PaymentThailandE-commerce

Payment Integration for Thai Websites: PromptPay, KBank, SCB

2 May 2026 · by Yunmin Shin

What Payment Methods Do Thai Customers Prefer?

Thai consumers have clear payment preferences that differ significantly from Western markets. Understanding these is essential before building any e-commerce, booking-deposit, or payment-enabled application in Thailand.

PromptPay is the most widely used payment method in Thailand. It allows instant bank transfers via phone number or national ID, with QR codes as the primary interface. The Bank of Thailand reports billions of PromptPay transactions monthly. If your site does not support PromptPay QR — whether that's an e-commerce checkout, a clinic collecting a booking deposit, or a restaurant taking a pre-order — you are creating unnecessary friction at the exact moment the customer is ready to pay.

Credit and debit cards remain important, particularly for younger Bangkok consumers and tourists. Visa and Mastercard coverage is essential for any business serving international customers, including aesthetic clinics that see a meaningful share of medical-tourism patients.

Mobile banking apps like K PLUS (Kasikornbank) and SCB Easy are used constantly for scanning PromptPay QR codes and for direct bank transfers — most Thai payment gateway integrations are really integrations with this QR-scanning behavior, not with a card form.

LINE Pay is the preferred in-app payment method for purchases made through LINE or LIFF apps, which matters if you're building a LINE-based ordering flow for a restaurant rather than a standalone website.

Buy Now Pay Later services like Atome, which supports Thai merchants, are growing in popularity for fashion, electronics, and increasingly for higher-ticket clinic treatment packages.

What Payment Gateways Work in Thailand?

Omise (now Opn Payments) is the leading payment gateway built specifically for Southeast Asia. It supports PromptPay QR, TrueMoney Wallet, credit cards, and installments. Its documentation is in Thai and English, its support team is Bangkok-based, and its merchant agreement process is straightforward for Thai-registered businesses. This is the recommended default for most Bangkok projects — the small e-commerce stores, clinic booking sites, and restaurant ordering systems Bluewich builds most often use Omise as the primary gateway.

2C2P is a Singapore-headquartered gateway with strong coverage across Southeast Asia and a long track record with larger Thai merchants — hotels, airlines, and enterprise retail. It supports PromptPay, cards, and regional wallets, and is worth evaluating alongside Omise for higher-volume or multi-country businesses, though its onboarding process is generally more involved than Omise's.

Stripe supports Thai baht and Thai businesses as of 2023. It excels at international card payments and has a superior developer experience, but does not natively support PromptPay. Use Stripe for internationally-facing businesses and combine it with Omise or 2C2P if local payment methods are needed.

KBank KPayPlus and SCB Payment Gateway are bank-direct options that offer lower per-transaction fees at scale. However, their APIs are older, documentation is primarily in Thai, and integration requires a direct merchant agreement with the bank. These are worth considering for high-volume merchants processing over 1 million baht per month, but not the right starting point for a new site.

How Do You Implement PromptPay QR?

With Omise, generating a PromptPay QR is a server-side API call. This is the same pattern whether you're charging for a product, a clinic deposit, or a restaurant pre-order:

const charge = await omise.charges.create({
  amount: 50000, // amount in satang (THB × 100)
  currency: "thb",
  source: { type: "promptpay" },
});
// charge.source.scannable_code.image.download_uri = QR image URL

Display the QR code to the user and poll the charge status until it changes to successful. Polling alone is not reliable — always implement a webhook endpoint as the source of truth for payment confirmation, since a user closing the browser tab after scanning should not mean the order is lost.

How Do You Handle Webhooks Securely?

Every gateway sends a webhook when a charge's status changes. Treat this endpoint carefully:

export async function POST(req: Request) {
  const signature = req.headers.get("x-omise-signature");
  const rawBody = await req.text();

  if (!verifySignature(rawBody, signature, process.env.OMISE_WEBHOOK_SECRET)) {
    return new Response("Invalid signature", { status: 401 });
  }

  const event = JSON.parse(rawBody);
  if (event.data.status === "successful") {
    await markOrderPaid(event.data.metadata.orderId); // idempotent update
  }
  return new Response("OK", { status: 200 });
}

Always verify the webhook signature before trusting the payload — an unauthenticated endpoint that marks orders "paid" is an obvious fraud vector. Make the handler idempotent too: gateways retry webhook delivery, and re-processing the same successful charge should never double-fulfill an order or double-book a clinic slot.

What Are the Key Legal Requirements?

To accept payments in Thailand, your business must be registered (company or registered partnership). Foreign-owned businesses may face restrictions on certain payment methods — consult a Thai lawyer or accountant before integrating payments for a new business, especially one with foreign shareholders.

All payment providers require identity verification (KYC) for the merchant before going live. Prepare your company registration documents, director's ID, and bank account details before starting the gateway application process — this step, not the API integration, is usually what determines your actual launch date.

How Do You Test Payments Before Launch?

Every gateway provides a sandbox or test-mode environment with dummy card numbers and simulated PromptPay QR codes that auto-resolve to success or failure. Build and test your entire flow — checkout, webhook handling, order confirmation email or LINE notification, refund path — against test mode before requesting production (live) API keys.

Test failure paths deliberately, not just the happy path: a declined card, a webhook that arrives twice, a customer who closes the tab mid-payment and returns later to check their order status. These edge cases are common in real usage, especially on Thai mobile connections where a payment can be interrupted by a dropped 4G connection between scanning the QR and the bank confirming it.