Partner Payment using Hosted Checkout Integration

Initiate payment transactions that redirect customers to PayU's hosted payment page. This flow supports all payment methods including Cards, Net Banking, UPI, Wallets, EMI, and more.

Endpoint

HTTP Method: POST

Environment URLs:

Environment	URL
Test	`https://test-partnerapilayer.payu.in/apilayer/partner/payments`
Production	`https://api.payu.in/partner/payments`

Request Headers

Authorization: Bearer <FINAL_ACCESS_TOKEN>
Content-Type: application/json

📘
Notes:

You must generate the token using the Reseller Client Credentials Token API before to be posted in header in the above APIs. For more information, refer to Reseller Client Credentials Token API

If you are old partner merchant or reseller, you must a set of APIs to generate the token that must be used in above APIs, so you must use the final access token obtained from [Step 3] Exchange Authorization Code API.

For more information, refer to Token Generation Flow used for Partner Payments.

Request Parameters

Mandatory Parameters

Parameter	Type & Description	Example
`txnid`	string — Unique transaction ID generated by partner	28471834809170983
`amount`	string — Transaction amount	1000.00
`productinfo`	string — Product description	Product purchase
`firstname`	string — Customer first name	John
`email`	string — Customer email address	[email protected]
`phone`	string — Customer phone number (10 digits)	919876543210
`merchant_id`	integer — PayU merchant ID	8739528
`reseller_id`	string — Partner/reseller UUID	11ee-0e7e-5403fde2-9523-0a696b110fde
`surl`	string — Success redirect URL (where PayU redirects after successful payment)	https://merchant.example.com/success
`furl`	string — Failure redirect URL (where PayU redirects after failed payment)	https://merchant.example.com/failure
`hash`	string — SHA-512 hash: merchant_id\|txnid\|amount\|productinfo\|firstname\|email\|udf1\|udf2\|udf3\|udf4\|udf5\|\|\|\|\|\|client_secret	(computed hash value)

Optional Parameters

Parameter	Type & Description	Example
`lastname`	string — Customer last name	Doe
`address1`	string — Customer address line 1	123 Main Street
`address2`	string — Customer address line 2	Apartment 4B
`city`	string — Customer city	Mumbai
`state`	string — Customer state	Maharashtra
`country`	string — Customer country	India
`zipcode`	string — Customer postal code	400001
`udf1` - `udf5`	string — User-defined fields	custom_value
`curl`	string — Cancel redirect URL	https://merchant.example.com/cancel

Hash Generation Formula

Compute SHA-512 hash using this exact formula:

merchant_id|txnid|amount|productinfo|firstname|email|udf1|udf2|udf3|udf4|udf5||||||client_secret

Hash Generation Example (Java):

import java.security.MessageDigest;

public static String generatePaymentHash(
    int merchantId, String txnid, String amount, String productinfo,
    String firstname, String email, String udf1, String udf2, String udf3,
    String udf4, String udf5, String clientSecret
) throws Exception {
    
    String hashString = merchantId + "|" + txnid + "|" + amount + "|" + productinfo + "|" +
                       firstname + "|" + email + "|" +
                       (udf1 == null ? "" : udf1) + "|" + 
                       (udf2 == null ? "" : udf2) + "|" + 
                       (udf3 == null ? "" : udf3) + "|" +
                       (udf4 == null ? "" : udf4) + "|" + 
                       (udf5 == null ? "" : udf5) + "||||||" + clientSecret;
    
    MessageDigest md = MessageDigest.getInstance("SHA-512");
    byte[] digest = md.digest(hashString.getBytes("UTF-8"));
    
    StringBuilder hex = new StringBuilder();
    for (byte b : digest) {
        String h = Integer.toHexString(0xFF & b);
        if (h.length() == 1) hex.append("0");
        hex.append(h);
    }
    return hex.toString();
}

