Zoho Payment Gateway-India Payment Gateway Webhook Setup Guide
Payment Gateway Webhook Setup Guide for India
Introduction to Webhooks in Indian Payment Gateways
Webhooks are automated HTTP callbacks that notify your server about payment events in real-time. For Indian payment gateways like Razorpay, PayU, Paytm, CCAvenue, and others, webhooks are essential for handling asynchronous payment notifications.
Common Use Cases for Webhooks
- Successful/failed payment notifications
- Refund status updates
- Subscription/recurring payment alerts
- Dispute/chargeback notifications
Step-by-Step Setup Guide
1. Choose Your Payment Gateway Provider (Examples)
- Razorpay: Popular for startups and SaaS companies
- PayU: Widely used by e-commerce businesses
- Paytm: Preferred for mobile-first applications
- CCAvenue: Common with enterprise merchants
2. Prerequisites Before Setup:
- Production-ready website with HTTPS (SSL certificate)
- Server capable of receiving POST requests (Node.js/PHP/Python/Java etc.)
- Admin access to your payment gateway dashboard
3. Configuration Steps:
For Razorpay:
- Log in to your Razorpay Dashboard → Settings → Webhooks
- Click "Add New Webhook"
- Enter URL endpoint (e.g.,
https://yourdomain.com/webhook/razorpay) - Select relevant events:
payment.captured,payment.failed, etc. - Add secret key (optional but recommended)
- Test the webhook using test mode before going live
For PayU Money:
- Go to Merchant Dashboard → Integration → API Integration
- Navigate to "Webhook Settings"
- Add callback URL with HTTPS protocol only
4.Select transaction statuses: Success/Failure/Pending/etc.
5.Generate salt/key pair if required
For CCAvenue:
1.Access Merchant Panel → Service Integration Tab
2.Locate "Instant Transaction Notification" section
3.Input notification URL format:
https://yourdomain.com/ccavenuenotify?order_id=xxxxx
4.Set encryption parameters matching your implementation
4.Webhook Implementation Best Practices:
Security Measures:
# Example Python verification snippet (Razorpay)
import hmac
import hashlib
def verify_webhook_signature(body, signature):
secret = 'your_webhook_secret'
generated_signature = hmac.new(secret.encode(), body.encode(), hashlib.sha256).hexdigest()
return generated_signature == signature
# Usage
is_valid = verify_webhook_signature(request.body.decode('utf-8'), request.headers['X-Razorpay-Signature'])
Essential Checks:
1.Source IP validation against gateway’s whitelist IPs
2.HTTPS enforcement with TLS ≥ 1.2
3.Idempotency handling via unique event IDs
Testing & Troubleshooting:
| Issue | Solution |
|---|---|
| No calls received | Check firewall settings; Verify DNS resolution |
| Invalid signatures | Reconfirm shared secret; Validate encoding |
| Duplicate events | Implement idempotency keys/database deduplication |
Compliance Requirements Specific to India:
1.RBI mandates all transactions must have final confirmation via server-to-server notification
2.PCI-DSS compliance required if storing any card data temporarily
3.Data localization rules apply—ensure processing stays within India where required
Would you like me to elaborate on any specific aspect of this setup process or provide code samples for a particular programming language?
Advanced Payment Gateway Webhook Implementation for India
Handling Different Payment Gateway Protocols
1. Signature Verification Methods by Provider
Razorpay (HMAC-SHA256):
// Node.js verification example
const crypto = require('crypto');
function verifyRazorpayWebhook(body, razorpaySignature) {
const secret = process.env.RAZORPAY_WEBHOOK_SECRET;
const expectedSignature = crypto
.createHmac('sha256', secret)
.update(JSON.stringify(body))
.digest('hex');
return expectedSignature === razorpaySignature;
}
PayU (SHA-512 with Salt):
// PHP verification example for PayU
$hashSequence = "key|txnid|amount|productinfo|firstname|email||||||||||";
$hashSequence .= $SALT; // Your merchant salt from dashboard
if(strtolower($hash) != strtolower(hash('sha512', $hashSequence))) {
// Reject unauthorized webhook call
}
2. Database Design Considerations
Create these tables for proper webhook handling:
payment_webhooks (
id BIGINT PRIMARY KEY,
gateway ENUM('razorpay','payu','ccavenue'),
event_id VARCHAR(255) UNIQUE, # Gateway's event identifier
event_type VARCHAR(50),
)
payment_transactions (
)
Country-Specific Requirements Implementation
RBI Mandate Compliance Code Example:
def handle_rbi_compliance(payment_data):
if not payment_data.get("utr"):
raise Exception("UTR number missing - violates RBI guidelines")
if payment_data["currency"] != "INR":
raise Exception("Forex transactions require additional compliance checks")
# Store in India-located datacenter if required
Chinese