Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Payments Engineering: The Survival Guide

Payments Engineering: The Survival Guide

Slide deck I used for PaymentsFn 2020. You can find the video here: https://fast.wistia.net/embed/channel/pneirlkda4?wchannelid=pneirlkda4&wvideoid=69ihg6s0eh

Avatar for Mathias Fonseca

Mathias Fonseca

May 13, 2020

Other Decks in Technology

Transcript

  1. Who is this guy? Why are we here? Will we

    learn something? Intro “Clean code” - Robert Martin “DarkMarket” - Misha Glenny “Letters from a Stoic” - Seneca “I, robot” - Isaac Asimov “The last lecture” - Randy Pausch “What every body is saying” - Joe Navarro
  2. Who is this guy? Why are we here? Will we

    learn something? Intro YES • Start a revolution • Share experiences • Give advice NO • Blame • Offend • Just complain
  3. Who is this guy? Why are we here? Will we

    learn something? Intro Probably not… but I hope it’s fun!
  4. Why are we different? What are the challenges? Why didn’t

    you fix it? When will it be ready? Life of a Payments Engineer
  5. Life of a Payments Engineer Product Business Performance Testing Monitoring

    Security Compliance Alerts Escalation Modifiability Versioning Humans Dependency Consistency
  6. Life of a Payments Engineer Product Business Performance Testing Monitoring

    Security Compliance Alerts Escalation Modifiability Versioning Humans Dependency Consistency
  7. Suggestions • Change the methodology ◦ But estimate • Split

    the team ◦ But share knowledge • What release cycle? ◦ PSPs don’t care about your timeline • Chargebacks are a thing ◦ Don’t do it the last day • Webhooks are a thing ◦ Don’t leave them for last • Get the bigger picture ◦ Think business, act developer • Don’t sign first, ask first ◦ Participate in business decisions • You are also a customer ◦ Design a solution you would use • PSPs also have a product ◦ Decide wisely how to use it • Keep product calm ◦ Not every PSP is a clone • Complain with facts ◦ Too many is good • Weekly calls ◦ Force PSPs to listen • Feature checklist ◦ Fill and maintain it • Diagrams, glossaries, and docs ◦ Your memory is not that good
  8. Suggestions • Find support ◦ Emails, phones, home addresses •

    Find allies ◦ Devs understand each other • Define escalations ◦ Make PSPs commit to answer • Big red buttons ◦ Shut everything down in case of fire • Does it really work? ◦ Ask PSPs for a demo • Don’t idealize others ◦ You’ll be surprised, in a bad way • Test in production is a thing ◦ No chance to escape it • Feature flags ◦ Release small, test big • Fake PSP for load testing ◦ Simulate everything, even timeouts • Split infrastructure ◦ But keep cost low • Define dynamic alerts ◦ Don’t cry wolf, but cry loud and fast • Dashboards for dummies ◦ Is it down? Yes/No • Know your timeouts ◦ Keep different values in all levels • try/catch/finally { print } ◦ Log even when everything explodes
  9. Suggestions • Ask stupid questions ◦ Required, formats, what ifs

    • Integrate many ◦ One is bad, too many is bad • Aggregate integrations ◦ But not too much • Make the code speak ◦ Anyone can check mappings • Reduce client-side code ◦ Instant changes for all versions • Design for extension ◦ PSP of PSP of PSP • Defensive programming ◦ Everything will fail, everything • Null, Empty, “Null”, “dummy” ◦ Check for differences • Size matters ◦ Check for limits • yyyy-MM-dd hh:mm:ss UTC ◦ Prepare for all possible formats • Numbers and currencies ◦ Always minor units, and fight it • Optional is mandatory ◦ Assume everything is mandatory • Billing and shipping address ◦ Are they different? • First, middle, and last name ◦ Separate or together?
  10. Suggestions • Give SOAP a REST ◦ Not better, just

    different • SDKs are not that good ◦ Encapsulate and avoid changes • Exceptions are exceptional ◦ Don’t throw exception if you expect it • Detailed errors avoid questions ◦ Inform clients with clear error details • Validate before the PSP ◦ Don’t send requests that will fail • Async is your friend ◦ But only when necessary • Ifs are configs ◦ Avoid “if card is…”, make it generic • Implement GETs ◦ For payments and tokens, you’ll need it • Care about statement descriptors ◦ Don’t ignore them, they can help • Schemes, brands, types, etc. ◦ Know and use the differences • Credit, void, cancel, refund, blabla ◦ Every PSP has a new definition • Keep all data ◦ But secure and compliant • Log everything ◦ But log is also storage • No backoffices ◦ Keep your data in control
  11. Suggestions • No updates, just inserts ◦ One line per

    payment update • Store queryable JSONs ◦ Someday you’ll need that field • Ids everywhere ◦ Send all possible reconciliation • Cards tokens are a list ◦ Allow multiple tokens per card