What is the minimum setup needed to start collecting online donations in Nepal?

You need a registered organisation with a PAN, a bank account in the organisation's name, a hosted donation page served over HTTPS, and a payment gateway merchant account. Gateways such as eSewa, Khalti, Fonepay or ConnectIPS onboard you against those documents. Expect KYC review before go-live; confirm each vendor's current requirements.

Which payment gateway should a Nepali organisation pick?

It depends on who gives. Domestic wallets such as eSewa, Khalti and IME Pay cover most Nepali donors and settle quickly; ConnectIPS and Fonepay reach bank account holders. International card acceptance is a separate, harder track. Choose what your donors already use, and keep a bank transfer route for large gifts.

Can a Nepal-registered organisation accept international donations by card or PayPal?

At the time of writing, Nepal-based entities cannot open standard Stripe or PayPal receiving accounts, so international card collection usually runs through a foreign partner, a fiscal sponsor, or a wire to the organisation's foreign-currency account. Foreign donation rules and NRB approval change; confirm current requirements with your bank and a lawyer.

How do we verify a donation actually reached our bank account?

Never trust the browser redirect. Treat the gateway's server-to-server webhook or settlement report as the source of truth, store the gateway transaction ID, and reconcile daily against the bank statement or settlement file. Run one small live donation and confirm the net amount matches before promoting the page.

What causes a donation to show as paid but never arrive?

Typical causes are the donor closing the tab before the callback fired, a webhook that failed or was blocked by a firewall or WAF rule, or a reconciliation job that errored silently. Check the gateway log for the transaction ID, verify webhook signature handling, and make donation records idempotent.

How do we prevent donors being charged twice?

Send an idempotency key with each charge attempt and make your webhook handler idempotent on the gateway transaction ID. Never retry a charge blindly after a timeout; query the gateway for that transaction's status first. Refund genuine duplicates through the gateway dashboard and record the refund against the original donation.

Can we run recurring monthly donations?

Some providers support tokenised recurring mandates, but e-mandate support varies by gateway, card and wallet, so check current vendor documentation before advertising it. A workable fallback is a monthly reminder email carrying a one-click payment link. Failed recurring charges look like silent churn, so monitor them and notify the donor.

What security rules apply to a donation page?

Never store card numbers on your own server. Use the gateway's hosted checkout or tokenisation so card data never touches your code, force HTTPS across the whole site, verify webhook signatures, and keep API keys server-side only. Publish refund and privacy policies, and log every admin access to donation records.

What ongoing work does running online donations involve?

Daily reconciliation against gateway and bank records, monthly settlement checks, chasing failed recurring payments, processing refund requests, issuing donor receipts, and annual reporting if you are Social Welfare Council affiliated. Cost drivers are transaction fees, settlement delay, chargebacks and staff time spent reconciling, not the donation software itself.

What are the alternatives if a gateway is not viable yet?

A published bank account with a QR code, cheques, and direct wallet transfers to a dedicated number all work, at the cost of manual reconciliation and no instant receipt. A fiscal sponsor or an international platform can collect abroad and remit. Our team can help you compare options through /contact.

Online Donation Nepal: Setup That Actually Works

Taking donations online for a Nepali organisation

Accepting an online donation in Nepal requires integrating a local payment gateway like eSewa or Khalti into a secure web form, hosted on reliable infrastructure. The mechanism relies on server-side verification of payment callbacks to prevent spoofed transactions and ensure funds actually clear.

Key Takeaways

Local gateways like eSewa, Khalti, and Fonepay are essential because most Nepali donors do not use international credit cards.
Server-side signature verification is mandatory; relying solely on client-side redirects allows attackers to fake successful donations.
A custom Laravel application offers full control over donor data, while WordPress with WooCommerce suits smaller organisations needing quick setup.
Hosting must be fast and stable; a slow checkout page directly causes donors to abandon the transaction before paying.
PCI compliance is handled by the gateway's redirect flow, meaning your servers never touch raw card or banking credentials.
Recurring donations require specific gateway support, as not all Nepali providers offer automated subscription billing APIs.

The exact sequence a donation follows from the initial form submission through gateway redirection, server-side verification, and final database logging.

Which payment gateways actually work for online donations in Nepal?

Nepali payment gateways like eSewa, Khalti, and Fonepay process local donations by redirecting users to authenticated banking apps or wallets. International processors like Stripe lack direct Nepali Rupee settlement without complex corporate structures abroad. You must register a merchant account with the chosen provider, which requires PAN registration and organisational documents. Check the current docs for each gateway's specific API endpoints, as authentication methods have shifted recently toward standard OAuth flows.

Choosing between them depends on your audience. eSewa holds the largest wallet user base. Khalti offers a slightly more modern developer experience and aggressive cashback campaigns that sometimes encourage giving. Fonepay connects directly to mobile banking apps, bypassing the need for a separate wallet balance. Most mature platforms integrate at least two of these to avoid turning away donors whose preferred app is unsupported.

Why does server-side verification matter for donation forms?

