Payments

When a customer pays, the gateway's checkout (a hosted page, a pop-up or a mobile SDK) collects the payment details so they never touch your server. It routes the request through the card network or UPI to the customer's bank, returns success or failure within seconds, and later settles the money, minus its fee, into your bank account, usually one or two working days later (T+1 or T+2).

In India the RBI licenses payment aggregators, companies such as Razorpay, Cashfree and PayU that collect money on a merchant's behalf and must verify every merchant they sign up. A pure payment gateway only provides the technology while a bank handles the funds, but in everyday speech both are called gateways. Most add extras on top: payment links, subscriptions, invoices, split payments for marketplaces and payouts.

The usual flow has three steps. Your server creates an order through the Orders API, with the amount in paise; the website or app opens Razorpay Checkout with that order id; after the customer pays, Checkout returns a payment id and a signature, which your server checks with its secret key before marking the order paid. Webhooks such as payment.captured confirm the result even if the customer closes the page.

Beyond the gateway there are Payment Links and Payment Pages (no code needed), Subscriptions, Smart Collect virtual accounts, Route for splitting money between vendors, Instant Settlements, and RazorpayX for business banking and payouts. SDKs cover the web, Android, iOS, Flutter and React Native, and plugins exist for Shopify and WooCommerce. Money normally settles two working days after capture (T+2).

Test mode works as soon as you sign up, with test keys and test cards. Live payments need KYC (PAN, bank account and business details) and a website or app that shows terms, privacy, refund and contact pages, which Razorpay reviews before activating the account.

Stripe gives developers building blocks: Checkout (a hosted payment page), Elements (card and wallet fields you embed in your own page), Payment Links (no code), Billing for subscriptions and invoices, Connect for marketplaces that pay out to sellers, Radar for fraud screening and Tax for sales tax and VAT. A PaymentIntent object tracks each payment from creation to success, and webhooks report every change.

The API is built around developers: versioned endpoints, a full test mode with test cards, idempotency keys that make retries safe, and a log of every request in the dashboard. Standard US pricing is 2.9% plus 30 cents per successful card payment, with extra fees for international cards and currency conversion.

In India, Stripe has been invite-only since May 2024 and focuses on Indian businesses that sell abroad, so most businesses selling within India use a local gateway instead. It added UPI as a payment method in 2026, for customers paying in rupees.

Buyers log in to PayPal (or check out as a guest with a card), approve the payment, and the seller never sees their card or bank details. PayPal also offers invoicing, payment links, subscriptions, Pay Later instalments in some countries and Venmo in the US. Braintree, which PayPal owns, is its developer-focused gateway for larger merchants.

Since April 2021, PayPal in India has handled only international payments: an Indian freelancer, exporter or studio can receive money from clients abroad, but Indian customers cannot pay an Indian business through it. Each payment needs an RBI purpose code (such as export of software services), the money is withdrawn to an Indian bank account in rupees, and PayPal provides a FIRA as proof of the foreign payment.

Buyer protection lets customers open disputes, and PayPal charges sellers a dispute fee in some cases. Accounts that see unusual activity can have money held for a while, so keeping invoices and delivery records makes disputes easier to answer.

Cashfree works much like other Indian gateways: your server creates an order, the customer pays through Cashfree's hosted checkout or SDK, and your server confirms the result by fetching the order status and checking signed webhooks. It supports UPI intent, collect, QR code and payment-link flows, cards, netbanking, wallets, EMI and Pay Later, plus payment links and forms that need no code.

Its Payouts product sends money out in bulk, to vendors, sellers, delivery partners or customers owed a refund, through an API or a spreadsheet upload, which suits marketplaces and gig platforms. Easy Split divides each payment between vendors automatically, and a verification suite checks bank accounts, UPI IDs, PAN and GSTIN before money moves. Standard settlement is two working days after the payment (T+2).

UPI was built by NPCI (National Payments Corporation of India) and launched in 2016. A bank account is linked to a UPI ID such as name@bank, and apps such as Google Pay, PhonePe, Paytm and BHIM, or a bank's own app, let the customer approve a payment with a UPI PIN. Money moves between banks instantly, at any hour, and a single payment is usually capped at ₹1 lakh, with higher limits for some categories.

Online, a gateway offers UPI in a few ways: an intent flow that opens the customer's UPI app on a phone, a QR code to scan from a desktop screen, or a collect request sent to a UPI ID. UPI Autopay handles subscriptions: the customer approves a mandate once, and later debits of up to ₹15,000 go through automatically after an advance notice.

UPI carried zero MDR (no fee for merchants) from January 2020. Under an NPCI framework that applies from 15 October 2026, most merchants pay 0.4% on payments above ₹2,000, capped at ₹300 a payment, while payments up to ₹2,000, person-to-person transfers and small merchants receiving up to ₹1 lakh a month through QR codes stay free. Some sectors, such as fuel and railways, pay a flat ₹5 instead, and the charge may not be passed on to customers. Gateways add their own platform fee on top, usually about 2%.

