1. User clicks "Pay" on your site.
2. Your server calls Razorpay Orders API → gets order_id.
3. Your server returns (order_id, public key_id) to the browser.
4. Browser loads Razorpay Checkout with those values.
5. User completes payment inside Razorpay's modal.
6. Razorpay redirects back with (payment_id, order_id, signature).
7. Your server VERIFIES the signature against your key_secret.
8. Server marks the order paid, provisions service, emails the user.
9. (Redundancy) Razorpay also fires a webhook. Server verifies + marks paid if not already.

RAZORPAY_KEY_ID=rzp_test_xxxxxxxxxxxx
RAZORPAY_KEY_SECRET=xxxxxxxxxxxxxxxxx
RAZORPAY_WEBHOOK_SECRET=           # set this when you configure webhooks later

composer require razorpay/razorpay

<?php
require __DIR__ . '/vendor/autoload.php';
use Razorpay\Api\Api;

$api = new Api($_ENV['RAZORPAY_KEY_ID'], $_ENV['RAZORPAY_KEY_SECRET']);

$order = $api->order->create([
    'receipt'  => 'rcpt_' . uniqid(),
    'amount'   => 50000,                // in paise — ₹500.00
    'currency' => 'INR',
    'notes'    => [
        'customer_email' => '[email protected]',
        'product'        => 'Domain Renewal (.com, 1 year)',
    ],
]);

// Persist the order_id in your DB linked to the user + cart.
// Then return payment config to the browser:

header('Content-Type: application/json');
echo json_encode([
    'order_id' => $order->id,
    'key_id'   => $_ENV['RAZORPAY_KEY_ID'],
    'amount'   => 50000,
    'name'     => 'Your Company',
    'email'    => '[email protected]',
]);

<script src="https://checkout.razorpay.com/v1/checkout.js"></script>
<button id="pay-btn">Pay ₹500</button>

<script>
document.getElementById('pay-btn').addEventListener('click', async () => {
  const res = await fetch('/create-order.php', { method: 'POST' });
  const data = await res.json();

  const options = {
    key:       data.key_id,
    amount:    data.amount,
    currency:  'INR',
    name:      'Your Company',
    description: 'Domain Renewal',
    order_id:  data.order_id,
    prefill:   { name: data.name, email: data.email },
    handler:   async function (response) {
      // response contains: razorpay_payment_id, razorpay_order_id, razorpay_signature
      const verifyRes = await fetch('/verify-payment.php', {
        method:  'POST',
        headers: { 'Content-Type': 'application/json' },
        body:    JSON.stringify(response),
      });
      const result = await verifyRes.json();
      if (result.verified) alert('Payment successful! Your order is confirmed.');
      else alert('Payment verification failed. Contact support.');
    },
    theme: { color: '#0a75ff' },
  };
  new Razorpay(options).open();
});
</script>

<?php
require __DIR__ . '/vendor/autoload.php';
use Razorpay\Api\Api;
use Razorpay\Api\Errors\SignatureVerificationError;

$input = json_decode(file_get_contents('php://input'), true);

$api = new Api($_ENV['RAZORPAY_KEY_ID'], $_ENV['RAZORPAY_KEY_SECRET']);

try {
    $api->utility->verifyPaymentSignature([
        'razorpay_order_id'   => $input['razorpay_order_id'],
        'razorpay_payment_id' => $input['razorpay_payment_id'],
        'razorpay_signature'  => $input['razorpay_signature'],
    ]);

    // Signature is valid. Mark order paid in YOUR database.
    markOrderPaid($input['razorpay_order_id'], $input['razorpay_payment_id']);

    header('Content-Type: application/json');
    echo json_encode(['verified' => true]);
} catch (SignatureVerificationError $e) {
    http_response_code(400);
    header('Content-Type: application/json');
    echo json_encode(['verified' => false, 'error' => 'Invalid signature']);
}

npm install razorpay

import Razorpay from 'razorpay';

const razorpay = new Razorpay({
  key_id:     process.env.RAZORPAY_KEY_ID,
  key_secret: process.env.RAZORPAY_KEY_SECRET,
});

app.post('/create-order', async (req, res) => {
  const order = await razorpay.orders.create({
    amount:   50000,          // paise
    currency: 'INR',
    receipt:  `rcpt_${Date.now()}`,
    notes:    { customer_email: req.user.email },
  });

  res.json({
    order_id: order.id,
    key_id:   process.env.RAZORPAY_KEY_ID,
    amount:   order.amount,
  });
});

import crypto from 'crypto';

app.post('/verify-payment', express.json(), (req, res) => {
  const { razorpay_order_id, razorpay_payment_id, razorpay_signature } = req.body;

  const expected = crypto
    .createHmac('sha256', process.env.RAZORPAY_KEY_SECRET)
    .update(`${razorpay_order_id}|${razorpay_payment_id}`)
    .digest('hex');

  const valid = crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(razorpay_signature)
  );

  if (valid) {
    markOrderPaid(razorpay_order_id, razorpay_payment_id);
    res.json({ verified: true });
  } else {
    res.status(400).json({ verified: false, error: 'Invalid signature' });
  }
});

<?php
$payload   = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_RAZORPAY_SIGNATURE'] ?? '';

$expected = hash_hmac('sha256', $payload, $_ENV['RAZORPAY_WEBHOOK_SECRET']);

if (!hash_equals($expected, $signature)) {
    http_response_code(400);
    exit('invalid signature');
}

$event = json_decode($payload, true);

switch ($event['event']) {
    case 'payment.captured':
        $paymentId = $event['payload']['payment']['entity']['id'];
        $orderId   = $event['payload']['payment']['entity']['order_id'];
        markOrderPaid($orderId, $paymentId);   // idempotent — check if already paid
        break;

    case 'payment.failed':
        $orderId = $event['payload']['payment']['entity']['order_id'];
        $reason  = $event['payload']['payment']['entity']['error_description'] ?? 'unknown';
        markOrderFailed($orderId, $reason);
        break;

    case 'refund.processed':
        $refund = $event['payload']['refund']['entity'];
        markRefundComplete($refund['payment_id'], $refund['amount']);
        break;
}

http_response_code(200);
echo 'ok';

import crypto from 'crypto';

// IMPORTANT: use raw body middleware, NOT express.json(), for the webhook route.
// The signature is computed over the raw JSON string.
app.post('/webhooks/razorpay',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const payload   = req.body;                              // Buffer
    const signature = req.headers['x-razorpay-signature'];

    const expected = crypto
      .createHmac('sha256', process.env.RAZORPAY_WEBHOOK_SECRET)
      .update(payload)
      .digest('hex');

    const valid = crypto.timingSafeEqual(
      Buffer.from(expected),
      Buffer.from(signature)
    );

    if (!valid) return res.status(400).send('invalid signature');

    const event = JSON.parse(payload.toString());

    switch (event.event) {
      case 'payment.captured':
        markOrderPaid(
          event.payload.payment.entity.order_id,
          event.payload.payment.entity.id,
        );
        break;
      case 'payment.failed':
        markOrderFailed(
          event.payload.payment.entity.order_id,
          event.payload.payment.entity.error_description,
        );
        break;
      // ... other events
    }

    res.status(200).send('ok');
  }
);