1. Build Integration for Cards (New Integration)

3DS2 Authentication

3DS2 is an authentication protocol, the successor of 3DS1, that enables businesses and payment providers to send additional information (such as customer device or browser data) to verify the transaction's authenticity. Razorpay integration is compliant with the 3DS2 protocol.

Know more: Razorpay supports

Integration Steps

The integration consists of the following steps.

1.1

1.2

1.3

1.4

1.5

1.1 Create an Order

Order is an important step in the payment process.

• An order should be created for every payment.
• You can create an order using the

  Orders API

  . It is a server-side API call. Know how to

  authenticate

  Orders API.
• The order_id received in the response should be passed to the checkout. This ties the order with the payment and secures the request from being tampered.

You can create an order:

• Using the sample code on the Razorpay Postman Public Workspace.
• By manually integrating the API sample codes on your server.

Razorpay Postman Public Workspace

You can use the Postman workspace below to create an order:

You can create an order manually by integrating the API sample codes on your server.

API Sample Code

Use this endpoint to create an order using the Orders API.

curl -X POST https://api.razorpay.com/v1/orders 
-U [YOUR_KEY_ID]:[YOUR_KEY_SECRET]
-H 'content-type:application/json'
-d '{
  "amount": 500,
  "currency": "INR",
  "receipt": "qwsaq1",
  "partial_payment": true,
  "first_payment_min_amount": 230,
  "notes": {
    "key1": "value3",
    "key2": "value2"
  }
}'

{
  "id": "order_IluGWxBm9U8zJ8",
  "entity": "order",
  "amount": 5000,
  "amount_paid": 0,
  "amount_due": 5000,
  "currency": "INR",
  "receipt": "rcptid_11",
  "offer_id": null,
  "status": "created",
  "attempts": 0,
  "notes": [],
  "created_at": 1642662092
}

1.2 Create a Payment

Create a payment using the API given below after your order is created.

curl -X POST \
https://api.razorpay.com/v1/payments/create/json \
-u [YOUR_KEY_ID]:[YOUR_KEY_SECRET] \
-H "Content-Type: application/json" \
-d '{
  "amount": 100,
  "currency": "INR",
  "contact": "9000090000",
  "email": "gaurav.kumar@example.com",
  "order_id": "order_DPzFe1Q1dEOKed",
  "method": "card",
  "card": {
    "number": "4111111111111111",
    "name": "Gaurav",
    "expiry_month": 11,
    "expiry_year": 23,
    "cvv": 100
  },
  "authentication": {
    "authentication_channel": "browser"
  },
  ### 3DS2.0 Browser Parameters###
  "browser": {
    "java_enabled": false,
    "javascript_enabled": false,
    "timezone_offset": 11,
    "color_depth": 23,
    "screen_width": 23,
    "screen_height": 100
  },
  "ip": "105.106.107.108",
  "referer": "https://merchansite.com/example/paybill",
  "user_agent": "Mozilla/5.0"
}'

Request Parameters

Response Parameters

If the payment request is valid, the response contains the following fields.

A basic integration must look out for one type of next action:

Implementing Native OTP flows

If you are using this endpoint to implement

You can also opt to have ['otp', '3ds'] defined as your default preferred auth. Get in touch with our

The response contains the following actions that should be consumed:

Examples

Different samples of payments using Native OTP with and without redirect flows are given below.

Payment Using Native OTP

This payment request results in next array containing otp_submit and otp_resend. This means the customer must be prompted for an OTP which can be submitted in the OTP Submit endpoint.

As otp_resend is also available, you can re-trigger the OTP SMS using the URL shared.

curl -X POST https://api.razorpay.com/v1/payments/create/redirect \
-u [YOUR_KEY_ID]:[YOUR_SECRET] \
-H 'content-type: application/json'
-d '{
  "amount": "1000",
  "currency": "INR",
  "order_id": "order_D32tqGE9vgwgJq",
  "email": "gaurav.kumar@example.com",
  "contact": "9000090000",
  "method": "card",
  "card": {
    "number": "4111111111111111",
    "name": "Gaurav",
    "expiry_month": 11,
    "expiry_year": 23,
    "cvv": 100
  },
  "authentication": {
    "authentication_channel": "browser"
  },
  ### 3DS2.0 Browser Parameters###
  "browser": {
    "java_enabled": false,
    "javascript_enabled": false,
    "timezone_offset": 11,
    "color_depth": 23,
    "screen_width": 23,
    "screen_height": 100
  },
  "ip": "105.106.107.108",
  "referer": "https://merchansite.com/example/paybill",
  "user_agent": "Mozilla/5.0",
  "auth_type": "otp"
}'

Payment Using Native OTP with Redirect Fallback

This payment request results in a next array containing otp_submit, otp_resend, and redirect. The redirect action here acts as a fallback to the bank page, that is, if your customer opts to enter the OTP on his bank page only, the browser can be redirected to the redirect URL in order to complete the payment using 3DS flow.

curl -X POST https://api.razorpay.com/v1/payments/create/redirect \
-u [YOUR_KEY_ID]:[YOUR_SECRET] \
-H 'content-type: application/json'
-d '{
  "amount": "1000",
  "currency": "INR",
  "order_id": "order_D32tqGE9vgwgJq",
  "email": "gaurav.kumar@example.com",
  "contact": "9000090000",
  "method": "card",
  "card": {
    "number": "4111111111111111",
    "name": "Gaurav",
    "expiry_month": 11,
    "expiry_year": 23,
    "cvv": 100
  },
  "authentication": {
    "authentication_channel": "browser"
  },
  ### 3DS2.0 Browser Parameters###
  "browser": {
    "java_enabled": false,
    "javascript_enabled": false,
    "timezone_offset": 11,
    "color_depth": 23,
    "screen_width": 23,
    "screen_height": 100
  },
  "ip": "105.106.107.108",
  "referer": "https://merchansite.com/example/paybill",
  "user_agent": "Mozilla/5.0",
  "auth_type": "otp"
}

