Step 1: Payment and Authentication Initiation

post

https://secure.payu.in/_payment

The first step in Cards SI mandate creation initiates the payment and begins 3DS authentication. The merchant sends a _payment POST request to PayU with card details. This is a normal card authentication call. PayU returns a Base64-encoded acsTemplate — decode it, render the HTML page, and redirect the customer to the OTP screen.

After the customer submits the OTP, use the bankData from the OTP response (plus siTokenDetails) as authentication_info in the AuthorizeTransaction API.

Authentication Flows

Flow 1: New Card via PayU

Send auth_only=1, txn_s2s_flow=4, authentication_flow=REDIRECT, and plain card details (ccnum, ccname, etc.).

Flow 2: Saved Card via PayU

Send auth_only=1, txn_s2s_flow=4, and storecard_token_type=1 with a stored network token (store_card_token). siTokenDetails in the subsequent AuthorizeTransaction call is optional for this flow.

Flow 3: Authentication Not via PayU

Send txn_s2s_flow=3 with authentication_info already containing the 3DS result (cavv, eci, etc.) and additional_info with network token details. The mandate is registered in this single call.

Hash Formula

SHA512(key|txnid|amount|productinfo|firstname|email|udf1|udf2|udf3|udf4|udf5||||||SALT)

Important!
Use empty strings for any udf fields not sent.

Method

POST

Endpoint

/merchant/postservice.php?form=2

Environments

Environment	URL
Test	`https://test.payu.in/_payment`
Production	`https://secure.payu.in/_payment`

Flow 1: New Card Authentication via PayU

The merchant sends plain card details. PayU selects the acquirer, initiates 3DS authentication, and returns an acsTemplate for OTP redirect.

Sample Requests

curl --location 'https://test.payu.in/_payment' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'key=vqpS7W' \
--data-urlencode 'txnid=Txn080720261125' \
--data-urlencode 'amount=100' \
--data-urlencode 'productinfo=iPhone' \
--data-urlencode 'firstname=Test User' \
--data-urlencode '[email protected]' \
--data-urlencode 'phone=9876543210' \
--data-urlencode 'surl=https://test.payu.in/admin/test_response' \
--data-urlencode 'furl=https://test.payu.in/admin/test_response' \
--data-urlencode 'api_version=7' \
--data-urlencode 'hash=4a4074485ceacdb1093e7089655e327bd9a987f59daeab26d71a6f5011f6bb780c9a1fd26febcc00c091689887d8e0dbb0e17da16de9892658867a3d4deaa699' \
--data-urlencode 'auth_only=1' \
--data-urlencode 'termUrl=https://test.payu.in/admin/test_response' \
--data-urlencode 's2s_client_ip=66.15.149.87' \
--data-urlencode 's2s_device_info=Mozilla' \
--data-urlencode 'authentication_flow=REDIRECT' \
--data-urlencode 'txn_s2s_flow=4' \
--data-urlencode 'pg=CC' \
--data-urlencode 'bankcode=CC' \
--data-urlencode 'ccnum=4761360079851258' \
--data-urlencode 'ccname=test' \
--data-urlencode 'ccexpmon=05' \
--data-urlencode 'ccexpyr=28' \
--data-urlencode 'ccvv=123' \

Sample Response

PayU returns a JSON object with txnStatus: "Enrolled" and an acsTemplate field.

{
    "metaData": {
      "message": null,
      "referenceId": "4e0d4a1b8f093f9bb03ed6e5605071b62ce39a9d136698d703862953a0106c24",
      "statusCode": null,
      "txnId": "Txn080720261125",
      "txnStatus": "Enrolled",
      "unmappedStatus": "pending"
    },
    "result": {
      "otpPostUrl": "",
      "acsTemplate": "PGh0bWw+PGJvZHk+PGZvcm0gbmFtZT0icGF5bWVudF9wb3N0Ii4uLg==",
      "binData": {
        "pureS2SSupported": false,
        "issuingBank": "YES",
        "category": "creditcard",
        "cardType": "VISA",
        "isDomestic": true
      }
    }
  }

Handling the `acsTemplate`

Base64-decode the acsTemplate value to get an HTML page. Open this page in the customer's browser to redirect them to the card network OTP/authentication screen.

