Integrating Payments and UAE E-Invoicing into a SaaS Product

Taking money and staying compliant are two of the least glamorous — and least forgiving — parts of a SaaS product. Here’s how I approached payment gateways and UAE e-invoicing so that neither one wakes you up at night.

Hosted redirect, server-authoritative

For gateways like Stripe and Amazon Payment Services, the safest flow is a hosted redirect: the customer pays on the gateway’s page, then returns to your app. The rule that keeps you safe is simple — never trust the client’s word that a payment succeeded. The server re-checks the gateway, verifies the amount and the signature, and only then marks the order paid.

Idempotency is non-negotiable

Networks retry, users double-click, webhooks arrive twice. Every “complete payment” path must be idempotent — keyed on the gateway’s transaction id so the same success can’t create two paid orders. Get this wrong and you’ll double-charge or double-fulfill; get it right and retries become harmless.

Plan for failure, not just success

A declined or abandoned payment needs a real path too: mark the order failed, release any held stock or booking slot, record the reason, and clean up the staging record. A reconciliation sweep that re-checks pending payments catches the cases where the customer closed the tab at the worst moment.

UAE e-invoicing: compliance as a pipeline

The UAE’s move to mandated e-invoicing means tax invoices have to be structured, validated, and ready to hand to an accredited service provider. I modeled it as a pipeline hung off the existing “invoice issued” event: when a tax invoice is issued, a subscriber records it, computes VAT correctly (including the tax-inclusive vs tax-exclusive cases that trip people up), validates totals, and stores a compliance-ready document.

Two details matter more than they look. First, VAT math must be canonical — back out net and tax consistently so subtotal + vat = total every time. Second, make the whole thing event-driven and off by default per tenant, so compliance can be switched on without touching the checkout hot path.

Takeaways

• Verify payments server-side; the client is a hint, not a source of truth.
• Make completion idempotent on the gateway transaction id.
• Treat e-invoicing as a validated pipeline off an event, not a checkout-time bolt-on.

Payments and tax aren’t where you innovate — they’re where you’re rigorous. Boring, correct, and idempotent is exactly the reputation you want here.