Payment Using Native OTP as Preferred Auth

Here the payment request contains preferred auth that opts for otp and falls back to 3ds. This will result in a next array containing otp_submit and otp_resend. If Native OTP is not supported for the card, the next array containing only redirect is returned in the response.

curl -X POST https://api.razorpay.com/v1/payments/create/redirect \
-u [YOUR_KEY_ID]:[YOUR_SECRET] \
-H 'content-type: application/json'
-d '{
  "amount": "1000",
  "currency": "INR",
  "order_id": "order_D32tqGE9vgwgJq",
  "email": "gaurav.kumar@example.com",
  "contact": "9000090000",
  "method": "card",
  "card": {
    "number": "4111111111111111",
    "name": "Gaurav",
    "expiry_month": 11,
    "expiry_year": 23,
    "cvv": 100
  },
  "authentication": {
    "authentication_channel": "browser"
  },
  ### 3DS2.0 Browser Parameters###
  "browser": {
    "java_enabled": false,
    "javascript_enabled": false,
    "timezone_offset": 11,
    "color_depth": 23,
    "screen_width": 23,
    "screen_height": 100
  },
  "ip": "105.106.107.108",
  "referer": "https://merchansite.com/example/paybill",
  "user_agent": "Mozilla/5.0",
  "preferred_auth": [
    "otp",
    "3ds"
  ]
}

Response on Submitting OTP

Once the customer submits the OTP using the following endpoint, the respective success or failure responses will be generated.

The following endpoint submits the OTP:

curl -X POST \
'https://api.razorpay.com/v1/payments/pay_D5jmY2H6vC7Cy3/otp/submit' \
-u [YOUR_KEY_ID]:[YOUR_KEY_SECRET] \
-H "Content-Type: application/x-www-form-urlencoded" \
-d 'otp=123456'

After the payment is completed, the final response is posted to the URL given in callback_url of the request.

1.3 Handle Payment Success and Failure

Once the payment is completed by the customer, a POST request is made to the callback_url provided in the payment request. The data contained in this request will depend on whether the payment was a success or a failure of the payment made by the customer.

Success Callback

If the payment made by the customer is successful, the following fields are sent:

• razorpay_payment_id
• razorpay_order_id
• razorpay_signature

{
  "razorpay_payment_id": "pay_29QQoUBi66xm2f",
  "razorpay_order_id": "order_9A33XWu170gUtm",
  "razorpay_signature": "9ef4dffbfd84f1318f6739a3ce19f9d85851857ae648f114332d8401e0949a3d"
}

Failure Callback

If the payment has failed, the callback will contain details of the error. Refer to

1.4 Verify Payment Signature

This is a mandatory step to confirm the authenticity of the details returned to the Checkout form for successful payments.

To verify the razorpay_signature returned to you by the Checkout form:

1. Create a signature in your server using the following attributes:

   • order_id: Retrieve the order_id from your server. Do not use the razorpay_order_id returned by Checkout.
   • razorpay_payment_id: Returned by Checkout.
   • key_secret: Available in your server. The key_secret that was generated from the
     Razorpay Dashboard
     .

2. Use the SHA256 algorithm, the razorpay_payment_id and the order_id to construct a HMAC hex digest as shown below:

   HMAC Hex Digest

   copy

   generated_signature = hmac_sha256(order_id + "|" + razorpay_payment_id, secret);
   
     if (generated_signature == razorpay_signature) {
       payment is successful
     }

3. If the signature you generate on your server matches the razorpay_signature returned to you by the Checkout form, the payment received is from an authentic source.

Generate Signature on Your Server

Given below is the sample code for payment signature verification:

RazorpayClient razorpay = new RazorpayClient("[YOUR_KEY_ID]", "[YOUR_KEY_SECRET]");

String secret = "EnLs21M47BllR3X8PSFtjtbd";

JSONObject options = new JSONObject();
options.put("razorpay_order_id", "order_IEIaMR65cu6nz3");
options.put("razorpay_payment_id", "pay_IH4NVgf4Dreq1l");
options.put("razorpay_signature", "0d4e745a1838664ad6c9c9902212a32d627d68e917290b0ad5f08ff4561bc50f");

boolean status =  Utils.verifyPaymentSignature(options, secret);

Post Signature Verification

After you have completed the integration, you can

1.5 Verify Payment Status

You can track the payment status in three ways:

• From the Dashboard

  .

• Subscribe to the Webhook Events

  .

• Poll our APIs

  .

Verify Status from Dashboard

To verify the payment status from the Dashboard:

1. Log in to the

   Dashboard

   and navigate to Transactions → Payments.
2. Check if a Payment Id has been generated and note the status. In case of a successful payment, the status is marked as Captured.

Subscribe to Webhook Events

You can use Razorpay webhooks to configure and receive notifications when a specific event occurs. When one of these events is triggered, we send an HTTP POST payload in JSON to the webhook's configured URL. Know how to

Example

If you have subscribed to the order.paid webhook event, you will receive a notification every time a customer pays you for an order.

Poll APIs

Next Steps