The parties

Your site, the customer, and the payment provider (Safaricom Daraja, Paystack, Stripe). Your site never touches a PIN or card number. That is the entire reason to use a provider.

The flow, in order

1. Customer clicks Pay
2. Your server creates a PENDING order with your own reference
3. Your server asks the provider to start the payment
4. Customer approves, an STK push prompt, or a card page
5. The provider tells you the result
6. Your server verifies and marks the order PAID

Step 6 is where people go wrong

Never mark an order paid because the BROWSER said so. A redirect back to success.php?status=paid can be typed by anyone. The confirmation must come from your server talking to the provider's server, or from a signed callback you verify.

Create the order first

The pending row exists before any money moves. Otherwise a callback arrives referring to something you have no record of, and you are reconciling by hand.

Your reference, not theirs

Generate an unguessable reference, bin2hex(random_bytes(8)), not order number 1, 2, 3. Sequential references let someone probe other people's orders.