1. Access Payment APIs using OAuth
You can process payments on behalf of your sub-merchants using Razorpay APIs. Use the tokens generated during OAuth integration. Use theaccess_token generated in the build integration step to authenticate using Bearer Auth.
Below is a sample code to create an Order and process payments.
/orders
Request
2. Public Token
Using thepublic_token for authorisation can secure a public-facing implementation such as Razorpay Checkout. In such cases, the public_token can replace the key_id field as shown below:
Checkout
3. Verify Payment Signature
This is a mandatory step to confirm the authenticity of the details returned to the Checkout form for successful payments. To verify therazorpay_signature returned to you by the Checkout form:
-
Create a signature in your server using the following attributes:
order_id: Retrieve theorder_idfrom your server. Do not use therazorpay_order_idreturned by Checkout.razorpay_payment_id: Returned by Checkout.client_secret: Available in your server. Theclient_secretthat was generated from the RazorpayDashboard.
-
Use the SHA256 algorithm, the
razorpay_payment_idand theorder_idto construct a HMAC hex digest as shown below:HMAC Hex Digest -
If the signature you generate on your server matches the
razorpay_signaturereturned to you by the Checkout form, the payment received is from an authentic source.
Generate Signature on Your Server
Given below is the sample code for payment signature verification:Java