Sample Request

curl --location 'https://test-partnerapilayer.payu.in/apilayer/partner/payments' \
--header 'Authorization: Bearer 039e0d1d70f467f946e2d73bd43868df856cfaa352ea54591a76bfc4a08d3487' \
--header 'Content-Type: application/json' \
--data '{
  "txnid": "28471834809170983",
  "amount": "1000.00",
  "productinfo": "Product purchase",
  "firstname": "John",
  "lastname": "Doe",
  "email": "[email protected]",
  "phone": "919876543210",
  "merchant_id": 8739528,
  "reseller_id": "11ee-0e7e-5403fde2-9523-0a696b110fde",
  "surl": "https://merchant.example.com/success",
  "furl": "https://merchant.example.com/failure",
  "curl": "https://merchant.example.com/cancel",
  "udf1": "",
  "udf2": "",
  "udf3": "",
  "udf4": "",
  "udf5": "web",
  "hash": "b8f3a5d2e1c7b4a9e6d3c8b1a2f4e7d9c3b6a2e1d5f4c7a8b3e6d2f1c9a5b4e7"
}'

import requests
import hashlib

def generate_hosted_checkout_payment():
    url = "https://test-partnerapilayer.payu.in/apilayer/partner/payments"
    
    # Payment details
    merchant_id = 8739528
    txnid = "28471834809170983"
    amount = "1000.00"
    productinfo = "Product purchase"
    firstname = "John"
    email = "[email protected]"
    
    # Compute hash
    hash_string = f"{merchant_id}|{txnid}|{amount}|{productinfo}|{firstname}|{email}|||||web||||||YOUR_CLIENT_SECRET"
    payment_hash = hashlib.sha512(hash_string.encode('utf-8')).hexdigest()
    
    headers = {
        "Authorization": "Bearer 039e0d1d70f467f946e2d73bd43868df856cfaa352ea54591a76bfc4a08d3487",
        "Content-Type": "application/json"
    }
    
    payload = {
        "txnid": txnid,
        "amount": amount,
        "productinfo": productinfo,
        "firstname": firstname,
        "lastname": "Doe",
        "email": email,
        "phone": "919876543210",
        "merchant_id": merchant_id,
        "reseller_id": "11ee-0e7e-5403fde2-9523-0a696b110fde",
        "surl": "https://merchant.example.com/success",
        "furl": "https://merchant.example.com/failure",
        "curl": "https://merchant.example.com/cancel",
        "udf5": "web",
        "hash": payment_hash
    }
    
    response = requests.post(url, headers=headers, json=payload)
    return response.json()

# Usage
result = generate_hosted_checkout_payment()
print("Redirect URL:", result.get('redirectUri'))

<?php

$url = "https://test-partnerapilayer.payu.in/apilayer/partner/payments";

// Payment details
$merchantId = 8739528;
$txnid = "28471834809170983";
$amount = "1000.00";
$productinfo = "Product purchase";
$firstname = "John";
$email = "[email protected]";

// Compute hash
$hashString = "{$merchantId}|{$txnid}|{$amount}|{$productinfo}|{$firstname}|{$email}|||||web||||||YOUR_CLIENT_SECRET";
$paymentHash = hash('sha512', $hashString);

$payload = [
    "txnid" => $txnid,
    "amount" => $amount,
    "productinfo" => $productinfo,
    "firstname" => $firstname,
    "lastname" => "Doe",
    "email" => $email,
    "phone" => "919876543210",
    "merchant_id" => $merchantId,
    "reseller_id" => "11ee-0e7e-5403fde2-9523-0a696b110fde",
    "surl" => "https://merchant.example.com/success",
    "furl" => "https://merchant.example.com/failure",
    "curl" => "https://merchant.example.com/cancel",
    "udf5" => "web",
    "hash" => $paymentHash
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer 039e0d1d70f467f946e2d73bd43868df856cfaa352ea54591a76bfc4a08d3487",
    "Content-Type: application/json"
]);

$response = curl_exec($ch);
curl_close($ch);

$data = json_decode($response, true);
echo "Redirect URL: " . $data['redirectUri'];
?>