Server-side verification prevents spoofed transactions by validating the cryptographic signature returned by the payment gateway against your secret key. Relying only on a browser redirect allows anyone to manipulate the success URL and trigger false confirmation emails. Your backend must receive the asynchronous callback, verify the payload, and mark the donation as complete only after the gateway confirms the funds cleared.

In practice, this means your application exposes a webhook endpoint. When a donor completes payment, the gateway sends an HTTP POST request to this endpoint containing the transaction ID and a hash. If you skip checking that hash, you will eventually ship thank-you receipts for money you never received. We have seen this exact failure mode cause severe accounting discrepancies for non-profits running their own unpatched plugins.

Should you build a custom application or use WordPress?

A custom Laravel application provides strict control over donor data schemas and reporting logic, while WordPress paired with WooCommerce handles standard one-off donations faster. The decision hinges on whether you need complex recurring billing tied to internal CRM systems or just a simple checkout page. For most small-to-medium organisations, a well-configured WordPress site avoids unnecessary engineering overhead.

Criteria	Custom Web Application (Laravel/Node)	WordPress + WooCommerce
Setup speed	Weeks of development and testing	Days using existing gateway plugins
Recurring billing	Fully programmable via API	Limited by plugin capabilities
Maintenance burden	Requires developer time for updates	Requires routine theme and plugin patching
Data ownership	Complete control over database schema	Stored in standard WP post meta tables

If your organisation runs large-scale campaigns requiring detailed analytics or integrates donations into a broader portal, custom software makes sense. Our team can help you scope this decision properly; reach out via our contact page to discuss your specific workflow. If you just need a reliable page that takes money securely, WordPress remains the pragmatic choice.

How do you set up a secure online donation page step-by-step?

Setting up a secure donation page involves registering a merchant account, installing SSL certificates, configuring the gateway plugin or SDK, and testing the webhook endpoint in sandbox mode. Never deploy a payment form over plain HTTP. The following steps outline the standard rollout sequence for a typical deployment.

Register your organisation with the chosen payment gateway and obtain your production and sandbox API credentials.
Provision a server with a valid SSL certificate. Managed hosting environments handle this automatically, but verify the chain is complete.
Install the official gateway plugin if using WordPress, or include the vendor's SDK if building a custom application in PHP or Node.js.
Configure the return URLs and webhook endpoints in both your application settings and the gateway dashboard to match exactly.
Run test transactions in sandbox mode. Verify that the webhook endpoint logs the event and updates the database state correctly.
Switch the credentials from sandbox to production. Monitor the first few live transactions manually to confirm funds settle.

Before switching to production credentials, back up your database. If you are migrating from an older system, run a dry-run migration first. Changing DNS records to point to a new hosting environment should be done during low-traffic hours, as propagation delays can temporarily break the checkout flow.

Mapping your organisation's specific operational needs to the correct technical architecture ensures you do not over-engineer a simple requirement.

What breaks in production with Nepali payment integrations?

Production failures usually stem from mismatched webhook URLs, expired SSL certificates, or gateway timeouts during high-traffic campaign launches. When a webhook fails silently, the donor sees a success screen but your database records nothing. You check the gateway dashboard first to see if the callback was dispatched, then inspect your server's access logs for the incoming POST request.

Another common failure mode involves currency formatting. Some gateways expect amounts in paisa (integer values), while others expect rupees with decimal points. Passing a float where an integer is expected results in immediate rejection errors. Always validate the payload format against the vendor's current specification before launching a major fundraising drive.

How do hosting and performance affect donation conversion rates?

Page load times directly impact donor abandonment; a delay beyond three seconds causes significant drop-off before the payment form even renders. Hosting your site on a managed VPS rather than cheap shared hosting ensures consistent CPU allocation during traffic spikes. Infrastructure stability matters just as much as the code itself when handling financial transactions.

We often review setups where organisations host critical portals on overcrowded shared servers. As we discussed in our guide on shared hosting versus VPS versus cloud, resource contention leads to random timeouts during checkout. Moving to isolated infrastructure stabilises the connection to the payment gateway. Proper caching layers, configured carefully to exclude the dynamic checkout cart, keep the rest of the site fast without breaking session states.

What are the security and compliance requirements for handling donations?

Handling donations securely means offloading sensitive data entry to the payment gateway's hosted fields or redirect pages so your server never processes raw credentials. This reduces your PCI DSS compliance burden significantly. You must still secure your own database, enforce HTTPS everywhere, and restrict administrative access to the backend systems storing donor contact information.

Regular security hardening is non-negotiable. Outdated WordPress plugins or unpatched PHP versions invite automated attacks. Whether you manage this internally or rely on ongoing maintenance services, the patching schedule must be documented. Backups should run daily and be tested periodically; a backup you cannot restore is just wasted storage space.

The sequential security checks every organisation must complete before routing live financial traffic through their newly deployed donation portal.

How do you handle recurring donations and offline reconciliation?