The customer signs up and authorises future charges; the provider stores a mandate or a saved payment method and charges it on schedule. A billing system (Stripe Billing, Razorpay Subscriptions, Cashfree Subscriptions or Chargebee) tracks plans, trials, upgrades, proration and invoices, and uses webhooks to tell your app when a renewal succeeds or fails, so access can be switched on or off.

India adds rules. Under RBI's e-mandate framework, the customer registers a mandate once with an extra authentication step; each later debit up to ₹15,000 (₹1 lakh for insurance, mutual funds and credit card bills) then runs automatically, after a notice at least 24 hours before, and the customer can cancel at any time. Cards and UPI Autopay follow these rules; eNACH mandates debit bank accounts directly.

Renewals fail for ordinary reasons (expired cards, low balances), so billing tools retry on a schedule and send reminders, a process called dunning. Apps that sell digital content inside an Android or iOS app usually have to use Google Play or App Store billing instead, under the stores' rules.

MDR (merchant discount rate) is split between the parties that move the money: the customer's bank (the issuer), the merchant's bank (the acquirer), the card network or UPI app, and the gateway. Gateways usually quote one all-in figure, sometimes called TDR (transaction discount rate) or a platform fee, and deduct it from each payment before settlement. In India, 18% GST is charged on the fee, not on the payment.

Rates depend on the method. RBI caps debit card MDR at 0.4% (at most ₹200 a payment) for merchants with turnover up to ₹20 lakh a year, and 0.9% (at most ₹1,000) above that. Credit card rates are set commercially and cost more, with premium, corporate and international cards the most expensive. UPI was free for merchants from 2020; from 15 October 2026, most payments above ₹2,000 carry 0.4%, capped at ₹300. Indian gateways typically charge about 2% on most methods and about 3% on premium and international cards.

Refunds usually do not give back the original fee, and chargebacks can add a fee of their own, so a refunded sale still costs money. The UPI framework also forbids passing MDR on to customers as a surcharge.

The browser cannot be trusted: a customer, or an attacker, can fake a 'payment successful' message or edit the amount in the page. So after checkout, the server checks the gateway's proof. Razorpay returns a signature, an HMAC SHA256 of the order id and payment id made with your secret key, which the server recomputes and compares; other gateways let the server fetch the payment from their API and compare its status, amount and currency with the order it created.

Webhooks are the second half. The gateway calls your server when a payment is captured, fails or is refunded, so the order is updated even if the customer closed the tab. Each webhook carries a signature header (X-Razorpay-Signature, Stripe-Signature) that must be checked against the raw request body with the webhook secret, and the handler should be idempotent, because the same event can arrive more than once.

Networks fail at awkward moments: a request times out, the app retries, and the first attempt had actually worked. With an idempotency key, the client sends a unique id with the request (Stripe uses an Idempotency-Key header); the server stores the result against that key and returns the same result for any repeat instead of acting again.

The same idea protects webhook handlers, since gateways retry deliveries and may send an event more than once: record each event or payment id, skip ones already processed, and back that with a unique constraint in the database so two copies arriving together cannot both win. In HTTP, GET, PUT and DELETE are meant to be idempotent; POST is not, unless you make it so.

Refunds go back to the original payment method through the gateway's dashboard or API, in full or in part. Card and UPI refunds usually take several working days to reach the customer, which is worth stating on the refund page. Most gateways do not charge for a refund but keep the fee from the original payment, and some offer instant refunds for an extra fee.

A chargeback starts with the customer's bank: the customer reports fraud, a missing delivery or a double charge, the bank pulls the money back, and the gateway asks the merchant for evidence such as invoices, delivery proof or logs. Missing the response deadline usually means losing automatically, many gateways add a chargeback fee, and too many chargebacks can get an account restricted.

In India, RBI rules require payment aggregators to verify each merchant before live payments start. Expect to share a PAN, ID and address proof for the owner or signatory, a bank account in the business's name (or the owner's name for a sole proprietor), and business proof such as a GST certificate, a shop and establishment licence, a partnership deed or a certificate of incorporation, depending on the type of business.

Gateways also review what you sell and where: prohibited categories are refused, and the website or app usually needs visible terms, privacy, refund and contact pages, with prices that match what the customer pays. Test mode needs none of this, so integration can start on day one while the paperwork catches up.

Elsewhere the idea is the same under anti-money-laundering rules, and businesses that pay money out to their own users, such as marketplaces, may have to verify those users too.

PCI DSS (Payment Card Industry Data Security Standard) is maintained by the PCI Security Standards Council, founded by Visa, Mastercard, American Express, Discover and JCB. It covers network security, encryption, access control, logging and regular testing. Large merchants and payment companies are assessed by auditors every year, while smaller merchants fill in a self-assessment questionnaire (SAQ).

The simplest way to comply is never to see card numbers. With a hosted checkout, a redirect, or card fields that load from the gateway inside an iframe (Stripe Elements, Razorpay Checkout), card data goes straight to the gateway, and the site usually qualifies for the shortest questionnaire, SAQ A. A home-made card form that posts to your own server pulls that whole server into scope.

India goes further: since October 2022, RBI rules have barred merchants from storing card numbers at all. Saved cards work through network tokens, stand-in numbers issued by the card networks that only work for that merchant.