XML-RPC still works in Odoo 19, but it is deprecated and the official documentation says it is scheduled for removal in Odoo 22. For anything you are touching now, move to the JSON-2 API.

Moving the portal to JSON-2

• Create a dedicated integration user with only the rights it needs.
• From that user's Preferences, under Account Security, create a New API Key with a clear description and a short duration. Keys cannot exceed three months, so plan rotation.
• Call POST /json/2/sale.order/ followed by the method name, sending the key as a bearer token in the Authorization header.
• Each call is its own transaction, so avoid splitting one order across many calls.

Also check your plan: the documentation states that external API access is only available on Custom pricing plans.

Avoiding duplicates

• Store the portal's order number on the sales order, for example in the customer reference or a dedicated field.
• Before creating, search for that reference and update instead of creating if it exists.

Payments

First check whether your gateway is in the list under Configuration, then Payment Providers. A built-in provider is better than a custom webhook. If it is not listed, create an automation rule with the On webhook trigger, enable Log Calls, keep the URL secret, and test everything on a duplicate database before going live.