Sample Response

{
  "redirectUri": "https://secure.payu.in/_payment?mihpayid=403993715521855092&amount=1000.00&txnid=28471834809170983&key=JPM7Fg&productinfo=Product+purchase&firstname=John&[email protected]&phone=919876543210..."
}

Response Parameters

Parameter	Type	Description
`redirectUri`	string	Redirect URL — Immediately redirect the customer to this URL to complete payment on PayU's hosted page

Handling the Redirect

After receiving the response, redirect the customer to the redirectUri:

Method 1: Server-Side Redirect (Recommended)

from flask import redirect

@app.route('/initiate-payment', methods=['POST'])
def initiate_payment():
    # Call Partner Payments API
    response = generate_hosted_checkout_payment()
    
    # Redirect customer to PayU
    return redirect(response['redirectUri'])

Method 2: Client-Side Redirect

// Call your backend to get redirect URL
fetch('/api/initiate-payment', { method: 'POST' })
  .then(response => response.json())
  .then(data => {
    // Redirect customer to PayU
    window.location.href = data.redirectUri;
  });

Method 3: HTML Form Auto-Submit

<form id="paymentForm" action="<?php echo $redirectUri; ?>" method="GET">
  <input type="submit" value="Proceed to Payment">
</form>

<script>
  // Auto-submit form
  document.getElementById('paymentForm').submit();
</script>

Payment Completion Flow

Customer is redirected to PayU's hosted checkout page
Customer selects payment method (Cards, Net Banking, UPI, Wallets, etc.)
Customer completes payment
PayU redirects customer to your surl (success) or furl (failure) URL
PayU POSTs payment response to the redirect URL
Your endpoint verifies the response hash
PayU also sends webhook to your configured partner webhook URL
You call verify payment API for final confirmation

Handling PayU Response (surl/furl)

When PayU redirects back to your URL, it POSTs the payment response:

from flask import request

@app.route('/payment/success', methods=['POST'])
def payment_success():
    # Extract response parameters
    response_data = request.form.to_dict()
    
    # Verify response hash (reverse hash formula)
    if not verify_response_hash(response_data):
        return "Invalid hash", 400
    
    # Update database
    update_payment_status(
        txnid=response_data['txnid'],
        status=response_data['status'],
        mihpayid=response_data['mihpayid']
    )
    
    # Display success page to customer
    return render_template('payment_success.html', data=response_data)

Response Hash Verification:

Use the reverse hash formula:

client_secret|status|||||udf5|udf4|udf3|udf2|udf1|email|firstname|productinfo|amount|txnid|merchant_id

See Partner Webhook API for complete verification code.

Error Codes

HTTP Status	Error Message	Description	Resolution
400	Invalid hash	Hash validation failed	Verify hash formula and client_secret
401	Auth token is not valid	Access token expired or invalid	Regenerate OAuth token
400	Missing surl or furl	Redirect URLs not provided	Include surl and furl in request
400	Invalid redirect URL	URL is not HTTPS or not accessible	Use valid HTTPS URLs

Supported Payment Methods

The hosted checkout page supports all PayU payment methods:

Cards — Credit Cards, Debit Cards
Net Banking — All major banks
UPI — UPI ID, UPI QR, UPI Intent
Wallets — Paytm, PhonePe, Amazon Pay, Mobikwik, Freecharge
EMI — Card EMI, Cardless EMI
Pay Later — LazyPay, Simpl, ZestMoney
Cash Cards — Sodexo, Gift Cards

The customer can choose any available payment method on the hosted page.

Testing Hosted Checkout

Use these test cards on the UAT environment:

Successful Transaction:

Card Number: 5123456789012346
Expiry: Any future date (MM/YY)
CVV: 123
Name: Test User

Failed Transaction:

Card Number: 4111111111111111
Expiry: Any future date
CVV: 123
Name: Test User

For complete test data, see Testing and Troubleshooting.

Next Steps

After initiating hosted checkout payment:

Redirect customer to redirectUri
Customer completes payment on PayU's page
Handle response on surl/furl endpoints and verify hash
Wait for webhook callback from PayU
Verify payment using POST /partner/verifyPayment