API Docs

Kaise kaam karta hai

1. Aapka server create-order API call karta hai (amount ke saath).
2. Hum payment_url dete hain. Customer ko wahan bhejo (ya qr_image khud dikhao).
3. Customer kisi bhi UPI app se pay karta hai. Paisa seedha aapke Paytm me.
4. Payment confirm hote hi hum aapke Webhook URL par POST bhejte hain, aur customer ko redirect_url par wapas bhejte hain.
5. Order tabhi complete maano jab webhook aaye ya check-status API SUCCESS bataye. Sirf redirect par bharosa mat karo.

Base URL: https://yourdomain.in/api/
Auth: har request me header X-API-Key: AAPKI_API_KEY (Dashboard > API & Webhook)

1. Order banao: POST /api/create-order.php

Field	Zaroori	Matlab
amount	Haan	₹1 se ₹1,00,000. Jaise 499 ya 499.50
client_ref	Nahi	Aapka apna order number (A-Z 0-9 _ - .). Same ref dobara bhejoge to chalta hua order hi wapas milega.
redirect_url	Nahi	Payment ke baad customer yahan jayega (?order_id=..&client_ref=.. jud kar)
note	Nahi	UPI app me dikhne wala note (max 50)

curl -X POST https://yourdomain.in/api/create-order.php \
  -H "X-API-Key: AAPKI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"amount":"499","client_ref":"INV1001","redirect_url":"https://yoursite.in/thank-you.php"}'

Jawab:

{
  "success": true,
  "order_id": "ABP123456789012",
  "client_ref": "INV1001",
  "amount": "499.00",
  "status": "PENDING",
  "payment_url": "https://yourdomain.in/pay.php?o=ABP123456789012",
  "upi_link": "upi://pay?pa=...",
  "qr_image": "https://api.qrserver.com/...",
  "expires_at": "2026-10-25 22:10:00"
}

Galti par: {"success": false, "error": "..."} aur HTTP code 400/401/402/403/429.

2. Status dekho: POST /api/check-status.php

Body me order_id (ya client_ref). Status: PENDING, SUCCESS, EXPIRED.

curl -X POST https://yourdomain.in/api/check-status.php \
  -H "X-API-Key: AAPKI_API_KEY" \
  -d "order_id=ABP123456789012"

{ "success": true, "order_id": "...", "client_ref": "INV1001", "amount": "499.00",
  "status": "SUCCESS", "utr": "430212345678", "created_at": "...", "paid_at": "..." }

3. Webhook

Payment success par hum aapke Webhook URL par JSON POST karte hain. Header X-Signature = HMAC-SHA256(body, webhook_secret). Fail hone par 5 baar tak dobara bhejte hain, isliye ek hi order do baar aa sakta hai. Apni taraf se order ko ek hi baar complete karna.

{ "event": "payment.success", "order_id": "...", "client_ref": "INV1001",
  "amount": "499.00", "status": "SUCCESS", "utr": "430212345678", "paid_at": "2026-10-25 21:58:10" }

PHP example (copy-paste)

checkout.php: order banao aur customer ko payment page par bhejo

<?php
$apiKey = 'AAPKI_API_KEY';
$ch = curl_init('https://yourdomain.in/api/create-order.php');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['X-API-Key: ' . $apiKey, 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'amount'       => '499',
        'client_ref'   => 'INV1001',          // aapka order number
        'redirect_url' => 'https://yoursite.in/thank-you.php',
    ]),
]);
$res = json_decode(curl_exec($ch), true);
curl_close($ch);

if (!empty($res['success'])) {
    // order_id apne database me save kar lo
    header('Location: ' . $res['payment_url']);
    exit;
}
echo 'Error: ' . ($res['error'] ?? 'unknown');

payment-webhook.php: payment confirm hone par

<?php
$secret = 'AAPKA_WEBHOOK_SECRET';
$body = file_get_contents('php://input');
$sig  = $_SERVER['HTTP_X_SIGNATURE'] ?? '';

if (!hash_equals(hash_hmac('sha256', $body, $secret), $sig)) {
    http_response_code(401);
    exit('bad signature');
}
$data = json_decode($body, true);

if (($data['status'] ?? '') === 'SUCCESS') {
    $ref    = $data['client_ref'];   // aapka order number
    $amount = $data['amount'];
    // 1) apne DB me order dhundho, 2) amount match karo,
    // 3) agar pehle se paid nahi hai to "paid" mark karo (dobara aaye to ignore)
}
http_response_code(200);
echo 'OK';

thank-you.php: redirect par sirf "check ho raha hai" dikhao, aur pakka status check-status API ya webhook se lo.