PayU Hosted Integration

The pre_authorize parameter is used to pre-authorize payments using the PayU Hosted Checkout integration with the _payment API.

👍
Experience the end-to-end Pre-Authorize Payments flow and instantly generate the complete code for seamless, zero-coding integration into your website.

📘
Note: You need to activate the Pre-Authorize Payments before you start using this integration. Contact your PayU Key Account Manager (KAM) to activate Pre-Authorize Payments.

1. Post the Pre-Auth Transaction Request

Submit pre-authorization payment request to PayU's _payment API with mandatory parameters including merchant key, transaction details, customer information, and pre_authorize parameter set to 1

2. Check the Response from PayU

Validate PayU's response using reverse hash calculation, verify transaction status, unmappedstatus for pre-authorization confirmation, and other key response parameters

3. Capture a Pre-Authorized Payment

Use capture_transaction command with merchant key, hash, and transaction ID to settle pre-authorized payments when ready for final processing

4. Check Action Status

Verify and reconcile transaction details using webhooks for real-time monitoring or Verify Payment API to check unmappedstatus and ensure accurate capture processing

Step 1: Post the pre-auth transaction request

The pre_authorize parameter as specified is used to pre-authorize payments using the PayU Hosted Checkout integration with the _payment API. For Try-It experience, refer to Pre-Authorize Payment for the complete list parameters with Try It experience.

Environment


Test Environment	https://test.payu.in/_payment>
Production Environment	https://secure.payu.in/_payment>

Hashing

You must hash the request parameters using the following hash logic:

sha512(key|txnid|amount|productinfo|firstname|email|udf1|udf2|udf3|udf4|udf5||||||SALT)

For more information, refer to Generate Hash.

Mandatory Parameters

Parameter	Description	Example
key	String The merchant key provided by PayU while onboarding.	JP***g
txnid	String The transaction ID is a reference number for a specific order that is generated by the merchant.	ypl938459435
amount mandatory	String The payment amount for the transaction.	10.00
productinfo mandatory	String A brief description of the product.	iPhone
firstname mandatory	String The first name of the customer.	Ashish
email mandatory	String The email address of the customer.	[email protected]
phone mandatory	String The phone number of the customer.
surl mandatory	String The success URL, which is the page PayU will redirect to if the transaction is successful.	https://test-payment-middleware.payu.in/simulatorResponse
furl mandatory	String The Failure URL, which is the page PayU will redirect to if the transaction is failed.	https://test-payment-middleware.payu.in/simulatorResponse
pre_authorize mandatory for Pre-Auth	String This parameter is set to 1 to pre-authorize payment using PayU Hosted Checkout.
hash	String It is the hash calculated by the merchant. Reference: For detailed information on hashing, refer to Generate Hash.

Optional Parameters

Parameter	Description	Example
lastname optional	String The last name of the customer.	Kumar
address1 optional	String The first line of the billing address. Fraud Detection: This information is helpful when it comes to issues related to fraud detection and chargebacks. Hence, it is must to provide the correct information.	H.No- 17, Block C, Kalyan Bldg, Khardilkar Road, Mumbai
address2 optional	String The second line of the billing address.	34 Saikripa-Estate, Tilak Nagar
city optional	String The city where your customer resides as part of the billing address.	Mumbai
state optional	String The state where your customer resides as part of the billing address.	Maharashtra
country optional	String The country where your customer resides.	India
zipcode optional	String Billing address zip code is mandatory for the cardless EMI option. Character Limit: 20	400004
enforced_payment optional	String This parameter is to customize the payment options for each transaction. You can enforce specific payment modes, cards scheme, and specific banks under Net Banking using this method.	creditcard\|debitcard
drop_category optional	String This parameter is used if you want to hide one or multiple payment options. For example, if you consider the payment options such as credit card, debit card, and net banking, you can hide the credit card mode of payment.	CC
User Defined Field optional	String User-defined fields (udf) are used to store any information corresponding to a particular transaction. You can use up to five udfs in the post designated as udf1, udf2, udf3, udf4, udf5.	AELPR****E
udf2 optional	String User-defined fields (udf) are used to store any information corresponding to a particular transaction. You can use up to five udfs in the post designated as udf1, udf2, udf3, udf4, udf5.
udf3 optional	String User-defined fields (udf) are used to store any information corresponding to a particular transaction.	02-02-1980
udf4 optional	String User-defined fields (udf) are used to store any information corresponding to a particular transaction.	XYZ Pvt. Ltd.
udf5 optional	String User-defined fields (udf) are used to store any information corresponding to a particular transaction.	098450845