After the customer submits the OTP, a response is returned containing bankData. You will need this in Step 2 — Authorization.

{
      "referenceId": "4e0d4a1b8f093f9bb03ed6e5605071b62ce39a9d136698d703862953a0106c24",
      "cres": "eyJtZXNzYWdlVHlwZSI6IkNSZXMi...",
      "additionalInfo": {
        "authUdf1": "", "authUdf2": "", "authUdf3": "", "authUdf4": "", "authUdf5": "",
        "authUdf6": "", "authUdf7": "", "authUdf8": "", "authUdf9": "", "authUdf10": ""
      }
    }

Add siTokenDetails to this object before passing it as authentication_info in Step 2.

Flow 2: Saved Card Authentication via PayU

The customer's card is already stored at the merchant's end from a previous transaction. The merchant uses the associated network token directly — the customer does not need to enter card details again.

Sample Request

curl --location 'https://test.payu.in/_payment' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'key=vqpS7W' \
--data-urlencode 'txnid=Txn030720261622' \
--data-urlencode 'amount=100' \
--data-urlencode 'productinfo=iPhone' \
--data-urlencode 'firstname=Test User' \
--data-urlencode '[email protected]' \
--data-urlencode 'phone=9876543210' \
--data-urlencode 'surl=https://test.payu.in/admin/test_response' \
--data-urlencode 'furl=https://test.payu.in/admin/test_response' \
--data-urlencode 'api_version=7' \
--data-urlencode 'hash=f2791c938b60cd7f06534d8efa296107c66c3a6f5116268d777d1f1d65d6c827ece56ff3517d09641dafaa88b157ecca2bbb1e4e6faca8f13e980628e204e034' \
--data-urlencode 'auth_only=1' \
--data-urlencode 'termUrl=https://test.payu.in/admin/test_response' \
--data-urlencode 's2s_client_ip=66.15.149.87' \
--data-urlencode 's2s_device_info=Mozilla' \
--data-urlencode 'txn_s2s_flow=4' \
--data-urlencode 'pg=CC' \
--data-urlencode 'bankcode=CC' \
--data-urlencode 'storecard_token_type=1' \
--data-urlencode 'store_card_token=4761360079851258' \
--data-urlencode 'additional_info={"last4Digits":"1234","tavv":"ABCDEFGH","trid":"1234567890","tokenRefNo":"abcde123456"}' \
--data-urlencode 'ccexpmon=05' \
--data-urlencode 'ccexpyr=28' \

All parameters from Flow 1 apply. The following replaces or adds to the card-specific parameters:

Parameter	Description
`storecard_token_type` `mandatory`	`Integer` Specifies the type of stored card token being used. Possible values: `0`: PayU token `1`: Network token `2`: Issuer token Set to `1` for network tokens.
`store_card_token` `mandatory`	`varchar` The stored network token value. Replaces the plain card number for saved card transactions. For example `4761360079851258`
`additional_info` `mandatory`	`JSON Object` Additional token metadata: `{"last4Digits":"1234","tavv":"ABCDEFGH","trid":"1234567890","tokenRefNo":"abcde123456"}` `last4Digits`: Last 4 digits of the original card. Mandatory for all transactions. `tavv`: Token Authentication Verification Value (cryptogram) from the network/scheme. `trid`: Token Requestor ID assigned by the network. Required for Diners and recommended for other networks. `tokenRefNo`: Token Reference Number generated with the network token. Required for Diners.
`ccnum` `not required`	Omit this parameter for the saved card flow. Use `store_card_token` instead.

Sample Response

The response for the saved card flow is identical in structure to Flow 1 — you receive a txnStatus: "Enrolled" response with an acsTemplate. Proceed to redirect the customer for OTP.

The remaining steps (OTP page, bankData handling, and AuthorizeTransaction) are the same as Flow 1. Note that siTokenDetails is optional in the AuthorizeTransaction call when authentication is done via PayU for a saved card.

Flow 3: Authentication Not via PayU

The merchant has already performed 3DS authentication externally (e.g., through their own ACS integration or a third-party). The merchant passes the 3DS result directly in the _payment request. The mandate is registered in this single call — no separate AuthorizeTransaction call is required.

