Hosted payments lets you hand over the control of the entire checkout process to Razorpay. As the payment information entered by the customers is securely stored with Razorpay, you do not have to worry about implementing the PCI compliance requirements at your end.
Unlike the standard implementation of checkout where customers enter their payment details on a pop-up modal, hosted payments securely redirects customers to a Checkout page hosted at Razorpay. The payment details submitted by the customer in the Checkout form are sent to our server. Payments, from thereon, follow the usual payment flow.
Copy$order = $client->order->create([
'receipt' => 'order_rcptid_11',
'amount' => 50000, // amount in the smallest currency unit'currency' => 'INR',// <a href="/docs/payment-gateway/payments/international-payments/#supported-currencies" target="_blank">See the list of supported currencies</a>.)
]);
CopyDictionary<string, object> options = new Dictionary<string,object>();
options.Add("amount", 50000); // amount in the smallest currency unit
options.add("receipt", "order_rcptid_11");
options.add("currency", "INR");
Order order = client.Order.Create(options);
Copyoptions = amount:50000, currency:'INR', receipt:'<order_rcptid_11>',
order = Razorpay::Order.create
Copyvar options = {
amount: 50000, // amount in the smallest currency unit
currency: "INR",
receipt: "order_rcptid_11"
};
instance.orders.create(options, function(err, order) {
console.log(order);
});
An order id (referred as order_id) is generated on the successful creation of an order. You should store this order id in your system against the order.
integer The transaction amount, expressed in the currency subunit, such as paise (in case of INR). For example, for an actual amount of ₹299.35, the value of this field should be 29935.
currencymandatory
string The currency in which the transaction should be made. See the list of supported currencies. Default is INR. Length must be of 3 characters.
receiptoptional
string Your receipt id for this order should be passed here. Maximum length of 40 characters.
notesoptional
object Key-value pair that can be used to store additional information about the entity. Maximum 15 key-value pairs, 256 characters (maximum) each. For example, "note_key": "Beam me up Scotty”.
The Checkout options are sent as form-data to the following URL in a POST request.
https://api.razorpay.com/v1/checkout/embedded
The sample code is given below:
Copy<formmethod="POST"action="https://api.razorpay.com/v1/checkout/embedded"><inputtype="hidden"name="key_id"value="YOUR_KEY_ID"><inputtype="hidden"name="order_id"value="razorpay_order_id"><inputtype="hidden"name="name"value="Acme Corp"><inputtype="hidden"name="description"value="A Wild Sheep Chase"><inputtype="hidden"name="image"value="https://cdn.razorpay.com/logos/BUVwvgaqVByGp2_large.png"><inputtype="hidden"name="prefill[name]"value="Gaurav Kumar"><inputtype="hidden"name="prefill[contact]"value="9123456780"><inputtype="hidden"name="prefill[email]"value="gaurav.kumar@example.com"><inputtype="hidden"name="notes[shipping address]"value="L-16, The Business Centre, 61 Wellfield Road, New Delhi - 110001"><inputtype="hidden"name="callback_url"value="https://example.com/payment-callback"><inputtype="hidden"name="cancel_url"value="https://example.com/payment-cancel"><button>Submit</button></form>
For every successful payment, razorpay_payment_id, razorpay_order_id and razorpay_signature are submitted via a POST request to the callback_url passed in payment options.
If your customer cancels the transaction or clicks the back button, they are redirected to the cancel_url via a GET request.
If the payment fails, a POST request is made to the callback_url, with the error fields as payload.
A successful payment returns the following fields to the Checkout Form. Make provisions to store these fields on your server. You can confirm the authenticity of these details by verifying the signature in the next step.
This is a mandatory step that allows you to confirm the authenticity of the details returned to the Checkout form for successful payments.
To verify the razorpay_signature returned to you by the Checkout form:
Create a signature in your server using the following attributes:
order_id - Retrieve the order_id from your server. Do not use the razorpay_order_id returned by Checkout.
razorpay_payment_id - Returned by Checkout.
key_secret - Available in your server. The key_secret that was generated from the Dashboard.
Use the SHA256 algorithm, the razorpay_payment_id and the order_id to construct a HMAC hex digest as shown below:
Copygenerated_signature = hmac_sha256(order_id + "|" + razorpay_payment_id, secret);
if (generated_signature == razorpay_signature) {
payment is successful
}
If the signature you generate on your server matches the razorpay_signature returned to you by the Checkout form, the payment received is from an authentic source.
Copy/**
* This class defines common routines for generating
* authentication signatures for Razorpay Webhook requests.
*/publicclassSignature{
privatestaticfinal String HMAC_SHA256_ALGORITHM = "HmacSHA256";
/**
* Computes RFC 2104-compliant HMAC signature.
* * @param data
* The data to be signed.
* @param key
* The signing key.
* @return
* The Base64-encoded RFC 2104-compliant HMAC signature.
* @throws
* java.security.SignatureException when signature generation fails
*/publicstatic String calculateRFC2104HMAC(String data, String secret)throws java.security.SignatureException
{
String result;
try {
// get an hmac_sha256 key from the raw secret bytes
SecretKeySpec signingKey = new SecretKeySpec(secret.getBytes(), HMAC_SHA256_ALGORITHM);
// get an hmac_sha256 Mac instance and initialize with the signing key
Mac mac = Mac.getInstance(HMAC_SHA256_ALGORITHM);
mac.init(signingKey);
// compute the hmac on input data bytesbyte[] rawHmac = mac.doFinal(data.getBytes());
// base64-encode the hmac
result = DatatypeConverter.printHexBinary(rawHmac).toLowerCase();
} catch (Exception e) {
thrownew SignatureException("Failed to generate HMAC : " + e.getMessage());
}
return result;
}
}
After verifying the signature, fetch the order in your system that corresponds to the razorpay_order_id in your database. Mark it as successful and process the order.
Once authorized, you need to capture payments made by customers for them to get settled to your bank account as per the settlement schedule. Payments that are not captured are auto-refunded after a fixed time period. You can:
Auto-capture payments (recommended) Authorized payments can be automatically captured. You can auto-capture all payments using global settings on the Dashboard.
Manually capture payments Each authorized payment can also be captured individually. You can manually capture payments:
Now that the integration is complete, you must ensure that your integration works as expected. You can make a test transaction using the test cards, verify the payment status from Dashboard, APIs or subscribe to related Webhook events to take appropriate actions at your end. After testing the integration in test mode, you can start accepting payments from your customers in real-time.
You can make test payments using any of the payment methods configured on the Checkout. No money is deducted from the customer's account as this is a simulated transaction. In the Checkout code, ensure that you have entered the API keys generated in the test mode.
You can use any of the test cards to make transactions in the test mode. Use any valid expiration date in the future and any random CVV to create a successful payment.
You can subscribe to a Webhook event that is generated when a certain event happens in our server. When one of those events is triggered, Razorpay sends the Webhook payload to the configured URL.
After testing the flow of funds end-to-end in test mode, you are now ready to take your integration live. Once you are confident that the integration is working fine, you can switch to the live mode and start accepting payments from customers. But first, you need to swap the test API keys with the live keys.
To generate API key in live mode:
Log into Dashboard and switch to Live mode on the menu.
Navigate to Settings → API Keys → Generate Key to generate API key for live mode.
Download the keys and save it securely.
Replace the test API key with the Live Key in the Checkout code and start accepting real-time payments.