curl -X POST "https://test.payu.in/_payment
-H "accept: application/json" -H "Content-Type: application/x-www-form-urlencoded" -d
"key=JP***g&txnid=PQI6MqpYrjEefU&amount=10.00
&firstname=PayU User&[email protected]&phone=9876543210
&productinfo=iPhone&pre_authorize=1&pg=cc&bankcode=CC&surl=
https://apiplayground-response.herokuapp.com/
&furl=https://apiplayground-response.herokuapp.com/
&pre_authorize=1&hash=05a397501918ec5c36ae52daa3b3e49b43e986b86940e109d060076e467c3ea7536617df7420e0e6863dced8c5b45f9fff15c13bdf0335512c05f0210b31b072"

import requests

url = "https://test.payu.in/_payment"

headers = {
    "accept": "application/json",
    "Content-Type": "application/x-www-form-urlencoded"
}

data = {
    "key": "JP***g",
    "txnid": "PQI6MqpYrjEefU",
    "amount": "10.00",
    "firstname": "PayU User",
    "email": "[email protected]",
    "phone": "9876543210",
    "productinfo": "iPhone",
    "pre_authorize": "1",
    "pg": "cc",
    "bankcode": "CC",
    "surl": "https://apiplayground-response.herokuapp.com/",
    "furl": "https://apiplayground-response.herokuapp.com/",
    "hash": "05a397501918ec5c36ae52daa3b3e49b43e986b86940e109d060076e467c3ea7536617df7420e0e6863dced8c5b45f9fff15c13bdf0335512c05f0210b31b072"
}

response = requests.post(url, headers=headers, data=data)

print("Status Code:", response.status_code)
print("Response:", response.text)

import java.io.IOException;
import java.net.URI;
import java.net.URLEncoder;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.util.LinkedHashMap;
import java.util.Map;
import java.util.stream.Collectors;

public class PayUHostedPreAuthorizePayment {
    public static void main(String[] args) throws IOException, InterruptedException {
        String url = "https://test.payu.in/_payment";
        
        Map<String, String> formData = new LinkedHashMap<>();
        formData.put("key", "JP***g");
        formData.put("txnid", "PQI6MqpYrjEefU");
        formData.put("amount", "10.00");
        formData.put("firstname", "PayU User");
        formData.put("email", "[email protected]");
        formData.put("phone", "9876543210");
        formData.put("productinfo", "iPhone");
        formData.put("pre_authorize", "1");
        formData.put("pg", "cc");
        formData.put("bankcode", "CC");
        formData.put("surl", "https://apiplayground-response.herokuapp.com/");
        formData.put("furl", "https://apiplayground-response.herokuapp.com/");
        formData.put("hash", "05a397501918ec5c36ae52daa3b3e49b43e986b86940e109d060076e467c3ea7536617df7420e0e6863dced8c5b45f9fff15c13bdf0335512c05f0210b31b072");
        
        String formBody = formData.entrySet()
            .stream()
            .map(entry -> URLEncoder.encode(entry.getKey(), StandardCharsets.UTF_8) + "=" + 
                          URLEncoder.encode(entry.getValue(), StandardCharsets.UTF_8))
            .collect(Collectors.joining("&"));
        
        HttpClient client = HttpClient.newHttpClient();
        
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create(url))
            .header("accept", "application/json")
            .header("Content-Type", "application/x-www-form-urlencoded")
            .POST(HttpRequest.BodyPublishers.ofString(formBody))
            .build();
        
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        
        System.out.println("Status Code: " + response.statusCode());
        System.out.println("Response: " + response.body());
    }
}

<?php

$url = "https://test.payu.in/_payment";

