Beyond Stripe: Choosing a Payment Gateway for a Global SaaS
By make1day
Most starters wire Stripe and stop. That is fine until you sell to a market where cards are not the default, or you discover that handling VAT as a sole founder is a second job.
Merchant of Record vs payment processor
A processor (Stripe, PayPal, Waffo Acquiring) moves money; you still own tax calculation, invoicing and compliance. A Merchant of Record (Waffo Pancake, Lemon Squeezy, Creem in some configurations) is the legal seller: it handles sales tax/VAT, invoices and often refunds. For a solo founder selling globally without an entity, that difference is the whole reason to pick one.
The six adapters
This project ships Waffo Pancake (default, MoR), Waffo Acquiring, Stripe, Creem, PayPal and Lemon Squeezy, plus none for bring-your-own billing. Selecting one in the Builder prunes the other adapters from the ZIP. All six implement the same interface: create a checkout, create a customer portal session, and verify a webhook.
Contract fields are supplied by env, never invented by the code: Waffo Acquiring's merchant id, return/notify URLs, product ids and signing mode all come from WAFFO_ACQUIRING_* variables copied from your merchant agreement. If one is missing, the config layer throws an error naming the variable.
One verification contract, six implementations
Every adapter throws on a missing, invalid or malformed signature; the route turns that into 400. Returning an empty list means only "validly signed but unhandled" and becomes 200 with an ignored flag. Event ids are deduplicated before any license or plan write. An earlier revision returned an empty list on verification failure — a forged request was accepted with 200 across five gateways. That contract is now covered by an offline probe.
How to test without six sandbox accounts
Four layers: a config self-check that only reports missing variables (never secret values), the offline signature probe (npm run probe:webhook) that asserts 400/200 on valid, missing, corrupted and malformed requests, per-gateway sandbox contrast runs, and one real small-value purchase before launch. The first two need no credentials at all and belong in CI; the last two need each provider's sandbox keys. See docs/payment-testing.md for the full matrix.
FAQ
Which gateways are supported?+
Waffo Pancake (default Merchant of Record), Waffo Acquiring, Stripe, Creem, PayPal and Lemon Squeezy, plus none. Only the selected adapter ships in a generated ZIP.
Do I need a company entity to sell globally?+
Not with a Merchant of Record — Waffo Pancake or Lemon Squeezy acts as the legal seller and handles tax. With a plain processor you own tax, invoicing and compliance yourself.
Does the code fill in missing contract fields?+
No. Merchant ids, price ids, notify URLs and signing modes must come from env or your merchant agreement. A missing required variable produces an error naming it, rather than a plausible-looking placeholder.
All frequently asked questions · Markdown version (for AI agents)