Recurring donations depend entirely on whether the selected Nepali gateway supports subscription APIs. Currently, automated recurring billing options are limited compared to Western processors. Many organisations solve this by generating manual payment links monthly or integrating SMS reminders prompting donors to repeat their contribution. Evaluate this limitation early, as it affects your revenue forecasting model.

Offline reconciliation requires matching the gateway's settlement reports against your internal database. Export the transaction CSV from the gateway dashboard daily and write a script to cross-reference transaction IDs. Discrepancies usually arise from failed webhooks or refunds processed directly inside the gateway panel without notifying your application. Building automated alerts around unmatched records saves hours of manual auditing.

When should you consider a mobile app for collecting donations?

A dedicated mobile application makes sense only if your organisation maintains frequent, direct engagement with its donor base beyond occasional fundraising drives. Cross-platform frameworks like Flutter allow you to target Android and iOS simultaneously, reducing development effort. However, app store approvals add friction, and convincing users to install an app solely for donating introduces unnecessary barriers.

For most NGOs and community groups, a responsive web application performs better because donors can give immediately via a link shared on social media. If you already operate a mobile platform for other services, adding a payment module is logical. Our experience in mobile app development shows that integrating native payment SDKs improves the checkout experience, but the acquisition cost of the app install must justify the engineering investment.

What does it cost to run an online donation system?

The cost drivers for running a donation system include server hosting, domain registration, SSL certificates, and the transaction fees charged by the payment gateway per successful transfer. Gateway fees are typically a percentage of the transaction amount plus a fixed charge. Cloud infrastructure costs scale with traffic; a quiet informational site costs very little, while a viral campaign requires auto-scaling resources.

Do not forget the operational cost of maintenance. Software requires updates, security patches, and occasional troubleshooting when upstream APIs change. Factor in the engineer time needed to monitor logs and reconcile accounts. Using vendor calculators helps estimate infrastructure spend, but human maintenance time is often the larger long-term expense. Understanding these variables helps when planning a web development budget.

In short, accepting digital contributions locally requires selecting the right payment partner, enforcing strict server-side validation, and hosting the application on infrastructure that does not buckle under pressure. Start with the simplest architecture that meets your reporting needs, verify every webhook signature, and monitor your error logs daily. If your organisation needs help scoping, building, or maintaining a secure donation platform, our team can help you evaluate the options through our core services. Reach out via our contact page to start the conversation, or review similar projects in our portfolio.

People also search for

Frequently asked questions

You need a registered organisation with a PAN, a bank account in the organisation's name, a hosted donation page served over HTTPS, and a payment gateway merchant account. Gateways such as eSewa, Khalti, Fonepay or ConnectIPS onboard you against those documents. Expect KYC review before go-live; confirm each vendor's current requirements.
It depends on who gives. Domestic wallets such as eSewa, Khalti and IME Pay cover most Nepali donors and settle quickly; ConnectIPS and Fonepay reach bank account holders. International card acceptance is a separate, harder track. Choose what your donors already use, and keep a bank transfer route for large gifts.
At the time of writing, Nepal-based entities cannot open standard Stripe or PayPal receiving accounts, so international card collection usually runs through a foreign partner, a fiscal sponsor, or a wire to the organisation's foreign-currency account. Foreign donation rules and NRB approval change; confirm current requirements with your bank and a lawyer.
Never trust the browser redirect. Treat the gateway's server-to-server webhook or settlement report as the source of truth, store the gateway transaction ID, and reconcile daily against the bank statement or settlement file. Run one small live donation and confirm the net amount matches before promoting the page.
Typical causes are the donor closing the tab before the callback fired, a webhook that failed or was blocked by a firewall or WAF rule, or a reconciliation job that errored silently. Check the gateway log for the transaction ID, verify webhook signature handling, and make donation records idempotent.
Send an idempotency key with each charge attempt and make your webhook handler idempotent on the gateway transaction ID. Never retry a charge blindly after a timeout; query the gateway for that transaction's status first. Refund genuine duplicates through the gateway dashboard and record the refund against the original donation.
Some providers support tokenised recurring mandates, but e-mandate support varies by gateway, card and wallet, so check current vendor documentation before advertising it. A workable fallback is a monthly reminder email carrying a one-click payment link. Failed recurring charges look like silent churn, so monitor them and notify the donor.
Never store card numbers on your own server. Use the gateway's hosted checkout or tokenisation so card data never touches your code, force HTTPS across the whole site, verify webhook signatures, and keep API keys server-side only. Publish refund and privacy policies, and log every admin access to donation records.
Daily reconciliation against gateway and bank records, monthly settlement checks, chasing failed recurring payments, processing refund requests, issuing donor receipts, and annual reporting if you are Social Welfare Council affiliated. Cost drivers are transaction fees, settlement delay, chargebacks and staff time spent reconciling, not the donation software itself.
A published bank account with a QR code, cheques, and direct wallet transfers to a dedicated number all work, at the cost of manual reconciliation and no instant receipt. A fiscal sponsor or an international platform can collect abroad and remit. Our team can help you compare options through /contact.