Building a Scalable Payment Gateway for Modern Financial Platforms

The Client

A Brazilian payments company operates a gateway that lets individuals and businesses register, verify their identity, and start processing payments, cash-in and cash-out alike, without needing a developer on their side to integrate anything. The platform needed to be robust enough for real financial operations, flexible enough to keep adding integrations, and simple enough for both end-users and non-technical administrators to run day to day.

The Challenge

A handful of problems were tightly linked, and each one had to hold up under real transaction volume, not just in testing.

• KYC couldn't be all-or-nothing. Document verification needed to happen automatically wherever possible, but the flow still had to allow manual review and override when a document didn't pass an automated check cleanly.

• Fees and reserves needed sensible defaults and real flexibility. Every merchant starts on the same default fee and reserve structure, but different merchants needed to adjust their own rates and reserve percentages without filing a support ticket to do it.

• API security had to assume it would be attacked. Token-based authentication, IP whitelisting, and idempotency all needed to be in place from day one, not bolted on after the first incident, to prevent unauthorized access and duplicate transaction processing.

• Payouts had to be provably safe. Funds could only ever move to a merchant's own verified PIX key, with protections against race conditions and retry logic that could otherwise let the same payout fire twice.

• The codebase had to stay modular. Adding a new payment method or a new dashboard feature needed to be additive, not a reason to touch core services that were already handling live money movement.

What We Built

1. A frontend that makes onboarding painless

We built the client-facing application in Vue.js as a single-page app, so registration, document upload, and KYC verification all happen with real-time feedback instead of a page reload between every step. Individuals and businesses each get a flow suited to what they actually need to submit, and inline notifications surface issues immediately rather than after a form submission fails silently.

2. An API layer that owns the hard security work

The core business logic and payment operations run through a Laravel API. It handles token-based authentication and IP whitelisting, processes cash-in and cash-out requests, and integrates with third-party payment providers. Gateway fees and reserve calculations happen automatically here too, applied per transaction according to each merchant's own configured rules.

3. A merchant dashboard non-technical users can actually run

We built the administrative and merchant-facing side with FilamentPHP, giving merchants direct visibility into balances, transaction history, and KYC status without needing to ask anyone for a report. Merchants can adjust their own fee and reserve settings, review and approve withdrawal requests, and process refunds, all inside an interface built for someone who isn't an engineer.

4. Payouts that can only go where they're supposed to

Payouts move exclusively to a merchant's own verified PIX key, with safeguards specifically built against race conditions and retry behavior that could otherwise double-send a payout. Combined with the idempotency mechanisms in the API layer, a duplicate request never becomes a duplicate transfer.

5. Predictable hosting, on purpose

The platform runs on Digital Ocean, chosen specifically for flat-rate, predictable hosting costs rather than the variable billing that can make a growing payments platform hard to forecast. Reliability and scalability came without the cost unpredictability that can come with more elastic pricing models.

6. CI/CD that keeps releases boring

GitHub Actions pipelines handle build and deployment, so shipping a change to a system processing real money is a routine, repeatable process rather than a manual one someone has to babysit.

Results and Impact

• Fast, adaptive onboarding for both individuals and businesses, with automated KYC that still allows manual override when needed
• Real-time visibility for merchants, with balances, transaction history, and key business metrics available directly in the dashboard
• Fee and reserve settings merchants can manage themselves, without support requests for routine account changes
• A security model built around prevention, with token-based auth, IP whitelisting, and idempotency guarding the API from the start
• Payouts that are safe by construction, restricted to a merchant's own verified account with race-condition and retry protection
• Predictable infrastructure costs, thanks to Digital Ocean's flat-rate model
• A modular codebase, letting new payment methods and dashboard features get added without rewriting core services

Stack

Area	Technologies
Frontend	Vue.js, Pinia, Vue Router
Backend	Laravel, FilamentPHP, JWT
CI/CD	GitHub Actions
Hosting	Digital Ocean
Security	SSL everywhere, input validation, regular penetration testing

The Outcome

The platform gives both individuals and businesses a fast, secure path from registration to processing their first payment, with KYC and onboarding handled without manual intervention in the common case. Merchants get real visibility into their own accounts and the ability to tune fees, reserves, and approvals themselves instead of routing every change through a support queue.

None of that would hold up without the security work underneath it: authentication, idempotency, and payout restrictions that make it structurally difficult for a transaction to go anywhere it shouldn't. Predictable hosting costs and a modular codebase mean the platform can keep adding payment methods and features without the underlying architecture becoming the bottleneck.