How to generate payment token in wordpress?

Question

Electronic commerce

Good afternoon, in general a subject.
How to properly organize payments from a security point of view (not woocommerce, paid subscription on the site). In general, I'm interested in the moment with a fake callback response by an attacker, for this I want to create a unique payment token that will be checked in the callback script and now I'm thinking about how best to organize this on wp.

1. Just add a column with a static token to the users table and compare ID + token in the callback itself
   
2. Generate a unique token for each payment, but then the question arises with payments that can be paid after some time, because the token, in theory, will be formed before the moment of payment ...
   

In general, there may be an article with best practice on how it is desirable to organize it, otherwise on the Internet I find only instructions for working with payment gateways without additional information about working with security on the server side.
Thank you.
PS In general, the question is removed, the response from the gateway is encrypted, and not transmitted in plain text. But in general, I would still be interested to know how to organize payments in the right way.

Answer 1

I think it's worth starting with such a thing as an Order. Any sites that have a more or less intelligible subscription mechanics have Orders in one form or another. Whether it's WooCommerce or LiterLMS (there are purely subscriptions and courses).
In any case, everything revolves around Orders. The user creates an Order. Further pays.
If this is a payment through Yandex Checkout or Wallet, then the token is sewn into the gateway panel. And the site should check it. If it matches, then consider the payment went through.
If payment is made by hand, for example, through payment on a card or in cash, then the admin pokes the order with his hands in the admin panel. After that, the Order is considered paid and then the rest of the logic dances from this.
Something like this.