Belkart Payment System Integration in Mobile Application
Belkart is the national payment system of Belarus, and its integration in mobile app differs slightly from familiar Stripe or Checkout.com. No direct public SDK exists — Belkart works via bank-acquirers (Belarusbank, BPS-Sberbank, Priorbank, and others), each with their own API and documentation. This first thing to clarify before development start.
Where Usually Stumbling Blocks Occur
Most common situation: client says "integrate Belkart", but specific bank-acquirer doesn't exist yet. Without acquiring contract there are no API keys, without keys — no test environment. Integration blocked not technically but organizationally. Take pause on credentials receipt, parallel prepare payment module under abstract interface — PaymentGateway protocol/interface — to later plug specific implementation.
Technically: most Belarusian banks provide payment form via redirect or iframe. For mobile app this means SFSafariViewController on iOS or Custom Tabs on Android — exactly like WebView-integration for iPay. Banks have no native SDK — work with REST API and WebView form.
Belkart-card specifics: 3D-Secure is mandatory. This means redirect to bank confirmation page — unavoidable part of flow. If app tries to handle 3DS in regular WKWebView without SFSafariViewController, bank page cookies may not persist between transitions, and 3DS hangs. Use SFSafariViewController or properly configure WKWebView with cross-site cookie permission (allowsBackForwardNavigationGestures, proper navigationDelegate).
How We Build Integration
Flow: app creates order on its server → server calls bank-acquirer API (REST, usually HTTPS POST with JSON or form-encoded parameters) → gets payment form URL → passes URL to mobile client → client opens form in SFSafariViewController / Custom Tabs.
After payment bank redirects to returnUrl — your app's specific URL (yourapp://payment/result). On iOS handle via Universal Links or URL Scheme in AppDelegate. In parallel server gets webhook notification from bank — main source of truth for transaction status.
Webhook signature verification — mandatory. Belarusbank and BPS use HMAC-SHA1 or SHA256 with secret key. Skip it — anyone can send fake payment.success to your endpoint.
On Android CustomTabs nuance: if device has no Chrome, CustomTabs won't launch, WebView used as fallback. Test on devices with MIUI/One UI where Chrome is not system browser.
Additional Security
Belkart transactions contain PAN (card number) in masked view — do not log even masked PAN to Crashlytics or Firebase Analytics. Transaction data stored only on server, client app works only with orderId and status.
Process
Bank acquiring contract conclusion → test credentials receipt → server part development (order creation, webhook) → mobile payment module → 3DS flow testing on real Belkart cards → production → first transaction monitoring.
Timeline Estimates
Integration itself — 2–3 days after API documentation and test key receipt. Bank contract waiting not included in development estimate.