Razorpay Integration in PHP and Node.js: Complete Guide

1. The customer clicks "Pay" on your site.
2. Your server calls the Razorpay Orders API and gets an order_id.
3. Your server sends the order_id and your public key_id to the browser.
4. The browser opens Razorpay Checkout with those values.
5. The customer pays inside Razorpay's window.
6. Checkout returns payment_id, order_id and signature to your page.
7. Your server VERIFIES the signature with your key secret.
8. Your server marks the order paid and delivers the product.
9. Razorpay also sends a webhook; your server verifies it and marks
   the order paid if it isn't already.

RAZORPAY_KEY_ID=rzp_test_xxxxxxxxxxxx
RAZORPAY_KEY_SECRET=xxxxxxxxxxxxxxxxxxxx
RAZORPAY_WEBHOOK_SECRET=set-this-when-you-add-the-webhook

composer require razorpay/razorpay

<?php
require __DIR__ . '/vendor/autoload.php';
$config = require '/home/youruser/private/razorpay.php'; // returns an array
use Razorpay\Api\Api;

$api = new Api($config['key_id'], $config['key_secret']);

// Take the amount from YOUR database, never from the browser.
$amountPaise = 50000; // ₹500.00

$order = $api->order->create([
    'receipt'  => 'rcpt_' . bin2hex(random_bytes(6)),
    'amount'   => $amountPaise,
    'currency' => 'INR',
]);

// Save $order->id against the customer's cart in your database here.

header('Content-Type: application/json');
echo json_encode([
    'order_id' => $order->id,
    'key_id'   => $config['key_id'],
    'amount'   => $amountPaise,
]);

<?php
function razorpay_post(string $path, array $body, array $config): array
{
    $auth = base64_encode($config['key_id'] . ':' . $config['key_secret']);
    $ctx  = stream_context_create(['http' => [
        'method'        => 'POST',
        'header'        => "Authorization: Basic $auth\r\nContent-Type: application/json\r\n",
        'content'       => json_encode($body),
        'timeout'       => 20,
        'ignore_errors' => true, // read Razorpay's error body too
    ]]);
    $raw = file_get_contents('https://api.razorpay.com/v1' . $path, false, $ctx);
    $status = isset($http_response_header[0]) ? (int) explode(' ', $http_response_header[0])[1] : 0;
    if ($raw === false || $status < 200 || $status >= 300) {
        throw new RuntimeException('Razorpay API error ' . $status . ': ' . $raw);
    }
    return json_decode($raw, true);
}

$order = razorpay_post('/orders', [
    'amount' => 50000, 'currency' => 'INR', 'receipt' => 'rcpt_123',
], $config);

<script src="https://checkout.razorpay.com/v1/checkout.js"></script>
<button id="pay-btn">Pay ₹500</button>
<script>
document.getElementById('pay-btn').addEventListener('click', async () => {
  const data = await (await fetch('/create-order.php', { method: 'POST' })).json();
  new Razorpay({
    key: data.key_id,
    amount: data.amount,
    currency: 'INR',
    name: 'Your Company',
    order_id: data.order_id,
    handler: async (response) => {
      // razorpay_payment_id, razorpay_order_id, razorpay_signature
      const r = await fetch('/verify-payment.php', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(response),
      });
      const result = await r.json();
      alert(result.verified ? 'Payment received. Thank you!' : 'We could not confirm the payment yet.');
    },
  }).open();
});
</script>

<?php
$config = require '/home/youruser/private/razorpay.php';
$in = json_decode(file_get_contents('php://input'), true) ?: [];

$orderId   = (string) ($in['razorpay_order_id'] ?? '');
$paymentId = (string) ($in['razorpay_payment_id'] ?? '');
$signature = (string) ($in['razorpay_signature'] ?? '');

// The order must be one YOU created for this customer and is still unpaid.
// if (!orderBelongsToCurrentCart($orderId)) { http_response_code(400); exit; }

$expected = hash_hmac('sha256', $orderId . '|' . $paymentId, $config['key_secret']);

header('Content-Type: application/json');
if ($signature !== '' && hash_equals($expected, $signature)) {
    markOrderPaid($orderId, $paymentId); // idempotent
    echo json_encode(['verified' => true]);
} else {
    http_response_code(400);
    echo json_encode(['verified' => false]);
}

import crypto from 'node:crypto';

function safeEqualHex(a, b) {
  const x = Buffer.from(a, 'utf8');
  const y = Buffer.from(String(b || ''), 'utf8');
  return x.length === y.length && crypto.timingSafeEqual(x, y);
}

app.post('/verify-payment', express.json(), (req, res) => {
  const { razorpay_order_id, razorpay_payment_id, razorpay_signature } = req.body;
  const expected = crypto
    .createHmac('sha256', process.env.RAZORPAY_KEY_SECRET)
    .update(`${razorpay_order_id}|${razorpay_payment_id}`)
    .digest('hex');

  if (safeEqualHex(expected, razorpay_signature)) {
    markOrderPaid(razorpay_order_id, razorpay_payment_id); // idempotent
    return res.json({ verified: true });
  }
  res.status(400).json({ verified: false });
});

<?php
$config    = require '/home/youruser/private/razorpay.php';
$payload   = file_get_contents('php://input');           // raw body
$signature = $_SERVER['HTTP_X_RAZORPAY_SIGNATURE'] ?? '';
$expected  = hash_hmac('sha256', $payload, $config['webhook_secret']);

if ($signature === '' || !hash_equals($expected, $signature)) {
    http_response_code(400);
    exit('invalid signature');
}

$event = json_decode($payload, true);
if ($event['event'] === 'payment.captured') {
    $p = $event['payload']['payment']['entity'];
    markOrderPaid($p['order_id'], $p['id']); // safe to call twice
}
http_response_code(200);
echo 'ok';

app.post('/webhooks/razorpay', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = crypto
    .createHmac('sha256', process.env.RAZORPAY_WEBHOOK_SECRET)
    .update(req.body) // Buffer
    .digest('hex');
  if (!safeEqualHex(expected, req.headers['x-razorpay-signature'])) {
    return res.status(400).send('invalid signature');
  }
  const event = JSON.parse(req.body.toString());
  if (event.event === 'payment.captured') {
    const p = event.payload.payment.entity;
    markOrderPaid(p.order_id, p.id);
  }
  res.status(200).send('ok');
});