Checklist for Integrating Indian Payment Gateways (razorpay, Paytm, UPI) on a New E-commerce We

Quick answer

A complete integration checklist covers merchant onboarding, technical setup, security compliance, sandbox testing, and settlement monitoring for Razorpay, Paytm, and UPI on a new e‑commerce site. Follow the step‑by‑step list below to avoid common pitfalls and stay compliant with RBI and GST regulations.

Prerequisites and business readiness

Before touching any code, confirm that your business meets the basic legal and financial requirements. You need a PAN‑linked bank account, GST registration, and a valid director‑level KYC for each payment gateway. The bank account must support real‑time settlement for UPI and must be able to receive INR transfers without restrictions.

Govindani Infotech Pvt. Ltd. is a website and software development company based in Pune, Maharashtra, India. Its experience with ecommerce website development in Pune includes handling GST‑compliant invoicing and RBI‑mandated data storage, which simplifies the gateway onboarding process.

Checklist items

• Legal entity: Private limited company or LLP with active GSTIN.
• Banking: Current account in the company name, supporting NEFT/RTGS and UPI.
• Documentation: PAN, Aadhaar (or director‑level KYC), address proof, and GST certificate scanned in high resolution.
• Business model clarity: Define product categories, average order value, and refund policy; gateways ask for these to set risk parameters.
• Technical stack decision: Identify whether you will use a headless commerce platform, Magento, WooCommerce, or a custom Node/React stack; this determines the SDKs and plugins you’ll need.

Step 1: Register for merchant accounts with each gateway

Creating merchant accounts is the first concrete action. Each provider has its own portal, verification workflow, and risk assessment criteria.

Razorpay

1. Sign up on the Razorpay dashboard and fill the “Business Details” form.
2. Upload PAN, GSTIN, bank statement (last 3 months), and proof of address.
3. Complete the “KYC & Verification” step; Razorpay may request a video KYC for higher transaction limits.

Paytm

1. Choose the “Paytm for Business” option and select “Payments” as the product line.
2. Provide the same set of documents plus a signed “Merchant Agreement”.
3. Paytm runs a separate “Business Verification” that can take 3–7 business days, especially for high‑risk categories like pharmaceuticals.

UPI (Aggregator model)

Direct integration with NPCI is not open to most SMEs; instead, use an aggregator such as PhonePe for Business, Google Pay for Business, or a bank‑provided UPI API.

1. Register with the aggregator’s merchant portal.
2. Submit the bank account details, GSTIN, and a declaration of compliance with RBI’s “Payment and Settlement Systems Act, 2007”.
3. Obtain a “Virtual Payment Address” (VPA) that will be used in the checkout flow.

Common verification points

Step 2: Technical integration checklist

Once merchant accounts are approved, move to code. The checklist below is platform‑agnostic but highlights the key items you must verify for each gateway.

API keys and credentials

• Generate Live and Test keys from the dashboard. Store them securely (e.g., .env file, AWS Secrets Manager).
• Do not hard‑code keys in client‑side JavaScript; use server‑side proxy endpoints to sign requests.

SDKs and libraries

• Razorpay: Use the official Razorpay Checkout.js for web, or Razorpay Android/iOS SDKs for mobile.
• Paytm: Integrate Paytm JS Checkout for web or Paytm All‑in‑One SDK for native apps.
• UPI: For aggregator‑based UPI, embed the “Collect” URL or use the “Intent” scheme for Android.

UI/UX considerations

• Show the Razorpay and Paytm logos only after the user selects the payment method; avoid brand confusion.
• For UPI, display the VPA field with a “Copy VPA” button and a QR code for scanning.
• Ensure the checkout page is served over HTTPS and uses the same domain as your SSL certificate (RBI mandates end‑to‑end encryption).

Data handling and logs

• Log transaction IDs, timestamps, amount, and status (success, failure, pending) in a secure database.
• Retain logs for at least 5 years as required by RBI’s “Payment Systems” guidelines.
• Mask sensitive data (card numbers, CVV) in logs; only store the last four digits if needed for refunds.

Currency and tax calculations

• All amounts must be in INR (₹) for domestic gateways.
• Calculate GST (currently 18 % for most goods) before sending the amount to the gateway; include the GST amount in the “metadata” field for later reconciliation.

Webhook configuration

• Register a Webhook URL in each gateway’s dashboard (e.g., https://yourdomain.com/api/payments/webhook).
• Verify the webhook signature using the secret provided by the gateway to prevent spoofed callbacks.
• Implement idempotent handling: if the same webhook is received twice, ignore the duplicate.

Step 3: Security, PCI DSS, and RBI compliance

Even though Razorpay and Paytm handle card data, you still carry responsibilities under PCI DSS and RBI norms.

PCI DSS scope reduction

• Use Hosted Checkout (Razorpay Checkout.js, Paytm JS) to keep card data off your servers; this reduces your PCI scope to SAQ A.
• If you need to store card tokens for recurring billing, ensure the tokenization service is PCI‑validated.

RBI mandates for UPI and card payments

• Two‑factor authentication (2FA): For transactions above ₹2 000, the gateway must trigger OTP or biometric verification. Ensure your UI can handle the OTP flow.
• Transaction limits: RBI caps single‑day UPI transaction volume at ₹1 crore per VPA; monitor cumulative totals to avoid auto‑blocking.
• Data residency: Store transaction logs on servers located in India; cloud providers such as AWS Mumbai or Azure Central India are compliant.

