—custom Nepal gateways need Shopify Payments alternatives or external checkout redirects documented in platform policy.

Checkout StartCustomer in Nepal?YesNoOver Rs 50K?Stripe / PayPalUnderOvereSewa + Khalti+ Fonepay QRConnectIPSBank debitMultiple options lift conversion 15–25%
Ecommerce gateway selection by geography and order value: domestic wallets for retail, ConnectIPS for high-ticket, Stripe for international

Which gateway works for international sales and subscriptions?

Domestic Nepal gateways cannot process foreign Visa or Mastercard directly. Global SaaS or digital exports need a separate international stack.

The Stripe Atlas route

Many Nepali founders incorporate a US LLC via Stripe Atlas to access Stripe globally. This suits pure digital SaaS with foreign revenue. It adds US tax filings, registered-agent fees (~$200/year, ~Rs 27,000), and complex repatriation to Nepal. Budget Rs 80,000–100,000 annually for compliance alone. For subscription-based businesses with verified USD revenue, the overhead pays off. For Kathmandu-focused retail, it is overkill.

Hybrid checkout for mixed audiences

Stores serving both Nepal and abroad should detect billing country at checkout. Present eSewa, Khalti, and Fonepay for NPR orders. Route international customers to Stripe or PayPal. Maintain separate ledgers or a unified paisa-normalized schema. Laravel polymorphic relations link an Order to either DomesticPayment or InternationalPayment records. The Nepal international payments guide covers Wise and Payoneer repatriation paths NRB allows.

Gateway Go-Live Checklist1. KYC DocsPAN / VAT / OCR2. SandboxAll fail modes3. UAT Sign-offNCHL if IPS4. Live KeysSeparate .envCommon Go-Live FailuresTrusting redirect without server verifyNo idempotency on webhook retriesProduction keys in staging .envOrder email fires before payment confirmNRB KYC cycle: plan 2–4 weeks in BS 2083
Nepal ecommerce gateway production checklist: NRB-regulated KYC, sandbox failure testing, and UAT before live credentials

What compliance and testing requirements must you meet before going live?

NRB Payment Systems Department rules require aggregators to complete merchant KYC before issuing live API credentials. Prepare documents early—launch delays usually trace to paperwork, not code.

  1. Company registration certificate from OCR or ward office
  2. PAN and VAT registration certificate from IRD
  3. Board resolution authorizing online payment acceptance (Pvt Ltd)
  4. Director citizenship copies and passport photos
  5. Bank account verification letter from your settlement bank
  6. Website URL with privacy policy and refund terms published

Testing protocols differ by provider. eSewa sandbox uses separate test credentials that do not carry to production. Khalti switches via API key prefix. ConnectIPS requires NCHL UAT sign-off before production keys. Budget two to four weeks for the full approval cycle in BS 2083 (2026).

Simulate failure scenarios—not just success paths. Test timeouts, partial payments, expired sessions, and declined transactions. Mock gateway responses in PHPUnit or Pest. On a legal-tech portal I built, UAT caught order confirmation emails firing before ConnectIPS token exchange completed. Fixing that pre-launch prevented hundreds of support tickets.

Post-launch, align with eCommerce legal compliance requirements covering consumer protection and data retention. If you need webhook design beyond payments, the API development service covers idempotent receiver patterns for fintech integrations.

Key Takeaways

  • Run at least two domestic gateways—Khalti for DX, eSewa for reach—to maximize checkout conversion on any ecommerce gateway stack.
  • Always verify payments server-side; never mark orders paid from redirect URLs alone.
  • Store NPR amounts as integer paisa and normalize gateway-specific formats through adapter classes.
  • Factor 13% VAT on MDR fees and plan NRB KYC paperwork two to four weeks before launch.
  • Use ConnectIPS for orders above Rs 50,000; reserve Stripe Atlas for confirmed international SaaS revenue.
  • Implement idempotent webhook handlers with database locks before dispatching fulfillment jobs.

People Also Ask

What is the best ecommerce gateway for small businesses in Nepal?

Most small retailers start with Khalti and eSewa together. Khalti integrates faster on custom Laravel stores. eSewa reaches customers who already hold wallet balances. Adding Fonepay QR captures bank-app users who skip standalone wallets.

Can Nepal payment gateways accept international credit cards?

No. eSewa, Khalti, ConnectIPS, and Fonepay process domestic NPR transactions only. International cards require Stripe, PayPal, or similar providers—often through a foreign entity. Repatriating USD revenue follows NRB foreign-exchange procedures.

How long does merchant approval take for Nepal gateways?

Wallet providers (eSewa, Khalti) typically approve within one to two weeks after document submission. ConnectIPS through NCHL often needs two to four weeks including UAT. Start KYC during development, not after code is finished.

Do I need VAT registration to use an ecommerce gateway in Nepal?

Gateways require PAN at minimum. VAT registration becomes mandatory once turnover crosses IRD thresholds. Registered VAT merchants issue tax invoices gateways expect during compliance audits. Unregistered sellers still pay 13% VAT embedded in gateway service fees.

Choose your Nepal ecommerce gateway with production evidence

The ecommerce gateway landscape in Nepal rewards dual integration and punishes shortcut verification. Start with Khalti and eSewa, add Fonepay when retail volume grows, and route high-ticket B2B sales through ConnectIPS. International sellers should validate foreign demand before absorbing Stripe Atlas compliance costs.

Integration quality beats MDR negotiation every time. A broken webhook handler loses more revenue than a 0.3% fee difference. Build an idempotent payment service layer that hides gateway quirks behind one interface. Your future self debugging production at midnight will thank you.