$data = array(
    'key' => 'JP***g',
    'txnid' => 'PQI6MqpYrjEefU',
    'amount' => '10.00',
    'firstname' => 'PayU User',
    'email' => '[email protected]',
    'phone' => '9876543210',
    'productinfo' => 'iPhone',
    'pre_authorize' => '1',
    'pg' => 'cc',
    'bankcode' => 'CC',
    'surl' => 'https://apiplayground-response.herokuapp.com/',
    'furl' => 'https://apiplayground-response.herokuapp.com/',
    'hash' => '05a397501918ec5c36ae52daa3b3e49b43e986b86940e109d060076e467c3ea7536617df7420e0e6863dced8c5b45f9fff15c13bdf0335512c05f0210b31b072'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'accept: application/json',
    'Content-Type: application/x-www-form-urlencoded'
));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$error = curl_error($ch);
curl_close($ch);

if ($error) {
    echo "cURL Error: " . $error . "\n";
} else {
    echo "Status Code: " . $httpCode . "\n";
    echo "Response: " . $response . "\n";
}
?>

#!/usr/bin/perl
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common qw(POST);

my $url = "https://test.payu.in/_payment";

my $ua = LWP::UserAgent->new;
$ua->timeout(30);

my %data = (
    'key'           => 'JP***g',
    'txnid'         => 'PQI6MqpYrjEefU',
    'amount'        => '10.00',
    'firstname'     => 'PayU User',
    'email'         => '[email protected]',
    'phone'         => '9876543210',
    'productinfo'   => 'iPhone',
    'pre_authorize' => '1',
    'pg'            => 'cc',
    'bankcode'      => 'CC',
    'surl'          => 'https://apiplayground-response.herokuapp.com/',
    'furl'          => 'https://apiplayground-response.herokuapp.com/',
    'hash'          => '05a397501918ec5c36ae52daa3b3e49b43e986b86940e109d060076e467c3ea7536617df7420e0e6863dced8c5b45f9fff15c13bdf0335512c05f0210b31b072'
);

my $response = $ua->request(POST $url,
    Content_Type => 'application/x-www-form-urlencoded',
    Accept       => 'application/json',
    Content      => [%data]
);

if ($response->is_success) {
    print "Status Code: " . $response->code . "\n";
    print "Response: " . $response->decoded_content . "\n";
} else {
    print "Error: " . $response->status_line . "\n";
    print "Response: " . $response->decoded_content . "\n";
}

Step 2: Check the response from PayU

Hash validation logic for payment response (Reverse Hashing)

While sending the response, PayU takes the exact same parameters that were sent in the request (in reverse order) to calculate the hash and returns it to you. You must verify the hash and then mark a transaction as a success or failure. This is to make sure the transaction has not tampered within the response.

The order of the parameters is similar to the following code block:

sha512(SALT|status||||||udf5|udf4|udf3|udf2|udf1|email|firstname|productinfo|amount|txnid|key)

Sample response

By default, the response in HTML format. The formatted sample response body is similar to the following, and you need to look for the following parameters:

PG_TYPE: CC PG
bankcode: CC
unamappedstatus: auth

mihpayid: 403993715523615328
mode: CC
status: success
unmappedstatus: auth
key: JPM7Fg
txnid: 50QJq6lBJBmx14
amount: 10.00
cardCategory: domestic
discount: 0.00
net_amount_debit: 10
addedon: 2021-07-28 15:11:37
productinfo: iPhone
firstname: PayU User
lastname: 
address1: 
address2: 
city: 
state: 
country: 
zipcode: 
email: [email protected]
phone: 9876543210
udf1: 
udf2: 
udf3: 
udf4: 
udf5: 
udf6: 
udf7: 
udf8: 
udf9: 
udf10: 
hash: afeab9dcf4e43d47f8fbf5a6838d393c70694a58e30ada08e6cb86ac943236c05717c5f5e4872d671fe81d0d9b2d9facd44e9a061ba621aff6f20c4343ea5dfa
field1: 
field2: 
field3: 
field4: 
field5: 
field6: 
field7: 
field8: 
field9: Transaction Completed Successfully
payment_source: payu
PG_TYPE: CC-PG
bank_ref_num: 7f0d5ada-59bb-41d7-9e41-20a6af2406c9
bankcode: CC
error: E000
error_Message: No Error
name_on_card: test
cardnum: 411111XXXXXX1111
cardhash: This field is no longer supported in postback params.

