General Integration
The Server-to-Server integration is performed at the server level, that is, your server (merchant server) and PayU server. The transaction is initiated from your server; hence redirection hop is eliminated. Since the details are captured on your page, customers gain confidence and enhance the checkout experience.
Note: You must be PCI-DSS certified to use Server-to-Server integration. For more information on PCI-DSS certification, contact your Account Manager at PayU.
Experience the end-to-end Merchant Hosted Checkout > Cards flow and instantly generate the complete code for seamless, zero-coding integration into your website.
Integration security
After receiving a response from PayU, you must calculate the hash again and validate it against the hash that you sent in the request to ensure the transaction is secure. PayU recommends implementing the transaction details APIs and webhook/callback as an extra security measure. You can find more information on this process in the Transaction Detail APIs and Webhooks documentation.
You need to ensure that sensitive information related to the integration is not part of the payment request to PayU. The details including — but are not limited to — the following are considered sensitive information:
- Salt value
- plain text hash string
Along with the request, the sensitive information should not be a part of any merchant-level URL. The following are considered sources for the merchant-level URL:
- The last web address accessed by a browser before loading PayU's checkout page.
- URLs shared as part of payment request to PayU in the parameters: surl, furl, curl, nurl, and termUrl.
- Notification URLs configured with the merchant account.
- Invoice Completion URLs configured with the merchant account.
Note: It is important to compare the parameters sent by PayU in the response with the ones you sent in the request to make sure none of them have been changed. You should verify specific parameters such as the transaction ID and amount. PayU is not responsible for any security breaches or losses resulting from your failure to implement the necessary security measures.
Steps to integrate
Step 1: Post the parameters to PayU
The first request from you to PayU with the required transaction mandatory/ optional parameters. This needs to be a server-to-server Curl call request. For the sample request and response, refer to Collect Payment - General Integration .
Environment
| Test Environment | https://test.payu.in/_payment |
| Production Environment | https://secure.payu.in/_payment |
Mandatory Parameters
| Parameter | Description | Example |
|---|---|---|
| key | String Merchant key provided by PayU during onboarding. | |
| txnid | String The transaction ID is a reference number for a specific order that is generated by the merchant. | |
| amount | String The payment amount for the transaction. | |
| productinfo | String A brief description of the product. | |
| firstname | String The first name of the customer. | Ashish |
String The email address of the customer. | ||
| phone | String The phone number of the customer. | |
| pg | String The pg parameter determines which payment tabs will be displayed on the PayU page. For cards, 'CC' will be the value. | CC |
| bankcode | String Each payment option is identified with a unique bank code at PayU. The merchant must post this parameter with the corresponding payment option's bank code value in it. For more information, refer to Card Type Codes and Supported Banks for Cards. | AMEX |
| ccnum | String Use 13-19 digit card number for credit/debit cards (15 digits for AMEX, 13-19 for Maestro) and validate with LUHN algorithm. Refer to Card Number Formats and display error message on invalid input. | 5123456789012346 |
| ccname | String This parameter must contain the name on card – as entered by the customer for the transaction. | Ashish Kumar |
| ccvv | String Use 3-digit CVV number for credit/debit cards and 4-digit security code (4DBC/CID) for AMEX cards. Validate with BIN API. | 123 |
| ccexpmon | String This parameter must contain the card's expiry month – as entered by the user for the transaction. It must always be in 2 digits or in MM format. For months 1-9, this parameter must be appended with 0 – like 01, 02…09. For months 10-12, this parameter must not be appended – It should be 10, 11 and 12 respectively. | 10 |
| ccexpyr | String This parameter must contain the card's expiry year – as entered by the customer for the transaction. It must be of four digits. | 2021 |
| furl | String The success URL, which is the page PayU will redirect to if the transaction is successful. | |
| surl | String The Failure URL, which is the page PayU will redirect to if the transaction is failed. | |
| hash | String It is the hash calculated by the merchant. The hash calculation logic is: SHA-512(key|txnid|amount|productinfo|firstname|email|udf1|udf2|udf3|udf4|udf5||||||Salt) | |
| txn_s2s_flow | String This parameter must be passed with the value as: • 4 for Legacy Decoupled flow. • 3 for Direct Authorization. |
Optional Parameters
| Parameter | Description | Example |
|---|---|---|
| address1 | String The first line of the billing address. For Fraud Detection: This information is helpful when it comes to issues related to fraud detection and chargebacks. Hence, it is must to provide the correct information. | |
| address2 | String The second line of the billing address. | |
| city | String The city where your customer resides as part of the billing address. | |
| state | String The state where your customer resides as part of the billing address. | |
| country | String The country where your customer resides. | |
| zipcode | String Billing address zip code is mandatory for the cardless EMI option. Character Limit - 20 | |
| udf1 | String User Defined Fields (udf) are used to store any information corresponding to a particular transaction. You can use up to five udfs in the post designated as udf1, udf2, udf3, udf4, udf5. | |
| udf2 | String User-defined fields (udf) are used to store any information corresponding to a particular transaction. You can use up to five udfs in the post designated as udf1, udf2, udf3, udf4, udf5. | |
| udf3 | String User-defined fields (udf) are used to store any information corresponding to a particular transaction. | |
| udf4 | String User-defined fields (udf) are used to store any information corresponding to a particular transaction. | |
| udf5 | String User-defined fields (udf) are used to store any information corresponding to a particular transaction. |
curl -X POST "https://test.payu.in/_payment" \
-H "accept: application/json" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "key=JP***g&txnid=tJA4IWme0jIsDw&amount=10.00&firstname=PayU User&[email protected]&phone=9876543210&productinfo=iPhone&pg=cc&bankcode=cc&surl=https://apiplayground-response.herokuapp.com/&furl=https://apiplayground-response.herokuapp.com/&ccnum=5123456789012346&ccexpmon=05&ccexpyr=2022&ccvv=123&ccname=&txn_s2s_flow=4&hash=36b4ab309154a9cbc0a0b9829c086a196cb2edd758b1e918cf7f20fbc1f596f17cc4ba5682eee32317365c99e8b461692595328eea7bb9c6e689bc4b923abe81"import requests
url = "https://test.payu.in/_payment"
headers = {
"accept": "application/json",
"Content-Type": "application/x-www-form-urlencoded"
}
data = {
"key": "JP***g",
"txnid": "tJA4IWme0jIsDw",
"amount": "10.00",
"firstname": "PayU User",
"email": "[email protected]",
"phone": "9876543210",
"productinfo": "iPhone",
"pg": "cc",
"bankcode": "cc",
"surl": "https://apiplayground-response.herokuapp.com/",
"furl": "https://apiplayground-response.herokuapp.com/",
"ccnum": "5123456789012346",
"ccexpmon": "05",
"ccexpyr": "2022",
"ccvv": "123",
"ccname": "",
"txn_s2s_flow": "4",
"hash": "36b4ab309154a9cbc0a0b9829c086a196cb2edd758b1e918cf7f20fbc1f596f17cc4ba5682eee32317365c99e8b461692595328eea7bb9c6e689bc4b923abe81"
}
response = requests.post(url, headers=headers, data=data)
print("Status Code:", response.status_code)
print("Response:", response.text)<?php
$url = "https://test.payu.in/_payment";
$data = array(
'key' => 'JP***g',
'txnid' => 'tJA4IWme0jIsDw',
'amount' => '10.00',
'firstname' => 'PayU User',
'email' => '[email protected]',
'phone' => '9876543210',
'productinfo' => 'iPhone',
'pg' => 'cc',
'bankcode' => 'cc',
'surl' => 'https://apiplayground-response.herokuapp.com/',
'furl' => 'https://apiplayground-response.herokuapp.com/',
'ccnum' => '5123456789012346',
'ccexpmon' => '05',
'ccexpyr' => '2022',
'ccvv' => '123',
'ccname' => '',
'txn_s2s_flow' => '4',
'hash' => '36b4ab309154a9cbc0a0b9829c086a196cb2edd758b1e918cf7f20fbc1f596f17cc4ba5682eee32317365c99e8b461692595328eea7bb9c6e689bc4b923abe81'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'accept: application/json',
'Content-Type: application/x-www-form-urlencoded'
));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$error = curl_error($ch);
curl_close($ch);
if ($error) {
echo "cURL Error: " . $error . "\n";
} else {
echo "Status Code: " . $httpCode . "\n";
echo "Response: " . $response . "\n";
}
?>import java.io.IOException;
import java.net.URI;
import java.net.URLEncoder;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.util.LinkedHashMap;
import java.util.Map;
import java.util.stream.Collectors;
public class PayUCreditCardS2SPayment {
public static void main(String[] args) throws IOException, InterruptedException {
String url = "https://test.payu.in/_payment";
Map<String, String> formData = new LinkedHashMap<>();
formData.put("key", "JP***g");
formData.put("txnid", "tJA4IWme0jIsDw");
formData.put("amount", "10.00");
formData.put("firstname", "PayU User");
formData.put("email", "[email protected]");
formData.put("phone", "9876543210");
formData.put("productinfo", "iPhone");
formData.put("pg", "cc");
formData.put("bankcode", "cc");
formData.put("surl", "https://apiplayground-response.herokuapp.com/");
formData.put("furl", "https://apiplayground-response.herokuapp.com/");
formData.put("ccnum", "5123456789012346");
formData.put("ccexpmon", "05");
formData.put("ccexpyr", "2022");
formData.put("ccvv", "123");
formData.put("ccname", "");
formData.put("txn_s2s_flow", "4");
formData.put("hash", "36b4ab309154a9cbc0a0b9829c086a196cb2edd758b1e918cf7f20fbc1f596f17cc4ba5682eee32317365c99e8b461692595328eea7bb9c6e689bc4b923abe81");
String formBody = formData.entrySet()
.stream()
.map(entry -> URLEncoder.encode(entry.getKey(), StandardCharsets.UTF_8) + "=" +
URLEncoder.encode(entry.getValue(), StandardCharsets.UTF_8))
.collect(Collectors.joining("&"));
HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create(url))
.header("accept", "application/json")
.header("Content-Type", "application/x-www-form-urlencoded")
.POST(HttpRequest.BodyPublishers.ofString(formBody))
.build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println("Status Code: " + response.statusCode());
System.out.println("Response: " + response.body());
}
}using System;
using System.Collections.Generic;
using System.Net.Http;
using System.Threading.Tasks;
class Program
{
static async Task Main(string[] args)
{
var client = new HttpClient();
client.DefaultRequestHeaders.Add("accept", "application/json");
var formData = new FormUrlEncodedContent(new[]
{
new KeyValuePair<string, string>("key", "JP***g"),
new KeyValuePair<string, string>("txnid", "tJA4IWme0jIsDw"),
new KeyValuePair<string, string>("amount", "10.00"),
new KeyValuePair<string, string>("firstname", "PayU User"),
new KeyValuePair<string, string>("email", "[email protected]"),
new KeyValuePair<string, string>("phone", "9876543210"),
new KeyValuePair<string, string>("productinfo", "iPhone"),
new KeyValuePair<string, string>("pg", "cc"),
new KeyValuePair<string, string>("bankcode", "cc"),
new KeyValuePair<string, string>("surl", "https://apiplayground-response.herokuapp.com/"),
new KeyValuePair<string, string>("furl", "https://apiplayground-response.herokuapp.com/"),
new KeyValuePair<string, string>("ccnum", "5123456789012346"),
new KeyValuePair<string, string>("ccexpmon", "05"),
new KeyValuePair<string, string>("ccexpyr", "2022"),
new KeyValuePair<string, string>("ccvv", "123"),
new KeyValuePair<string, string>("ccname", ""),
new KeyValuePair<string, string>("txn_s2s_flow", "4"),
new KeyValuePair<string, string>("hash", "36b4ab309154a9cbc0a0b9829c086a196cb2edd758b1e918cf7f20fbc1f596f17cc4ba5682eee32317365c99e8b461692595328eea7bb9c6e689bc4b923abe81")
});
try
{
var response = await client.PostAsync("https://test.payu.in/_payment", formData);
string responseBody = await response.Content.ReadAsStringAsync();
Console.WriteLine("Status: " + response.StatusCode);
Console.WriteLine("Response: " + responseBody);
}
catch (Exception ex)
{
Console.WriteLine("Error: " + ex.Message);
}
}
}#!/usr/bin/perl
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common qw(POST);
my $url = "https://test.payu.in/_payment";
my $ua = LWP::UserAgent->new;
$ua->timeout(30);
my %data = (
'key' => 'JP***g',
'txnid' => 'tJA4IWme0jIsDw',
'amount' => '10.00',
'firstname' => 'PayU User',
'email' => '[email protected]',
'phone' => '9876543210',
'productinfo' => 'iPhone',
'pg' => 'cc',
'bankcode' => 'cc',
'surl' => 'https://apiplayground-response.herokuapp.com/',
'furl' => 'https://apiplayground-response.herokuapp.com/',
'ccnum' => '5123456789012346',
'ccexpmon' => '05',
'ccexpyr' => '2022',
'ccvv' => '123',
'ccname' => '',
'txn_s2s_flow' => '4',
'hash' => '36b4ab309154a9cbc0a0b9829c086a196cb2edd758b1e918cf7f20fbc1f596f17cc4ba5682eee32317365c99e8b461692595328eea7bb9c6e689bc4b923abe81'
);
my $response = $ua->request(POST $url,
Content_Type => 'application/x-www-form-urlencoded',
Accept => 'application/json',
Content => [%data]
);
if ($response->is_success) {
print "Status Code: " . $response->code . "\n";
print "Response: " . $response->decoded_content . "\n";
} else {
print "Error: " . $response->status_line . "\n";
print "Response: " . $response->decoded_content . "\n";
}Hashing
You must hash the request parameters using the following hash logic:
sha512(key|txnid|amount|productinfo|firstname|email|udf1|udf2|udf3|udf4|udf5||||||SALT)
For more information, refer to Generate Hash.