For secure payment architecture on Laravel, WooCommerce, or multi-gateway checkout, contact us to discuss your store requirements. I've integrated these exact systems on production Nepali ecommerce builds and can help you skip the failures I've seen repeatedly. You can also reach out directly about your project scope.

Frequently Asked Questions

eSewa, Khalti, IME Pay, and ConnectIPS currently support domestic Visa, Mastercard, and UnionPay cards for Nepali merchants. International Stripe or PayPal accounts cannot legally process NPR transactions from Nepal-based businesses due to NRB regulations.

Development integration typically costs NPR 25,000 to 45,000 (USD 190–340) depending on complexity. eSewa charges no setup fee but takes 1.5% to 2% per transaction. Annual maintenance contracts for payment modules usually run NPR 15,000 to 25,000 separately.

No. Nepal Rastra Bank restricts outward capital transfers, preventing Nepali entities from holding standard Stripe or PayPal merchant accounts. You must use NRB-approved domestic gateways like eSewa, Khalti, or ConnectIPS for NPR transactions. Foreign currency collection requires special export permits.

You need WooCommerce 9.x, PHP 8.2+, and SSL enabled. Install the official Khalti plugin or a verified third-party adapter. Configure your Merchant ID and Secret Key from the Khalti dashboard. Ensure your server allows outbound HTTPS requests to api.khalti.com and that webhook endpoints are publicly accessible without authentication barriers blocking verification callbacks.

ConnectIPS links directly to bank accounts with lower fees (0.5%–1%) but has a stricter KYC process and slower settlement times compared to wallets. eSewa offers faster integration, better documentation, and instant wallet settlements but charges higher transaction fees. For high-volume stores, ConnectIPS reduces costs; for quick launches and user convenience, eSewa remains the default choice in my experience.

Webhooks often fail because Laravel's CSRF middleware blocks external POST requests. Exclude your webhook route from VerifyCsrfToken middleware. Also check if your server firewall or Cloudflare blocks non-browser user agents. In one production deployment, I found that opcache was caching an old secret key after rotation, causing signature validation failures until I restarted PHP-FPM to clear the opcode cache.

Full PCI DSS certification is generally not required when using hosted payment pages or tokenized APIs from eSewa, Khalti, or ConnectIPS, as they handle sensitive card data. However, you must still maintain basic security hygiene: SSL everywhere, secure secret storage in environment variables, and regular dependency updates. If you store raw card numbers locally, which I strongly advise against, full compliance becomes mandatory.

eSewa and Khalti merchant approval typically takes 3 to 7 business days after submitting complete KYC documents including PAN/VAT registration and company incorporation papers. ConnectIPS can take 2 to 4 weeks due to banking verification layers. Delays usually stem from incomplete documentation or mismatched business names between tax filings and bank accounts. Start the application before development begins to avoid launch delays.

This usually indicates a failed webhook delivery or incorrect callback URL configuration. Check your gateway dashboard for webhook retry logs. Verify the callback endpoint returns HTTP 200 within 5 seconds; slow responses cause timeouts. Implement idempotent order processing using the transaction reference ID to prevent duplicate fulfillment. On a legal-tech portal I built, adding a manual sync command resolved edge cases where network issues prevented automatic confirmation.

Most domestic gateways charge zero monthly subscription fees for standard merchant accounts. Revenue comes entirely from per-transaction commissions ranging from 0.5% to 2%. Some enterprise plans with dedicated support or custom SLAs may have fixed monthly costs around NPR 5,000 to 10,000. Always confirm current rate sheets directly with the provider, as pricing structures change frequently based on NRB directives and market competition.

Refund APIs vary significantly. eSewa supports programmatic refunds via their API with original transaction IDs, while Khalti requires dashboard-initiated refunds for most merchant tiers. ConnectIPS refund processing is batch-based and slower. Always implement refund tracking in your database separate from the gateway. In practice, I build admin interfaces that initiate refund requests and reconcile statuses daily, since real-time refund confirmation is unreliable across all local providers.

Accepting foreign currency requires special permission from Nepal Rastra Bank under export promotion schemes. Approved IT exporters can open dollar accounts and integrate international processors. For typical domestic eCommerce, this is not feasible. Instead, offer NPR pricing and let international customers use remittance channels or ask them to pay via local contacts. Several travel booking sites I've worked on use hybrid models where foreign inquiries get custom invoice workflows outside automated checkout.

Enable OTP verification for all transactions above NPR 5,000. Store only transaction references, never raw credentials. Use HMAC signature verification on every webhook. Rate-limit payment endpoints to prevent brute-force testing. Monitor for velocity patterns like multiple failed attempts from single IPs. On client projects, I've seen fraud drop significantly after implementing device fingerprinting and requiring registered mobile numbers to match gateway KYC records.

eSewa and Khalti provide sandbox environments with test credentials and simulated success/failure scenarios. Use these exclusively during development. Never test with live keys. Create test orders with specific amounts that trigger different response codes. Document sandbox limitations; some features like partial refunds or dispute handling aren't available in test mode. Before going live, perform at least three real transactions with minimal amounts to verify end-to-end flow including webhook delivery and email notifications.

eSewa currently offers the most comprehensive API documentation with Postman collections, SDK examples, and clear error codes. Khalti's docs have improved significantly in 2025 but still lack detailed webhook payload schemas. ConnectIPS documentation remains sparse and often outdated, requiring direct support contact for implementation details. When choosing a gateway for custom Laravel builds, I prioritize documentation quality alongside fees because poor docs add 20 to 40 hours of debugging time per integration.

Share this article

0 Comments

Leave a comment

Your email is not published. Comments appear once they have been read. Sign in to have your details filled in.

Quick Contact Options
Choose how you want to connect me: