1. Authentication Keys
Gateway API requests require two headers for authentication:
2. Create Payment Order API
Call POST /api/v1/payment/orders from your website backend whenever a customer clicks "Checkout" or "Buy Product".
Request Payload (JSON):
{
"order_id": "STORE_ORD_10029",
"amount": "10.00",
"currency": "INR",
"customer_email": "customer@example.com",
"customer_phone": "9876543210"
}Code Integration Snippets:
import requests
url = "https://PayZen.pythonanywhere.com/api/v1/payment/orders"
headers = {
"Content-Type": "application/json",
"X-Api-Public-Key": "pub_live_your_public_key",
"X-Api-Secret-Key": "sec_live_your_secret_key"
}
payload = {
"order_id": "ORDER_9912",
"amount": "10.00",
"currency": "INR"
}
response = requests.post(url, json=payload, headers=headers)
data = response.json()
print("Checkout Page URL:", data["checkout_url"])const axios = require('axios');
async function createPaymentOrder() {
const res = await axios.post('https://PayZen.pythonanywhere.com/api/v1/payment/orders', {
order_id: 'ORDER_9912',
amount: '10.00',
currency: 'INR'
}, {
headers: {
'Content-Type': 'application/json',
'X-Api-Public-Key': 'pub_live_your_public_key',
'X-Api-Secret-Key': 'sec_live_your_secret_key'
}
});
console.log("Redirect to:", res.data.checkout_url);
}<?php
$ch = curl_init('https://PayZen.pythonanywhere.com/api/v1/payment/orders');
$payload = json_encode([
'order_id' => 'ORDER_9912',
'amount' => '10.00',
'currency' => 'INR'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'X-Api-Public-Key: pub_live_your_public_key',
'X-Api-Secret-Key: sec_live_your_secret_key'
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
$response = curl_exec($ch);
$data = json_decode($response, true);
header('Location: ' . $data['checkout_url']);
exit;
?>3. Redirecting to QR Checkout Page
Order create hone ke baad API response me aapko checkout_url milega (e.g. http://127.0.0.1:8000/pay/pay_live_.../).
Aap customer ko directly is URL par redirect kar dete hain. Dynamic QR page par customer UPI scan karke pay karega, automatic status poll hoga aur time expire hone par Continue Payment & Cancel options milenge.
4. Handling Webhook Notifications
Jab payment success hoti hai, Gateway aapke registered Webhook URL par Signed HTTP POST Request bhejta hai.
Webhook Event Payload Example:
{
"event": "payment.success",
"payment_id": "pay_live_883b2990791942b66fff1583",
"order_id": "STORE_ORD_10029",
"amount": "10.00",
"currency": "INR",
"status": "SUCCESS",
"provider_reference": "UTR20260812E8B88997",
"timestamp": "2026-08-12T20:25:00Z"
}Webhook Signature Verification Code (Python Example):
import hmac
import hashlib
def verify_gateway_webhook(raw_request_body, received_signature, webhook_secret):
"""
Verifies that the incoming webhook POST was generated by PayZen Gateway
using HMAC SHA-256 algorithm.
"""
computed_signature = hmac.new(
webhook_secret.encode('utf-8'),
raw_request_body,
hashlib.sha256
).hexdigest()
return hmac.compare_digest(computed_signature, received_signature)
# Usage in Django View / Flask Route:
# signature = request.headers.get('X-Gateway-Signature')
# if verify_gateway_webhook(request.body, signature, "whsec_your_secret"):
# # Mark order as PAID in your database!
# print("Valid Webhook!")5. Test vs Live Mode Guidelines
Use during development. Checkout page provides a "Simulate Scan & Pay" button to test payment success without real bank transfers.
Use in production for real customer orders. Test simulation buttons are strictly disabled and blocked on backend for security.
6. Server-Side Amount Locking & Tamper Prevention
Q: Kya customer browser me Inspect Element (DevTools) se HTML text ₹1000 ko ₹1 edit karke payment fraud kar sakta hai?
NAHI, BILKUL NAHI (100% IMPOSSIBLE). Hamari Gateway Architecture is type ke client-side tampering attacks ko 3 layers par block karti hai:
-
Layer 1 — Server-Side Immutable Database Lock:
Amount kabhi bhi customer ke browser HTML ya Frontend se nahi aata. Amount strict aapke Merchant Backend API call (
POST /api/v1/payment/orders) se aata hai aur Gateway Database me lock ho jaata hai. -
Layer 2 — Dynamic Server-Generated QR Code:
Browser par jo QR code dikhta hai (
/pay/{id}/qr.png), uska PNG image Python ReportLab/QRCode library direct Gateway Server database amount se render karti hai. Bhale hi user browser me HTML display text edit kar le, QR code me encoded amount badalna browser user ke liye impossible hai! -
Layer 3 — Real-Time Bank Settlement Amount Matching:
Jab bank se payment notification aati hai, Gateway verify karta hai ki
amount_paid == order.amount. Agar 1 paise ka bhi mismatch milta hai, transaction instant REJECT (Security Alert: Amount Tampering) ho jaata hai.
7. Shopify Store Integration Guide
Step-by-step guide to connect PayZen Payment Gateway to any Shopify Store.
1 Create a Private / Custom App in Shopify Admin
1. Open your Shopify Admin panel: Settings -> Apps and sales channels -> Develop apps.
2. Click "Create an app", name it PayZen Payment App.
3. Under Admin API Scopes, grant write_orders and read_orders permissions.
4. Install App & copy your Shopify Admin API Access Token (shpat_...).
2 Add Custom "Pay via Dynamic UPI QR" Button to Shopify Theme
In your Shopify Theme Liquid file (sections/cart-template.liquid or layout/theme.liquid), add a custom button:
<!-- Shopify Liquid Cart Button -->
<button type="button" onclick="payWithPayZenMediaUPI()" class="btn btn--primary" style="background:#059669; color:#fff;">
⚡ Pay via Dynamic UPI QR Code
</button>
<script>
async function payWithPayZenMediaUPI() {
// 1. Fetch Cart Total Amount from Shopify JS object
const cart = await (await fetch('/cart.js')).json();
const amountInINR = (cart.total_price / 100).toFixed(2);
// 2. Call your backend middleware / App proxy endpoint
const response = await fetch('/apps/PayZen/create-order', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
shopify_cart_id: cart.token,
amount: amountInINR,
customer_email: ''
})
});
const data = await response.json();
if (data.checkout_url) {
// 3. Redirect customer to Gateway Dynamic QR Page
window.location.href = data.checkout_url;
}
}
</script>3 Auto-Mark Shopify Order as PAID via Webhook Callback
When customer pays on PayZen Gateway QR Page, Gateway dispatches a Webhook to your Shopify App middleware. Your middleware calls Shopify Admin REST API to mark the order PAID & Ready for Fulfillment:
# Python / Node.js Shopify Webhook Listener Handler Example
import requests
def on_PayZen_payment_success_webhook(payload):
shopify_order_id = payload['order_id'] # e.g. 58392019482
shopify_store = "your-shop-name.myshopify.com"
access_token = "shpat_your_admin_access_token"
# Call Shopify Order Transaction API to capture payment
url = f"https://{shopify_store}/admin/api/2026-04/orders/{shopify_order_id}/transactions.json"
headers = {
"X-Shopify-Access-Token": access_token,
"Content-Type": "application/json"
}
transaction_data = {
"transaction": {
"kind": "capture",
"status": "success",
"amount": payload['amount'],
"gateway": "PayZen UPI Gateway"
}
}
res = requests.post(url, json=transaction_data, headers=headers)
print("Shopify Order Marked PAID Status:", res.status_code)