Virtual Cards
Virtual Cards are digital-only payment instruments (typically Visa, Mastercard, or RuPay) that function like physical debit or credit cards but exist only within a mobile app or web interface. They are primarily used to enable secure online transactions for digital wallets or Prepaid Payment Instruments (PPI).
PayU provides GPR (General Purpose Reloadable) cards as a solution for PayU partners. This offering includes Min-KYC, Full-KYC, Card Management, and Limit Management. To achieve PCI DSS compliance, merchants can use the PayU Card Management SDK on web and mobile platforms.
Before you begin:Register for a account with PayU before you start integration. Contact your PayU Key Account Manager to enable Virtual Cards (GPR cards) and obtain your
walletIdentifier. For more information, refer to Register for a Merchant Account.
Integration guides
The following sections describe how to integrate Virtual Cards with PayU:
- Web Integration
- Android SDK Integration
- iOS SDK Integration
- Flutter SDK Integration
- React Native SDK Integration
Key features
GPR card capabilities
PayU GPR cards for partners include:
- Min-KYC — Lightweight customer verification to issue a virtual card.
- Full-KYC — Complete KYC for higher limits and compliance.
- Card Management — View, block, or manage virtual card details within the PayU-hosted or SDK UI.
- Limit Management — Configure and enforce spending limits on issued cards.
Benefits for merchants
- PCI DSS compliance — Card data is handled by PayU PPI SDKs and hosted pages, reducing merchant PCI scope.
- Multi-platform support — Integrate on web (PayU Hosted or iFrame) and native mobile SDKs.
- Wallet and PPI enablement — Offer card-like payment experiences for closed-loop wallets and prepaid instruments.
- Branded experience — Embed card management within your app or website using iFrame or native SDK UI.
Benefits for customers
- Digital-first cards — Use Visa, Mastercard, or RuPay virtual cards without a physical card.
- Secure online payments — Complete OTP verification on PayU-hosted pages or within the merchant app via SDK.
- In-app card management — View and manage card details without leaving the merchant experience.
Customer journey
Web – PayU Hosted
- Merchant constructs the request JSON and HMAC authorization header on the server.
- Merchant FORM-POSTs to the Virtual Cards Launch API.
- Customer is redirected to the PayU Virtual Cards OTP page.
- Customer completes OTP verification and card management.
- Customer is returned to the merchant
redirectUrl.
Web – iFrame
- Merchant loads the PayU PPI JS SDK and constructs request objects on the server.
- Customer clicks the card button; merchant calls
ppi.launch()with request data and handlers. - PayU renders the card UI in an iFrame on the merchant page.
- Customer completes the flow;
onCancel()orcatchException()handlers capture the outcome.
Mobile SDK
- Merchant initialises the platform PPI SDK with
merchantKey,mobileNumber,walletIdentifier,walletUrn, andreferenceId. - Merchant calls
showCards()to present the native Virtual Cards UI. - SDK requests a dynamic hash from the merchant server via
generateHash. - Merchant server returns SHA-512 hash; customer completes card management in the native UI.
Integration best practices
- Generate all hashes on your server — never expose merchant salt in client-side code.
- Ensure the
Dateheader and JSON request string used in the hash match exactly in the POST request (web integrations). - Use UAT SDK and API endpoints during testing before switching to production URLs.
- Handle
onCancel()andcatchException()/onError()callbacks to manage user abandonment and errors gracefully. - Obtain
walletIdentifierand customerwalletUrnfrom your PayU Key Account Manager during onboarding.
- Ensure the
APIs used in Virtual Cards integration
| API | Purpose |
|---|---|
Virtual Cards Launch API (POST /loyalty-points/olw/user/card/v1) | FORM-POST request with HMAC SHA-512 authorization (referenceId, redirectUrl, mobileNumber, walletUrn, walletIdentifier) to redirect customers to the Virtual Cards OTP page. |
PayU PPI JS SDK (ppi.launch()) | Launch the Virtual Cards management UI in an iFrame on the merchant page or after a hosted redirect. Requires https://jssdk.payu.in/ppi/ppi.min.js (UAT: https://jssdk-uat.payu.in/ppi/ppi.min.js). |
SDK integration
Mobile integrations use platform-specific PayU PPI SDKs with server-side dynamic hash generation.
| Platform | SDK / package | Integration guide |
|---|---|---|
| Android | in.payu:payu-ppi-sdk — OnePayUJSParams, showCards() | Android SDK Integration |
| iOS | PayUIndia-PPI-SDK — OnePayUJSKit, showCards() | iOS SDK Integration |
| Flutter | payu_ppi_flutter | Flutter SDK Integration |
| React Native | payu-ppi-react | React Native SDK Integration |
Updated 19 days ago