General FAQs

PayU provides a test environment that allows you to test your payment integration without processing real payments. You can access the test key/salt and simulate different payment scenarios to ensure that your integration works correctly. For more information, refer to Access Test Merchant Key and Salt.

You can get the Key/Salt details from the PayU Dashboard. After you log in to PayU Dashboard, navigate to Collect Payments> Payment Gateway and scroll down to view the Key/Salt. For more information, refer to Access Test Merchant Key and Salt.

Key/Salt are secret values used to encrypt and decrypt data, while salts are random values added to data before it is encrypted to make it more secure. The role of the key is to encrypt the data, while the salt adds randomness to the data to make it more difficult to crack.

A: If you lose your key/salt, you may not be able to access or decrypt your encrypted data. It is important to keep your Key/Salt secure and backed up in a safe place. If you lose your key/salt, you may need to create a new key/salt and re-encrypt your data.

You can get the Key/Salt details from the PayU Dashboard. After you log in to PayU Dashboard, navigate to Collect Payments> Payment Gateway and scroll down to view the Key/Salt. For the procedure to get the test Key and Salt, refer to Access Production Key and Salt on PayU Dashboard.

No, it is not recommended to share your key/salt with others. Key/Salt are secret values that should only be known by the owner of the data. Sharing Key/Salt can compromise the security of the data.

Cross-Origin Resource Sharing (CORS) is a security feature implemented by web browsers that restrict HTTP requests made across different origins. CORS requires that servers include specific headers in their responses to allow or deny access to client-side JavaScript.

To handle CORS errors, you can add the appropriate headers to your server-side response, such as Access-Control-Allow-Origin or Access-Control-Allow-Methods. You can also use third-party libraries or frameworks to handle CORS, such as CORS middleware in Node.js or Flask-CORS in Python.

No, you can only use your test credentials or Key and Salt from your UAT account. For more information on how to get Key/Salt for Test environment, refer to Access Test Merchant Key and Salt.

If your request parameters are not working, you should check to make sure that they are correctly formatted and that their values are valid. You should also check the documentation for the API or web service you are using to make sure that you are using the correct parameters and values. If you are still having issues, you may need to contact PayU support for assistance.

A “bad request” error message typically indicates that there is something wrong with the request parameters being sent. Double-check that all required parameters are included in the request and that they are in the correct format. Check the API documentation for the specific endpoint being used to ensure that all required parameters are included.

The causes for not receiving a response when posting an API request can be any of the following:

• Check whether your Internet or Broadband connection is working.
• Check that all required parameters are included in the request and that they are in the correct format.
• Check the API documentation for the specific endpoint being used to ensure that the correct HTTP method is being used (e.g., POST vs GET).

An “invalid parameter” error message typically means that one or more of the parameters being sent in the API request is not valid. Check that all parameters are spelled correctly and that they are in the correct format. Also, refer to the API documentation for the specific endpoint being used to ensure that all parameters are being sent correctly.

You need to append “?form=2” with the endpoint to get the response in JSON format. For example, the following endpoints are used for integration APIs such as Verify Payment, Get Transaction Details, Get TDR, Eligible Bins for EMI, Create Invoice, and Get BIN Info APIs:

a:2:{s:6:""status"";i:0;s:3:""msg"";s:21:""Merchant key is empty"";}"

In the cURL request, if there are unwanted spaces in the key, Salt, or with any other parameter’s value, the response is similar to the above. Check and remove the unwanted spaces in the cURL request.

A webhook is an HTTP callback. The callback is done to a URL specified while creating a webhook. The webhook callbacks are event-driven i.e. a callback to a webhook will be done whenever the event associated with the webhook occurs. For example, Successful Payment Webhook – The event associated with this webhook is Successful Payment.

To configure a webhook:

1. Sign in to PayU Dashboard and go to Settings > Webhooks.
2. Create a webhook and enter a publicly accessible HTTPS URL.
3. Select the payment events that your endpoint must receive.
4. Test the webhook and confirm that your endpoint returns a successful HTTP response.
5. Validate the hash in every payload and handle duplicate events idempotently.
   A webhook supplements the browser redirect to surl or furl; it does not replace those URLs.
   For more information, refer to Create a New Webhook and Webhooks.

You can create a webhook using Dashboard or manually:

• Using Dashboard

  To create a webhook, you need to follow these steps:

  1. Log in to your PayU Dashboard.
  2. Navigate to the Settings> Webhook.
  3. Click Create Webhook.
  4. Select any of the following types from the Type drop-down list:
     • Payments
     • Payouts
  5. Select the event type from the Event drop-down list.
  6. Enter the URL where you want to receive the webhook callbacks in the Webhook URL field.
  7. Click Create.

• Manually

  To create webhooks manually during integration with PayU:

  1. Create a server URL from your business server landscape and share it with PayU, along with its server IP address. It is the URL at which the transaction response from PayU will hit. For example, www.test.payu.in/success/response
  2. PayU will configure the merchant’s server URL at its backend, mapping it against the MID and key of that particular merchant.
  3. PayU will whitelist the webhook URL provided by the merchant in its systems. For more information, contact the PayU Integration Team by email: [email protected].

Currently, PayU provides two types of webhook events:

1. When a payment is successful
2. When a payment fails

You can test your webhooks by using the Test Webhook feature available in your PayU Dashboard.

