Classic Integration for Cards - OTP Integration

The Server-to-Server (S2S) integration for cards allows merchants to securely process card transactions using PayU’s classic integration method. This document describes the step-by-step process to integrate and handle card submissions, OTP verification, and transaction responses.

1. Initiate Payment Request with PayU
   • The merchant sends a payment request to PayU with necessary parameters such as transaction details, customer information, and surl/furl URLs for redirection after processing.
   • The transaction parameters must comply with the PayU Classic Integration. For more information, refer to Cards Classic Integration.

📘

Reference:

This integration is supported for Cards, Network Tokens, Payu token based integrations. For more details how to pass the network token and payu token, refer to Collect Payments using a Saved Card.Handle the OTP Flow or Redirect the Customer

2. • After receiving PayU’s response to the initiate payment request (Step 1), merchants can choose one of the below paths based on the response conditions:
   • Collect and submit the OTP using the Native Submit OTP API.
   • Redirect the customer to the Bank Page for OTP entry if required.

Step 1: Initiate Payment request with PayU

The merchant initiates PayU with the required transaction mandatory or optional parameters. This needs to be a server-to-server cURL call request. URL, parameters, and descriptions. For more information, refer to . Collect the response in the  under API Reference. The response for the S2S payment request is not similar to Merchant Hosted or PayU Hosted Checkout. For description of response parameters, refer to Additional Info for Payment APIs.

Environment

Request parameters

Hashing

You must hash the request parameters using the following hash logic:

sha512(key|txnid|amount|productinfo|firstname|email|udf1|udf2|udf3|udf4|udf5||||||SALT)

Sample request

HTML form

Generate a payment form with all the required parameters. This can be an HTML form or a server-side request. Here’s an example of an HTML form:

<form action="https://test.payu.in/_payment" method="post">
    <input type="hidden" name="key" value="your_merchant_key" />
    <input type="hidden" name="txnid" value="unique_transaction_id" />
    <input type="hidden" name="amount" value="100.00" />
    <input type="hidden" name="productinfo" value="Product Description" />
    <input type="hidden" name="firstname" value="Customer Name" />
    <input type="hidden" name="email" value="[email protected]" />
    <input type="hidden" name="phone" value="9999999999" />
    <input type="hidden" name="surl" value="https://your-website.com/success" />
    <input type="hidden" name="furl" value="https://your-website.com/failure" />
    <input type="hidden" name="hash" value="calculated_hash_value" />
    <input type="hidden" name="txn_s2s_flow" value="3" />
    <input type="submit" value="Pay Now" />
</form>

cURL

curl --location --request POST 'https://secure.payu.in/_payment' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data 'key=JP***g' \
--data 'txnid=payuTestTransaction3818940' \
--data 'amount=1.0' \
--data 'firstname=Ashish' \
--data '[email protected]' \
--data 'phone=9988776655' \
--data 'productinfo=Product Info' \
--data 'surl=https://admin.payu.in/test_response' \
--data 'furl=https://admin.payu.in/test_response' \
--data 'notifyurl=https://admin.payu.in/test_response' \
--data 'codurl=https://admin.payu.in/test_response' \
--data 'ipurl=https://admin.payu.in/test_response' \
--data 'lastname=' \
--data 'udf1=' \
--data 'udf2=' \
--data 'udf3=' \
--data 'udf4=' \
--data 'udf5=' \
--data 'pg=CC' \
--data 'bankcode=DC' \
--data 'ccnum=XXXXXXXXXXX8811' \
--data 'ccname=Ashish' \
--data 'ccvv=XXX' \
--data 'ccexpmon=12' \
--data 'ccexpyr=2023' \
--data 'authorization_flow=REDIRECT' \
 --data 'hash=d89e7d88863617baf01e504c50aa58e94d6ff3371c2ed409ca1f139cfee75d67e85ce7e91c4224790b6cc1b59bb149fc98b0272e27b335225a9d288a34290e42' \
--data 'txn_s2s_flow=4'

Response parameters

Sample Responses

📘

Notes:

• Reverse hashing: To validate the response from PayU, calculate the following hash and compare it with the hash received in the response:
  sha512(SALT|status||||||udf5|udf4|udf3|udf2|udf1|email|firstname|productinfo|amount|txnid|key)
• Handling errors: For handling errors, refer to Error Codes.

Response When Native Submit OTP is Supported

{
"metaData": {
"txnId": "payuTestTransaction3818940",
"txnStatus": "Enrolled",
"unmappedStatus": "pending",
...
},
"result": {
"acsTemplate": "Base64_encoded_HTML_form_string"
},
"binData": {
"pureS2SSupported": true,
"issuingBank": "UBI",
"category": "debitcard",
"cardType": "VISA",
"isDomestic": true
}
}

Response When Native Submit OTP is NOT Supported

{
"metaData": {
"txnId": "payuTestTransaction3818940",
"txnStatus": "Enrolled",
"unmappedStatus": "pending",
...
},
"result": {
"acsTemplate": "Base64_encoded_HTML_form_string"
},
"binData": {
"pureS2SSupported": false,
"issuingBank": "UBI",
"category": "debitcard",
"cardType": "VISA",
"isDomestic": true
}
}

Step 2: Handle OTP or Redirect customer

When Native Submit OTP is Supported

If the response from Step 1 contains the parameters: - metaData.unmappedStatus = pending - binData.pureS2SSupported = true

curl --location --request POST 'https://test.payu.in/ResponseHandler.php' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Cookie: PHPSESSID=ef4510abes5uo7ephv7o20ossc; PHPSESSID=63fefa045789a' \
--data-urlencode 'referenceId=42df570fa8c4d9de6209a71970acb661' \
--data-urlencode 'otp=725356' \
--data-urlencode 'consent=0'

Then, the following actions should be taken:

1. Collect the OTP from the customer.
2. Submit the OTP to PayU using the Submit OTP API.

When Native Submit OTP is NOT Supported

If the metaData object of the response contains:

• mappedStatus = pending
• pureS2SSupported = false.

The following actions should be performed:

1. Decode result.acsTemplate from the response using Base64 decoding.
2. Generate the HTML form from the decoded template.
3. Redirect the customer to the Bank Page to enter the OTP.

Example code to decode and display the ACS template:

// Decode base64 encoded acsTemplate
const decodedTemplate = atob(acsTemplate);
// Create a container for the template
document.getElementById('acs-container').innerHTML = decodedTemplate;

Associated Actions on the OTP Page

When collecting the OTP on your page, you must provide the following functionality to the customer:

• Resend OTP: Enable customers to request another OTP using the Resend OTP API.

• Redirect to Bank Page: If merchants decide to redirect the customer, decode the acsTemplate and redirect them to the bank for transaction completion.

  Ensure you decode the acsTemplate to redirect the customer to the proper bank interface.

Verify the Transaction

After completing the payment flow, verify the transaction status using the Verify Payment API. For more information, refer to Verify Payment API.

curl --location 'https://test.payu.in/merchant/postservice.php?form=2' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'key=JP***g' \
--data-urlencode 'command=verify_payment' \
--data-urlencode 'var1=IhfgcZnXR4o4nB' \
--data-urlencode 'hash=a0ae79fdd66c875af6e9b21c4a67f1822deb00f2df5e9f0b1948f3222f536a9bf741b24efbb1874ca0f84f76b036e6c0d641581d0100f7abe4aeed2f3264f5c9'

Alternatively, implement PayU’s webhooks to receive real-time payment status updates. For more information, refer to Payment Webhooks.