PayU Integration Lab BETA

Decide between Generic (QR), Specific (target app), or Smart (auto-detect). This determines the bankcode you send.

POST to _payment with pg=UPI, txn_s2s_flow=4, and your chosen bankcode. Use the Initiate Payment form (next step) to test.

PayU returns intentURIData (a upi://pay?... URL) or acsTemplate (base64 HTML). Extract the deeplink URI.

Web: Convert deeplink to QR code. Android: Fire an ACTION_VIEW intent. iOS: Open the URL scheme for the target app.

Poll check_payment while waiting. PayU posts the final result to your surl (success) or furl (failure).

Gather the transaction amount, product info, and customer details (name, email, phone). Generate a unique txnid (max 25 chars).

Compute sha512(key|txnid|amount|productinfo|firstname|email|udf1|udf2|udf3|udf4|udf5||||||salt) on your server. Never expose salt client-side.

Send all parameters including pg=UPI, bankcode (INTENT/TEZ/PHONEPE/PAYTM), and txn_s2s_flow=4 to https://test.payu.in/_payment.

If unmappedStatus=pending with intentURIData, generate a QR code from the deeplink. If acsTemplate is returned, decode the base64 HTML and render it.

Use check_payment API to poll until the transaction moves to success or failure. PayU also sends a callback to your surl/furl.

Build the si_details JSON with mandatory fields: billingAmount, billingCurrency (INR), billingCycle (ONCE / ADHOC / DAILY / WEEKLY / MONTHLY / YEARLY), billingInterval, paymentStartDate, and paymentEndDate. Optionally include UPI-specific fields: remarks (PSP display text, max 50 chars), billingLimit (ON/BEFORE/AFTER), billingRule (MAX/EXACT), and billingDate (day number).

Set udf1 = PAN||DOB (e.g. ABCDE1234F||1990-01-01) and udf3 = InvoiceID||MerchantName.

Compute sha512(key|txnid|amount|productinfo|firstname|email|udf1|udf2|udf3|udf4|udf5||||||si_details_json|salt). The si_details JSON string is appended before the salt.

Send all parameters with si=1, pg=UPI, bankcode=INTENT, txn_s2s_flow=4, and api_version=7.

The customer receives a mandate approval request on their UPI app. Once approved, the mandate becomes active and recurring debits can be triggered.

Use the same transaction ID (txnid) that was used during mandate registration.

Compute sha512(key|command|var1|salt) where command is verify_payment and var1 is the txnid.

Send key, command (verify_payment), var1 (txnid), and hash.

The mihpayid in the response is the authPayuId needed for mandate status, modify, pre-debit, and SI transaction.

From your mandate registration response, get the mihpayid (this is your authPayuId).

Create a JSON object with authPayuId and a unique requestId.

Compute sha512(key|command|var1|salt) where command is upi_mandate_status.

Send key, command, var1 (JSON string), and hash to the postservice endpoint.

Use the mihpayid from your mandate registration or verify payment response.

Create a JSON object with authPayuId, requestId, and the fields to modify: amount and/or endDate.

Compute sha512(key|command|var1|salt) where command is upi_mandate_modify.

Send key, command, var1 (JSON string), and hash. The customer will receive a modification approval request on their UPI app.

Decide between Normal Capture (single full/partial capture) or Multi Capture (multiple partial captures). For multi capture, include "multiCapture": "Y" in si_details.

Build the JSON with paymentStartDate and paymentEndDate. Add "multiCapture": "Y" if using multi capture mode.

Compute sha512(key|txnid|amount|productinfo|firstname|email|udf1|udf2|udf3|udf4|udf5||||||si_details_json|salt). The si_details JSON string is appended before the salt.

Send all parameters with pre_authorize=1, pg=UPI, bankcode=INTENT, txn_s2s_flow=4, api_version=7, plus s2s_client_ip and s2s_device_info.

Once the customer authorizes, the amount is blocked. Use capture_transaction API to capture the full or partial amount within the validity window.

Use the UPI OTM flow to create a pre-authorized transaction. The amount will be blocked in the customer's account.

Call verify_payment with the transaction ID to retrieve the mihpayid (PayU's internal transaction reference).

Compute sha512(key|command|var1|salt) where command=capture_transaction and var1=mihpayid.

Send key, command, var1 (mihpayid), var2 (unique capture order ID), var3 (capture amount), and hash to postservice.php.

Call verify_payment again to confirm the capture was successful and the amount has been debited.

Use the txnid you sent when creating the payment. This is your merchant-side unique reference.

Compute sha512(key|command|var1|salt) where command=verify_payment and var1=txnid.

Send key, command, var1 (txnid), and hash to postservice.php.

Extract mihpayid, status, mode, and payment_source from the response to determine payment outcome.

Based on the verified status, fulfill the order (if success) or show an error (if failure/pending).

Use verify_payment to get the mihpayid of the auth transaction you want to cancel or refund.

Use cancel_transaction to release the blocked amount. The command is the same for both Normal and Multi Capture.

Compute sha512(key|command|var1|salt) where var1=mihpayid.

Send the request to postservice.php with all required parameters including a unique cancel token ID.

Use check_action_status with the request_id to track the refund progress.

Use verify_payment or extract from the auth response to get the PayU transaction ID (mihpayid/payuId).

The proxy handles this server-side. Headers include: Date (UTC), Digest (SHA-256 of empty body, base64), and Authorization (HMAC signature).

Call https://apitest.payu.in/v1/transaction/upi_otm_status_check?payuId={{payuid}} with the HMAC headers.

The response contains the mandate/OTM status, amount, validity, and transaction details.

Use the mihpayid from the Verify Payment response (auto-filled if you followed the flow).

The debit date must be at least 24 hours in the future. Amount should be within the mandate limits.

Click “Send to PayU” to send the pre_debit_SI command. The customer will be notified of the upcoming debit.

After the pre-debit notification is acknowledged, proceed to execute the actual recurring payment.

Use the mihpayid from the Verify Payment response (auto-filled if you followed the flow).

Enter the recurring amount, a unique transaction ID, and customer details (name, email, address).

Click “Send to PayU” to execute the si_transaction command and debit the customer.

Use verify_payment with the SI txnid to confirm the payment was successful.

Use the same transaction ID (txnid) that was used in the si_transaction request.

Compute sha512(key|command|var1|salt) where command is verify_payment and var1 is the SI txnid.

Send key, command (verify_payment), var1 (txnid), and hash.

Look for status = success or failure to confirm whether the recurring debit was completed.