To create a webhook, you will need to create a URL at your server which will be able to receive the callback message that will be sent. Once you have created the URL, you can go to your PayU merchant account -> Settings -> My Account ->Webhook Click on Create New Webhook button.

Yes, you need to whitelist the following IP addresses in your firewall so that the webhooks you had created or configured work:

To use Webhooks during integration with PayU:

1. Create a server URL from your business server landscape and share it with PayU, along with its server IP address. It is the URL at which the transaction response from PayU will hit. For example, www.test.payu.in/success/response
2. PayU will configure the merchant’s server URL at its backend, mapping it against the MID and key of that particular merchant.
3. PayU will whitelist the webhook URL provided by the merchant in its systems. For more information, contact the PayU Integration Team by email: [email protected].

PayU charges fees for processing payments through its gateway, which may vary depending on factors such as transaction volume and payment method. For more information, contact your PayU Key Account Manager (KAM) or customer support.

The UPI option can be unavailable when PayU cannot detect a compatible UPI app on the customer's device. Ask the customer to install or enable a supported UPI app, such as Google Pay, PhonePe, or Paytm, and then retry the payment.
If you control the checkout interface, display a message explaining that a compatible UPI app is required.
For more information, refer to UPI Intent Integration.

NPCI OC190 requirements include UPI Smart Intent, appropriate ordering of UPI apps, and support for applicable QR flows.
PayU handles these requirements on PayU Hosted Checkout. Merchants using a Merchant Hosted or other seamless integration must implement the applicable Smart Intent requirements in their own checkout experience.
For more information, refer to PayU Hosted Checkout and UPI Smart Intent - Non SDK Flow.

To migrate:

1. Update your PayU integration or SDK to a version that supports UPI Intent.
2. Confirm that UPI Intent is enabled for your merchant account.
3. Configure the required UPI Intent request parameters for your web or mobile integration.
4. Test the flow on physical devices with supported UPI apps; simulators cannot complete the app-switch flow reliably.
5. Verify the final transaction status before fulfilling the order.
   For enablement or account configuration, contact your PayU Key Account Manager (KAM).
   For more information, refer to UPI Intent Integration.

Use the applicable EMI checkout-details API to retrieve eligible tenures and the amount breakdown before initiating the payment. The request typically requires the merchant key, transaction amount, relevant bank or offer details, and a hash. Use the returned tenure, interest, and instalment details to display the schedule.
For more information, refer to Get EMI Amount according to Interest API.

PayU maintains test credentials and scenario-specific instructions for cards, UPI IDs, and wallets. Use only the values documented for the PayU test environment; do not use test credentials in production.
For more information, refer to Test Cards, UPI ID and Wallets.

American Express enablement is account-specific and can require additional underwriting, documentation, commercial terms, and acquiring-bank approval. Contact your PayU Key Account Manager (KAM) to confirm eligibility, required documents, and the expected activation timeline.

A dynamic descriptor controls the merchant text that can appear on the customer's card statement. A recognisable descriptor can reduce customer confusion and chargebacks.

Check the following:

• Use the Salt and merchant key for the same environment as the endpoint.
• Follow the documented reverse-hash formula and parameter order exactly.
• Preserve empty fields and additional charges in the formula where required.
• Check UTF-8 and URL-decoding behaviour for special characters.
• Remove unintended spaces or line breaks from parameter values.
• Log the pre-hash string securely and compare it with the expected sequence. Never log the Salt.
  Reject a response when hash validation fails.
  For more information, refer to Generate Hash and Using PayU Hash Verification Tool.

Do not fulfil the order while the payment status is pending. Use the Verify Payment API to retrieve the current status and use webhooks to receive subsequent updates. If you poll, use a bounded retry interval and stop after your business-defined timeout.
Reconcile unresolved transactions before fulfilment. If the status remains pending beyond the normal processing window, raise a PayU support ticket with the transaction ID.
For more information, refer to Verify Payment API and Webhooks.

The available customization depends on the integration:

• PayU Hosted Checkout: Configure supported branding options such as the logo and theme while PayU hosts the payment page.
• Merchant Hosted Checkout: Control the checkout UI and payment-mode presentation on your website, subject to security and PCI-DSS requirements.
• CheckoutPro mobile SDKs: Configure supported themes, colours, fonts, and payment-mode ordering through the SDK.
  For more information, refer to PayU Payment Page Customization and Merchant Hosted Checkout.

Create and configure the offer in PayU Dashboard, then pass the offer identifier required by your integration in the payment request. Validate the offer's dates, eligibility rules, payment modes, and discount configuration before going live. Use the payment response to reconcile the applied discount.
Contact your PayU Key Account Manager (KAM) for enablement or configuration of account-specific and bank-funded offers.
For more information, refer to Offers Integration.

The available control depends on the integration:

• PayU Hosted Checkout: Use the supported parameters to enforce or remove payment categories. Contact your PayU Key Account Manager (KAM) for account-level sequencing options.
• Merchant Hosted Checkout: Retrieve the available payment options and render them in the required order.
• Mobile SDKs: Use the SDK's payment-mode ordering configuration.
  Ordering must comply with applicable NPCI requirements for UPI.
  For more information, refer to Enforce Pay Method or Remove Category.