Step 3: Capture a Pre-authorized payment

To capture a pre-authorized payment, use the following command. After the API command is successful, the transaction would be captured and settled to you.

Environment


Test Environment	https://test.payu.in/merchant/postservice.php?form=2
Production Environment	https://info.payu.in/merchant/postservice.php?form=2

Sample Request

curl --location --request POST 'https://info.payu.in/merchant/postservice.php?form=2' \ 
--header 'Content-Type: application/x-www-form-urlencoded' \ 
--form 'key="JF***g"' \ 
--form 'command="capture_transaction"' \ 
--form 'hash="67411736ab98c59522492a12751a6015c41b87764019f9dc14052690c2c7af9095d31002fc109dcf3596c2f38792d56db6f6207b1989010f2adf51c144fa3019"' \ 
--form 'var1="15246574846"' \ 
--form 'var2="authorizeTransaction123"' \ 
--form 'var3="1"'

Sample response

{ 
    "status": 1, 
    "msg": "Capture Request Queued", 
    "request_id": "Request ID", 
    "bank_ref_num": "Bank Reference Number" 
}

Step 4: Check Action Status

Upon receiving the response, PayU recommends you performing a reconciliation step to validate all transaction details.

You can verify your payments using either of the following methods:

Configure the webhooks to monitor the status of payments.
Webhooks enable a server to communicate with another server by sending an HTTP callback or message.
These callbacks are triggered by specific events or instances and operate at the server-to-server (S2S) level.

Know how to manage Webhooks for Payments.

Environment


Test Environment	https://test.payu.in/merchant/postservice.php?form=2
Production Environment	https://info.payu.in/merchant/postservice.php?form=2

Note: The hash logic for Verify Payment API is:
sha512(key|command|var1|salt) sha512

Sample request

curl --request POST
--url 'https://test.payu.in/merchant/postservice?form=2'
--header 'Content-Type: application/x-www-form-urlencoded'
--data key=JPM7Fg
--data command=verify_payment
--data var1=IhfgcZnXR4o4nB
--data hash=a0ae79fdd66c875af6e9b21c4a67f1822deb00f2df5e9f0b1948f3222f536a9bf741b24efbb1874ca0f84f76b036e6c0d641581d0100f7abe4aeed2f3264f5c9

Sample response

If credit card payment is made, the response is similar to the following:

{
  "status":0,
  "msg":"0 out of 1 Transactions Fetched Successfully",
  "transaction_details":
{
"IhfgcZnXR4o4nB":
{
"mihpayid":"Not Found",
"status":"Not Found"
}
}
}

If txnID is not found, the response is similar to the following:


{
    "status":0,
    "msg":"0 out of 1 Transactions Fetched Successfully",
      "transaction_details":
      {	
                      "IhfgcZnXR4o4nB":
        {
                              "mihpayid":"Not Found",
            "status":"Not Found"
          }
                      }
}

Response parameters

Parameter	Description	Example
status	This parameter returns the status of web service call. The status can be any of the following: 0 - If web service call failed. 1 - If web service call succeeded	0
msg	This parameter returns the reason string.	For example, any of the following messages are displayed: Parameter missing Token is empty Amount is empty Transaction not exists
transaction_details	This parameter contains the response in a JSON format. For more information refer to JSON fields description for transaction_details parameter .
request_id	PayU Request ID for a request in a Transaction. For example, a transaction can have a refund request.	7800456
bank_ref_num	This parameter returns the bank reference number. If the bank provides after a successful action.	204519474956

To learn more about the possible error codes and their description, refer to Error Codes.

📘
Notes:

The unamappedstatus to auth can be checked using the Verify Payment API and in callback response in the Transaction callback.

To check the status of the Auth Request and then Capture Request sent, use the check_action_status API. For more information, refer to Check Refund Status API with Request ID.

If you want to cancel or refund a pre-authorized payment, refer to Cancel a Pre-Authorized Payment.

👍
Reference: For cancelling pre-auth payments, refer to Cancel a Pre-Authorized Transaction API.

Updated 11 days ago

Did this page help you?

Step 1: Post the pre-auth transaction request

Step 2: Check the response from PayU

Hash validation logic for payment response (Reverse Hashing)

Step 3: Capture a Pre-authorized payment

Step 4: Check Action Status

EXAMPLE QUESTIONS