Sample Request

curl --location 'https://test.payu.in/_payment' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'key=vqpS7W' \
--data-urlencode 'txnid=1234455566111111' \
--data-urlencode 'amount=100' \
--data-urlencode 'productinfo=YOUR_REFERENCE_NUMBER' \
--data-urlencode 'firstname=John' \
--data-urlencode 'lastname=Smith' \
--data-urlencode '[email protected]' \
--data-urlencode 'phone=1234567890' \
--data-urlencode 'surl=https://test.adyen.com' \
--data-urlencode 'furl=https://test.adyen.com' \
--data-urlencode 'api_version=7' \
--data-urlencode 'hash=8f158ff319ff023e92cc990d607c2e6a8ec725e799f31692320092f12904a1a081a705799b347c104220111b05dd0bd3d882b111eb01daf74c3a766a62f23b19' \
--data-urlencode 'txn_s2s_flow=3' \
--data-urlencode 'pg=CC' \
--data-urlencode 'bankcode=CC' \
--data-urlencode 'ccexpmon=05' \
--data-urlencode 'ccexpyr=2028' \
--data-urlencode 'ccvv=123' \
--data-urlencode 'ccname=test' \
--data-urlencode 'udf2=TestMerchant:355:visa' \
--data-urlencode 'udf5=YOUR_REFERENCE_NUMBER' \
--data-urlencode 'authentication_info={"cavv":"MTAwMjMyMDI2MTUxNzAwMDAwMDA5","eci":"02","flowType":"challenge","threeDSTransID":"2c75dd4a-c899-2f42-9081-19c4be594f97","threeDSServerTransID":"2c75dd4a-c899-2f42-9081-19c4be594f97","threeDSTransStatus":"Y"}' \
--data-urlencode 'threeDS2RequestData={"deviceChannel":"BRW","threeDSVersion":"2.1.0"}' \
--data-urlencode 'additional_info={"tavv":"ADcBA4ZHFQAgJRImEjklAAAAAAE=","par":"PN07d26452cf9a1696e2744f470377ec48d5","last4digits":"2656"}' \
--data-urlencode 'store_card_token=5506900480000008' \
--data-urlencode 'storecard_token_type=1' \

All base parameters (key, txnid, amount, productinfo, firstname, email, phone, surl, furl, api_version, hash, pg, bankcode, si, si_details) apply. The following are added or changed:

Parameter	Description
`txn_s2s_flow` `mandatory`	`String` Set to 3 to indicate authentication was handled externally by the merchant.
`authentication_info` `mandatory`	`JSON Object` 3DS authentication result from the merchant's external authentication. `cavv`: Cardholder Authentication Verification Value. `eci`: Electronic Commerce Indicator. `flowType`: 3DS flow type (e.g., `challenge`). `threeDSTransID`: 3DS transaction ID from the ACS. `threeDSServerTransID`: 3DS server transaction ID. `threeDSTransStatus`: Authentication status. `Y` = successful.
`threeDS2RequestData` `mandatory`	`JSON Object` 3DS2 device channel data. `deviceChannel`: `BRW` (browser). `threeDSVersion`: 3DS version used, e.g., `2.1.0`.
`storecard_token_type` `mandatory`	`Integer` Set to 1 for network token.
`store_card_token` `mandatory`	`varchar` The network token value for the card.
`additional_info` `mandatory`	`JSON Object` Network token metadata for the non-PayU auth flow. `tavv`: Token Authentication Verification Value. `par`: Payment Account Reference. `last4digits`: Last 4 digits of the tokenised card.
`auth_only` `not required`	Do not send `auth_only` for this flow. The mandate is registered directly in this call.

Sample Response

For Flow 3, the mandate is registered in this single call. The response contains the final transaction authorization result directly — check IsStandingInstructionSet: "1" and save mihpayid as your authPayuId.