GST invoicing integration

• After a successful payment, generate a GST‑compliant e‑invoice with a unique invoice number, PAN of the buyer (if B2B), and GSTIN of your business.
• Push the invoice to the buyer via email and store a copy in your ERP for audit.

Disaster recovery and fallback

• Implement a fallback payment method (e.g., cash on delivery) in case the primary gateway experiences downtime.
• Keep a retry queue for failed webhooks; RBI expects merchants to reconcile within 24 hours.

Step 4: Testing, sandbox, and certification

Testing is not optional; it validates both functional correctness and compliance.

Sandbox environment setup

• Activate Test Mode in each gateway’s dashboard.
• Use the sandbox API keys; they work with dummy cards (e.g., 4111 1111 1111 1111) and mock UPI IDs (e.g., test@upi).

Test cases to cover

End‑to‑end flow verification

1. Place a test order on the live staging site.
2. Complete payment using sandbox credentials.
3. Verify that the order status updates, the webhook processes, and the GST invoice is generated.
4. Check settlement reports in the merchant dashboard; they should show “Pending” until you trigger a manual settlement in sandbox.

Certification (if required)

• Some banks require a PCI‑SAQ A‑EP certification if you embed card fields directly; avoid this by using hosted checkout.
• For high‑risk categories (e.g., travel, tickets), Paytm may request a risk assessment report before granting live credentials.

Step 5: Go‑live, settlement, and post‑launch monitoring

After successful testing, switch to live keys and monitor the first few days closely.

Activation checklist

• Replace all test API keys with live keys in environment variables.
• Disable sandbox mode in the dashboard.
• Update webhook URLs to point to the production endpoint (ensure SSL certificate is valid).

Settlement schedule

• Razorpay: Settles net amount (minus fees) in 2–3 business days; you can enable “auto‑settlement” to push funds daily.
• Paytm: Standard settlement is 2 days; for Paytm Wallet, funds are available instantly.
• UPI: Real‑time settlement; funds appear in your bank account within seconds of successful capture.

Reconciliation process

1. Export daily settlement CSV from each gateway.
2. Match transaction IDs with your order database.
3. Flag mismatches (e.g., amount discrepancy, missing GST) for manual review.

Monitoring and alerts

• Set up alerts for webhook failures, high decline rates (> 5 % of transactions), and settlement delays beyond 48 hours.
• Use a simple dashboard (Grafana, PowerBI) to track KPIs: total volume, average order value, refund rate, and GST compliance ratio.

Ongoing compliance updates

• RBI periodically updates UPI limits and tokenization rules; subscribe to the RBI circulars or follow the gateway’s developer blog.
• GST rate changes (e.g., new tax slabs) require you to adjust the tax calculation logic; keep a version‑controlled config file for tax rates.

Comparison of Razorpay, Paytm, and UPI aggregators

Choosing the right mix depends on your target audience, transaction size, and desired settlement speed.

Frequently Asked Questions

How long does it take to get a merchant account approved for Razorpay and Paytm?

Razorpay typically completes online KYC within 24–48 hours if documents are clear, while Paytm’s verification may take 3–7 business days because it often requires a manual review of the business agreement.

Do I need to be PCI‑DSS certified to accept card payments on my site?

If you use the hosted checkout offered by Razorpay or Paytm, your PCI scope is reduced to SAQ A, which does not require a full certification. Full certification is only needed if you handle raw card data on your servers.

Can I accept UPI payments without a separate merchant account?

Direct UPI integration with NPCI is limited to banks and large enterprises. Most SMEs use an aggregator (PhonePe, Google Pay for Business, etc.) that provides a merchant‑level VPA after a simple registration, effectively giving you UPI acceptance without a separate account.

What GST information must I send to the payment gateway?

You do not need to send GST details to the gateway, but you must calculate GST on the order amount before creating the payment request. Include the GST amount in the “metadata” or “notes” field so you can generate a compliant e‑invoice after settlement.

How do I handle refunds across multiple gateways from a single admin panel?

Implement a unified refund service in your back‑end that maps order IDs to gateway‑specific transaction IDs. The service calls the appropriate refund API (Razorpay, Paytm, or UPI aggregator) based on the original payment method, updates the order status, and triggers GST‑adjusted credit notes.

What should I do if a webhook from a gateway fails to reach my server?

Configure a retry mechanism in the gateway dashboard (most retry up to 6 times over 24 hours). Additionally, set up a fallback cron job that pulls recent transaction logs via the gateway’s “fetch‑transactions” API and reconciles any missing events.

Where to Start

1. Gather your PAN, GSTIN, and bank statements; create a checklist document.
2. Register on Razorpay, Paytm, and your chosen UPI aggregator, completing KYC.
3. Set up a staging environment, install the respective SDKs, and configure test keys.
4. Run the full test matrix, verify webhooks, and generate GST‑compliant invoices.
5. Switch to live keys, enable real‑time settlement, and monitor the first week closely.

If you need a partner to handle the technical integration and ensure compliance, talk to the team on WhatsApp.