Step 2: Check response from PayU
Sample response
{
"metaData": {
"message": null,
"referenceId": "2710cd2a20e08a006034861feea27f084a425e94920df9b1856eb6e90793067b",
"statusCode": "E000",
"txnId": "payuTestTransaction2909041",
"unmappedStatus": "captured"
},
"result": {
"mihpayid": "412345678912362515",
"mode": "CC",
"status": "success",
"key": "J****g",
"txnid": "payuTestTransaction2909041",
"amount": "100",
"addedon": "2020-06-09 16:54:26",
"productinfo": "Product Info",
"firstname": "Postman",
"lastname": "",
"address1": "",
"address2": "",
"city": "",
"state": "",
"country": "",
"zipcode": "",
"email": "[email protected]",
"phone": "9123456781",
"udf1": "",
"udf2": "",
"udf3": "",
"udf4": "",
"udf5": "",
"udf6": "",
"udf7": "",
"udf8": "",
"udf9": "",
"udf10": "",
"card_no": "XXXXXXXXXXXX2346",
"field0": "",
"field1": "",
"field2": "",
"field3": "",
"field4": "",
"field5": "NW9WYkV0dzJCclpsMWNRbzg0VVk=",
"field6": "02",
"field7": "AUTHPOSITIVE",
"field8": "",
"field9": "Successful Transaction",
"payment_source": "payuPureS2SAuth",
"PG_TYPE": "CC-PG",
"error": "E000",
"error_Message": "Success",
"unmappedstatus": "captured",
"hash": "df540d8fc8265e9382415993e468cfe0884574ddc617b96053082195752e11e4405888bb96030e749be780805dcf8499241a3c51fb26f978cdb6d328cda2a138",
"bank_ref_num": "",
"bankcode": "CC"
}
}
Next StepsResponse Parameters
Note: The response contains a combination of the following JSON objects (metaData, result, and binData) based on the use case used in S2S, and the fields in each of them are described in the following tables.
Collect the response in the Collect Payment API - Server-to-Server under API Reference. The response for the S2S payment request is not similar to Merchant Hosted or PayU Hosted Checkout. For description of response parameters, refer to Additional Info for Payment APIs.
Step 3. Verify the payment
Upon receiving the response, PayU recommends you performing a reconciliation step to validate all transaction details.
You can verify your payments using either of the following methods:
Configure the webhooks to monitor the status of payments.
Webhooks enable a server to communicate with another server by sending an HTTP callback or message.
These callbacks are triggered by specific events or instances and operate at the server-to-server (S2S) level.
Know how to manage Webhooks for Payments.
Environment
| Test Environment | https://test.payu.in/merchant/postservice.php?form=2 |
| Production Environment | https://info.payu.in/merchant/postservice.php?form=2 |
Note: The hash logic for Verify Payment API is:
sha512(key|command|var1|salt) sha512
Sample request
curl --request POST
--url 'https://test.payu.in/merchant/postservice?form=2'
--header 'Content-Type: application/x-www-form-urlencoded'
--data key=JPM7Fg
--data command=verify_payment
--data var1=IhfgcZnXR4o4nB
--data hash=a0ae79fdd66c875af6e9b21c4a67f1822deb00f2df5e9f0b1948f3222f536a9bf741b24efbb1874ca0f84f76b036e6c0d641581d0100f7abe4aeed2f3264f5c9
Sample response
If credit card payment is made, the response is similar to the following:
{
"status":0,
"msg":"0 out of 1 Transactions Fetched Successfully",
"transaction_details":
{
"IhfgcZnXR4o4nB":
{
"mihpayid":"Not Found",
"status":"Not Found"
}
}
}If txnID is not found, the response is similar to the following:
{
"status":0,
"msg":"0 out of 1 Transactions Fetched Successfully",
"transaction_details":
{
"IhfgcZnXR4o4nB":
{
"mihpayid":"Not Found",
"status":"Not Found"
}
}
}Response parameters
| Parameter | Description | Example |
|---|---|---|
| status | This parameter returns the status of web service call. The status can be any of the following:
| 0 |
| msg | This parameter returns the reason string. | For example, any of the following messages are displayed:
|
| transaction_details | This parameter contains the response in a JSON format. For more information refer to JSON fields description for transaction_details parameter . | |
| request_id | PayU Request ID for a request in a Transaction. For example, a transaction can have a refund request. | 7800456 |
| bank_ref_num | This parameter returns the bank reference number. If the bank provides after a successful action. | 204519474956 |
To learn more about the possible error codes and their description, refer to Error Codes.
Updated about 2 hours ago