{
    "status": "success",
    "result": {
      "mihpayid": "403993715537854832",
      "mode": "DC",
      "status": "success",
      "txnid": "1234455566111111",
      "amount": "100.00",
      "addedon": "2026-07-08 12:00:56",
      "productinfo": "YOUR_REFERENCE_NUMBER",
      "firstname": "John",
      "card_no": "XXXXXXXXXXXX2656",
      "error": "E000",
      "error_Message": "No Error",
      "issuing_bank": "AXIS",
      "card_type": "MAST",
      "AuthCode": "729577",
      "net_amount_debit": "100",
      "IsStandingInstructionSet": "1",
      "bank_ref_no": "519813603159458050",
      "PG_TYPE": "DC-PG",
      "payment_source": "sist"
    }
  }

Next Step

For Flows 1 and 2: Proceed to Step 2 — Authorization and Mandate Registration with the bankData received after OTP submission.
For Flow 3: The mandate is already registered. Save mihpayid as your authPayuId and proceed to Pre-Debit and Recurring Payments.

Form Data

key

string

required

The merchant key generated from the dashboard. Know how to generate the test and live keys.

txnid

string

required

Unique merchant transaction identifier for this payment request.

amount

string

required

Transaction amount.

productinfo

string

required

Product or service description.

firstname

string

required

Customer first name.

lastname

string

Customer last name.

string

required

Customer email address.

phone

string

required

Customer phone number.

surl

string

required

Merchant success callback URL.

furl

string

required

Merchant failure callback URL.

api_version

string

required

API version. Must be 7 for the S2S card flow.

hash

string

required

SHA-512 hash generated using the formula: SHA512SHA512(key|txnid|amount|productinfo|firstname|email|udf1|udf2|udf3|udf4|udf5||||||SALT). Use empty strings for udf fields not sent.

auth_only

string

Set to 1 to initiate 3DS authentication via PayU without immediate capture.
Required for new card and saved card flows (txn_s2s_flow=4).
Omit for the non-PayU authentication flow (txn_s2s_flow=3).

termUrl

string

URL to receive the 3DS ACS response after OTP submission. Required when auth_only=1.

s2s_client_ip

string

Customer IP address used for fraud risk analysis. Required when auth_only=1.

s2s_device_info

string

Customer browser or device user-agent string. Required when auth_only=1.

authentication_flow

string

Set to REDIRECT for the OTP redirect flow. Required when auth_only=1.

txn_s2s_flow

string

enum

S2S authentication mode.

4 — Authentication handled via PayU (new card or saved card flow).
3 — Authentication was handled by the merchant externally (non-PayU flow).

Allowed:

string

enum

required

Payment gateway type.

Allowed:

bankcode

string

required

Bank or card network code.

ccnum

string

16-digit plain card number. Required for new card flow. Omit for saved card flow.

ccname

string

Name as printed on the card. Required for new card and non-PayU auth flows.

ccexpmon

string

Card expiry month (2 digits).

ccexpyr

string

Card expiry year (2 or 4 digits).

ccvv

string

Card CVV. Optional — may be required depending on issuer rules.

storecard_token_type

string

Set to 1 to indicate a stored network token is being used (saved card flow).

store_card_token

string

Stored network token value. Replaces the plain card number for saved card and non-PayU auth flows.

additional_info

object

Additional token metadata. Content varies by flow:

Saved card flow:

last4Digits — Last 4 digits of the original card.
tavv — Token Authentication Verification Value.
trid — Token Requestor ID.
tokenRefNo — Token reference number.

Non-PayU authentication flow:

tavv — TAVV from the network token.
par — Payment Account Reference.
last4digits — Last 4 digits of the tokenised card.

authentication_info

object

3DS authentication result from the merchant's external authentication.
Required only when txn_s2s_flow=3 (non-PayU authentication flow).

threeDS2RequestData

object

3DS2 device data. Required when txn_s2s_flow=3.

udf1

string

User-defined field 1.

udf2

string

User-defined field 2.

udf3

string

User-defined field 3.

udf4

string

User-defined field 4.

udf5

string

User-defined field 5.

Response

Language

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

Authentication Flows

Hash Formula

Important!

Environments

Flow 1: New Card Authentication via PayU

Sample Requests

Sample Response

Handling the acsTemplate

Flow 2: Saved Card Authentication via PayU

Sample Request

Sample Response

Flow 3: Authentication Not via PayU

Sample Request

Sample Response

Next Step

EXAMPLE QUESTIONS

Handling the `acsTemplate`