UPI Payment Integration for Indian Businesses — PhonePe, Paytm, Razorpay UPI Intent

use Razorpay\Api\Api;

$api = new Api(getenv('RAZORPAY_KEY_ID'), getenv('RAZORPAY_KEY_SECRET'));

$order = $api->order->create([
    'receipt'  => 'order_' . time(),
    'amount'   => 50000,             // ₹500 in paise
    'currency' => 'INR',
    'notes'    => ['user_id' => 42],
]);

echo json_encode([
    'orderId' => $order['id'],
    'key'     => getenv('RAZORPAY_KEY_ID'),
]);

const Razorpay = require('razorpay');
const rzp = new Razorpay({
  key_id: process.env.RAZORPAY_KEY_ID,
  key_secret: process.env.RAZORPAY_KEY_SECRET,
});

app.post('/api/order', async (req, res) => {
  const order = await rzp.orders.create({
    amount: 50000,           // paise
    currency: 'INR',
    receipt: `order_${Date.now()}`,
    notes: { userId: req.user.id },
  });
  res.json({ orderId: order.id, key: process.env.RAZORPAY_KEY_ID });
});

<script src="https://checkout.razorpay.com/v1/checkout.js"></script>

<button onclick="pay()">Pay ₹500</button>

<script>
async function pay() {
  const { orderId, key } = await (await fetch('/api/order', { method: 'POST' })).json();

  new Razorpay({
    key,
    order_id: orderId,
    amount: 50000,
    currency: 'INR',
    name: 'Your Company',
    description: 'Order #1234',
    prefill: {
      name: 'Rajesh Kumar',
      email: '[email protected]',
      contact: '9876543210',
    },
    method: {
      upi: true,          // show UPI prominently
      card: true,
      netbanking: true,
      wallet: true,
    },
    handler: async (response) => {
      // response: { razorpay_payment_id, razorpay_order_id, razorpay_signature }
      const verified = await fetch('/api/verify', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(response),
      });
      if (verified.ok) window.location = '/success';
      else alert('Payment verification failed');
    },
    theme: { color: '#0f172a' },
  }).open();
}
</script>

// The checkout handler above sends JSON, so read the raw body
$in = json_decode(file_get_contents('php://input'), true) ?? [];

$attributes = [
    'razorpay_order_id'   => $in['razorpay_order_id'] ?? '',
    'razorpay_payment_id' => $in['razorpay_payment_id'] ?? '',
    'razorpay_signature'  => $in['razorpay_signature'] ?? '',
];

try {
    $api->utility->verifyPaymentSignature($attributes);
    // Signature valid — mark order paid in DB
    markOrderPaid($attributes['razorpay_order_id'], $attributes['razorpay_payment_id']);
} catch (Razorpay\Api\Errors\SignatureVerificationError $e) {
    http_response_code(400);
    echo 'Invalid signature';
}

const crypto = require('crypto');

app.post('/api/verify', async (req, res) => {
  const { razorpay_order_id, razorpay_payment_id, razorpay_signature } = req.body;
  const expected = crypto
    .createHmac('sha256', process.env.RAZORPAY_KEY_SECRET)
    .update(`${razorpay_order_id}|${razorpay_payment_id}`)
    .digest('hex');

  const ok = expected.length === razorpay_signature?.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(razorpay_signature));
  if (!ok) {
    return res.status(400).send('Invalid signature');
  }
  // Mark paid
  await db.order.update({ where: { id: razorpay_order_id }, data: { status: 'paid' } });
  res.json({ ok: true });
});

app.post('/webhook/razorpay',
  express.raw({ type: 'application/json' }),  // must be raw for signature
  async (req, res) => {
    const sig = req.headers['x-razorpay-signature'];
    const expected = crypto
      .createHmac('sha256', process.env.RAZORPAY_WEBHOOK_SECRET)
      .update(req.body)
      .digest('hex');

    if (!sig || sig.length !== expected.length ||
        !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig))) {
      return res.status(400).send('Invalid');
    }

    const event = JSON.parse(req.body);
    if (event.event === 'payment.captured') {
      const p = event.payload.payment.entity;
      await markOrderPaid(p.order_id, p.id, p.amount);
    }
    res.json({ ok: true });
  }
);

upi://pay?pa=yourname@hdfcbank&pn=Your%20Name&am=500&cu=INR&tn=Invoice+1234

import qrcode

data = "upi://pay?pa=yourname@hdfcbank&pn=Your%20Name&am=500&cu=INR&tn=Invoice+1234"
img = qrcode.make(data)
img.save('upi-qr.png')

// Create subscription
const sub = await rzp.subscriptions.create({
  plan_id: 'plan_XXX',
  customer_notify: 1,
  total_count: 12,    // monthly × 12
  notes: { userId: 42 },
});

await rzp.payments.refund(payment_id, {
  speed: 'normal',   // or 'optimum' for faster
});

await rzp.payments.refund(payment_id, {
  amount: 20000,    // refund ₹200 from ₹500 payment
});