Guide
3-D Secure 2: what the backend has to do
Authentication is not a capture. Which states your API has to persist, why the shopper return and the webhook will race, and what not to infer from a redirect.
Integration guides
The parts the vendor docs leave out.
How these APIs behave once you leave the sandbox — auth flows, webhooks, idempotency, and the failure modes the vendor docs skip. Every guide ships runnable .NET code.
Checkout.comHTTP
GuideHTTP
Idempotency keys for payment endpoints in .NET
How to make a charge endpoint safe to retry: key scope, hashing the raw body, the 409 on a mismatched payload, and the race a unique index has to close.
Guide
Out-of-order webhooks: what the handler must do
Payment webhooks do not arrive in causal order. How to apply them with a state machine and an event id, instead of trusting which HTTP request landed first.
Guide
Retry and backoff for payment APIs in .NET
Which payment HTTP failures are safe to retry, why a timeout is not one of them, and how backoff without an idempotency key charges the customer twice.
Guide
Reconciling a ledger against a settlement file
A captured payment is not settled money. How to match a settlement file to your ledger on the provider reference, and which mismatches need a person.
Guide
What a payment sandbox will not let you test
A sandbox proves your request is well formed. It does not prove settlement timing, issuer behaviour, or failures that show up only with real cards.
GuideCheckout.com
Checkout.com webhooks: Cko-Signature in ASP.NET Core
How Checkout.com signs webhooks, why the raw body matters in .NET, and how to verify Cko-Signature without breaking model binding.
Guide
Validating webhook signatures in ASP.NET Core
The raw-body trap that breaks HMAC verification in .NET, why == is a vulnerability, and how three real providers sign — including one that does not.