3DS2 Authentication

3DS2 is an authentication protocol, the successor of 3DS1, that enables businesses and payment providers to send additional information (such as customer device or browser data) to verify the transaction's authenticity. Razorpay integration is compliant with the 3DS2 protocol.

Know more: Razorpay supports

Integration Steps

Follow the steps below to integrate S2S JSON API with browser flow and accept payments using cards.

1.1

1.2

1.3

1.4

1.5

1.6

1.1 Create an Order

To begin processing a payment, create a Razorpay order to correspond with the order in your system.

Order is an important step in the payment process.

• An order should be created for every payment.
• You can create an order using the

  Orders API

  . It is a server-side API call. Know how to

  authenticate

  Orders API.
• The order_id received in the response should be passed to the checkout. This ties the order with the payment and secures the request from being tampered.

You can create an order:

• Using the sample code on the Razorpay Postman Public Workspace.
• By manually integrating the API sample codes on your server.

Razorpay Postman Public Workspace

You can use the Postman workspace below to create an order:

You can create an order manually by integrating the API sample codes on your server.

API Sample Code

Use this endpoint to create an order using the Orders API.

curl -X POST https://api.razorpay.com/v1/orders 
-U [YOUR_KEY_ID]:[YOUR_KEY_SECRET]
-H 'content-type:application/json'
-d '{
  "amount": 500,
  "currency": "INR",
  "receipt": "qwsaq1",
  "partial_payment": true,
  "first_payment_min_amount": 230,
  "notes": {
    "key1": "value3",
    "key2": "value2"
  }
}'

{
  "id": "order_IluGWxBm9U8zJ8",
  "entity": "order",
  "amount": 5000,
  "amount_paid": 0,
  "amount_due": 5000,
  "currency": "INR",
  "receipt": "rcptid_11",
  "offer_id": null,
  "status": "created",
  "attempts": 0,
  "notes": [],
  "created_at": 1642662092
}

1.2 Create a Payment

After the order is created, your next step is to create a payment. The following API will create a payment with card as the payment method. The

Sample Code

curl -X POST \
https://api.razorpay.com/v1/payments/create/json \
-u [YOUR_KEY_ID]:[YOUR_KEY_SECRET] \
-H "Content-Type: application/json" \
-d '{
	"amount": 100,
	"currency": "INR",
	"contact": "9900008989",
	"email": "gaurav.kumar@example.com",
	"order_id": "order_DPzFe1Q1dEOKed",
	"method": "card",
	"card":{
    	   "number": "4111111111111111",
    	   "name": "Gaurav",
    	   "expiry_month": "11",
    	   "expiry_year": "30",
    	   "cvv": "100"
      },
      "authentication":{
    	   "authentication_channel": "browser"
      },
      "browser":{
    	   "java_enabled": false,
    	   "javascript_enabled": false,
    	   "timezone_offset": 11,
    	   "color_depth": 23,
    	   "screen_width": 23,
    	   "screen_height": 100
     },
     "ip": "105.106.107.108",
     "referer": "https://merchansite.com/example/paybill",
     "user_agent": "Mozilla/5.0" 
}'

Request Parameters

Response Parameters

If the payment request is valid, the response contains the following fields.

OTP Generation

If you would like the customer to enter the OTP on your website instead of the bank page, use the otp_generate URL. When this URL is triggered, you get the following response:

curl -u [YOUR_KEY_ID]
-X POST https://api.razorpay.com/v1/payments/pay_FVmAstJWfsD3SO/otp_generate
-H "Content-Type: application/json" \

Path Parameter

Response Parameters

If the payment request is valid, the response contains the following fields.

If the customer faces any latency issues, you can choose to cancel this request and redirect the customer to the bank page to enter the OTP and complete the payment. Thus, you can avoid payment failure by switching the customer to the bank page payment flow.

Response on Submitting OTP

Razorpay sends the respective success or failure response after the customer submits the OTP on your page.

The following endpoint submits the OTP:

After the payment is completed, the final response is posted to the URL given in callback_url of the request, and can then be verified.

1.3 Handle Payment Success and Error Events

Once the payment is completed by the customer, a POST request is made to the callback_url provided in the payment request. The data contained in this request will depend on whether the payment was a success or a failure.

Success Callback

If the payment made by the customer is successful, the following fields are sent:

• razorpay_payment_id
• razorpay_order_id
• razorpay_signature

{
  "razorpay_payment_id": "pay_29QQoUBi66xm2f",
  "razorpay_order_id": "order_9A33XWu170gUtm",
  "razorpay_signature": "9ef4dffbfd84f1318f6739a3ce19f9d85851857ae648f114332d8401e0949a3d"
}

Failure Callback

If the payment has failed, the callback will contain details of the error. Refer to

1.4 Verify Payment Signature

Signature verification is a mandatory step to ensure that the callback is sent by Razorpay. The razorpay_signature contained in the callback can be regenerated by your system and verified as follows.

Create a string to be hashed using the razorpay_payment_id contained in the callback and the Order ID generated in the first step, separated by a |. Hash this string using SHA256 and your API Secret.

generated_signature = hmac_sha256(order_id + "|" + razorpay_payment_id, secret);

if (generated_signature == razorpay_signature) {
    payment is successful
}

Generate Signature on your Server

/**
* This class defines common routines for generating
* authentication signatures for Razorpay Webhook requests.
*/
public class Signature
{
    private static final String HMAC_SHA256_ALGORITHM = "HmacSHA256";
    /**
    * Computes RFC 2104-compliant HMAC signature.
    * * @param data
    * The data to be signed.
    * @param key
    * The signing key.
    * @return
    * The Base64-encoded RFC 2104-compliant HMAC signature.
    * @throws
    * java.security.SignatureException when signature generation fails
    */
    public static String calculateRFC2104HMAC(String data, String secret)
    throws java.security.SignatureException
    {
        String result;
        try {

            // get an hmac_sha256 key from the raw secret bytes
            SecretKeySpec signingKey = new SecretKeySpec(secret.getBytes(), HMAC_SHA256_ALGORITHM);

            // get an hmac_sha256 Mac instance and initialize with the signing key
            Mac mac = Mac.getInstance(HMAC_SHA256_ALGORITHM);
            mac.init(signingKey);

            // compute the hmac on input data bytes
            byte[] rawHmac = mac.doFinal(data.getBytes());

            // base64-encode the hmac
            result = DatatypeConverter.printHexBinary(rawHmac).toLowerCase();

        } catch (Exception e) {
            throw new SignatureException("Failed to generate HMAC : " + e.getMessage());
        }
        return result;
    }
}

1.5 Integrate Payments Rainy Day Kit

Use Payments Rainy Day kit to overcome payments exceptions such as:

• Late Authorisation

• Payment Downtime

• Payment Errors

1.6 Verify Payment Status

You can track the payment status in three ways:

• From the Dashboard

  .

• Subscribe to the Webhook Events

  .

• Poll our APIs

  .

Verify Status from Dashboard

To verify the payment status from the Dashboard:

1. Log in to the

   Dashboard

   and navigate to Transactions → Payments.
2. Check if a Payment Id has been generated and note the status. In case of a successful payment, the status is marked as Captured.

Subscribe to Webhook Events

You can use Razorpay webhooks to configure and receive notifications when a specific event occurs. When one of these events is triggered, we send an HTTP POST payload in JSON to the webhook's configured URL. Know how to

Example

If you have subscribed to the order.paid webhook event, you will receive a notification every time a customer pays you for an order.

Poll APIs

Next Steps