Razorpay integration in a website: steps and mistakes

To integrate Razorpay in a website you have two routes. With no code, share Payment Links, publish a Payment Page, paste a Payment Button, or install a plugin for your platform. With code, use Standard Checkout: your server creates an order, the browser opens Razorpay Checkout with that order, and your server verifies the payment signature and confirms it by webhook. Before going live you need a Razorpay account, KYC and website details. As listed on 9 October 2026, Razorpay's pricing page shows setup, maintenance and integration support at Rs 0, and 2% plus GST on the standard plan.

Pick your route

Razorpay's docs say Payment Links "let you accept payments without a website or app". This guide covers Standard Checkout.

Before you go live

Sign up, then submit KYC (identity checks). The account setup page lists what to give:

• Unregistered individual: a personal PAN, identity verification through Central KYC, DigiLocker or a video call, and bank details checked with a Rs 1 deposit.
• Registered business: the business PAN, date of incorporation, any one of a GST certificate or a Udyam (MSME) certificate, and one additional document such as a Shop Establishment certificate. There is an "I don't have a GSTIN" option.
• Proprietorship: the proprietor's PAN.

The business website details page says you must give live website or app details at activation. Without them you cannot get live API keys, though Payment Links and Invoices still work. It asks for links to About us, Contact us, Pricing details, Terms and conditions, Privacy policy and Cancellation/Refund policy. Build these pages first.

Standard Checkout, in order

Generate API keys from the Dashboard first. Test and live modes have separate keys. These are the official integration steps.

1. Create an order on your server with the Orders API. Pass the amount, the currency and your own receipt id. The amount is in the smallest unit, so Rs 500 is 50000.
2. Open Checkout in the browser. Load checkout.js and pass your Key Id, the amount, the currency and the order_id your server returned. Payments made without an order id "cannot be captured and will be automatically refunded".
3. Handle the result. On success the browser gets razorpay_payment_id, razorpay_order_id and razorpay_signature. Send them to your server.
4. Verify the signature on your server. Build an HMAC hex digest with SHA256 over order_id + "|" + razorpay_payment_id, using your key secret. If it equals razorpay_signature, the details are authentic. Use the order id you stored, not the one the browser sent back. The docs say to do this "before fulfilling the order", and to reject the order if it fails.
5. Confirm the payment status. A successful payment is captured. Check the Dashboard, subscribe to webhooks, or poll the API.

The docs recommend auto-capture, set once on the Dashboard. Uncaptured payments are refunded automatically.

Server side in Node.js, in the shape of the official docs:

const Razorpay = require("razorpay");
const crypto = require("crypto");

const rzp = new Razorpay({
  key_id: process.env.RZP_KEY_ID,
  key_secret: process.env.RZP_KEY_SECRET,
});

// Step 1: amount in paise (Rs 500 = 50000)
function createOrder(rupees, receipt) {
  return rzp.orders.create({
    amount: Math.round(rupees * 100),
    currency: "INR",
    receipt,
  });
}

// Step 4: orderId is the one you saved
function isValid(orderId, paymentId, signature) {
  const expected = crypto
    .createHmac("sha256", process.env.RZP_KEY_SECRET)
    .update(orderId + "|" + paymentId)
    .digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Keep the key secret on the server only.

Webhooks

The browser can close before your server hears anything. The webhook docs call webhooks the primary method for event notifications. Add one under Accounts & Settings, then Webhooks, with a public URL, a secret and an alert email. Test and live are configured separately, and only ports 80 or 443 work. Events you will likely want:

• payment.captured and payment.failed.
• order.paid: the order is fully paid. A good trigger for fulfilment.

Rules from the docs:

• Return a 2xx quickly. Any non-2xx is a failure. Razorpay retries with exponential backoff for 24 hours, then disables the webhook.
• The same event can arrive more than once. If your server does not answer within 5 seconds, it is sent again. Use the x-razorpay-event-id header, unique per event, to skip repeats. A repeated order.paid can ship an order twice.
• Events can arrive out of order.
• Verify the signature. The validation page says to pass the raw request body and "do not parse or cast" it. Use the SDK helper with your webhook secret.

Same repeat-safe thinking: how to prevent double booking.

Test mode, then live

Test mode uses test keys and a mock bank page with Success and Failure buttons. No real money moves. The docs list a test UPI id, success@razorpay.

To go live, generate live keys on the Dashboard and replace the test keys in your Checkout code and server. With test keys still in place, customers see a payment success screen but nothing is captured or settled.

The pricing page says funds are settled "typically T+1 or Instant". The settlements docs say the standard domestic cycle is T+2 working days.

Common mistakes

• Sending 499 for Rs 499. The amount is in paise, so that charges Rs 4.99.
• Putting the key secret in front-end code. Only the Key Id belongs in the browser.
• Using callback_url instead of the handler. The docs say that for a standard web integration it bypasses the handler.

Weighing gateways first? See Razorpay vs Cashfree vs PayU. Need payments built into a site or app? Tell us about your project.

Frequently asked questions

How can I integrate a payment gateway into my website?

With no code, use Payment Links, a Payment Page, a Payment Button or a platform plugin. With code, use Standard Checkout, then switch from test keys to live keys once your account is activated.

Is Razorpay integration free?

As listed on 9 October 2026, setup, maintenance and integration support are Rs 0. You still pay the per-transaction fee, 2% plus GST on the standard plan, and developer time to build it.

Which websites are accepted by Razorpay?

Websites that pass activation checks: links to the policy and contact pages above, and an allowed business category. Razorpay's terms prohibit alcohol, gambling, bulk marketing tools and counterfeit goods.

Can I use Razorpay on multiple websites?

Yes, with limits. Razorpay's docs say you can have one main website and five additional ones, and the feature is available only if your products or services fall under the e-commerce category. Each additional site must be submitted for review.