Payment integration is often where side projects turn into real products, and HostelHub needed a reliable way to handle booking payments through eSewa, Nepal's most widely used digital wallet.
The core challenge was security. eSewa's integration flow requires generating an HMAC-SHA256 signature for every transaction request and verifying the response signature before confirming a payment. Any mismatch, and the transaction should be treated as invalid — there's no room for shortcuts here since real money is involved.
I built the flow so that all hostel bookings route through a single admin merchant account, regardless of which owner's hostel is being booked. This simplified the payment architecture significantly: instead of managing separate merchant credentials per owner, the system handles settlement internally after payment confirmation. It meant more work on the backend logic to track which owner is owed what, but it kept the payment gateway integration itself clean and auditable.
On the Django side, this involved:
- Generating a unique transaction UUID for every booking
- Constructing the signed payload with the total amount, product code, and secret key
- Verifying the callback signature from eSewa before marking a booking as paid
- Handling failure and cancellation states gracefully so students don't get stuck in a broken booking flow
The biggest lesson: test the failure paths as much as the success path. A payment gateway integration that only works when everything goes right isn't production-ready.