Razorpay Payment Extension

Accept payments via Razorpay on your TastyIgniter site. Razorpay supports cards, UPI, netbanking, wallets, EMI, and Pay Later, and is not limited to Indian merchants or customers — see Supported Regions below.

Supported Regions

Razorpay isn't limited to Indian merchants. A business can register a Razorpay merchant account in one of four countries:

• India — the primary market, with the full range of local methods (UPI, netbanking, wallets, EMI, Pay Later) alongside cards.
• Malaysia — Bank Negara Malaysia-regulated, a PayNet member supporting DuitNow and local Malaysian payment methods.
• Singapore
• United States

All four run on the same underlying API (api.razorpay.com) this extension integrates with, so a Key ID/Secret from any of them works without any code changes.

On top of that, any merchant account in any of these four countries can accept card payments from customers in 180+ countries, across 100+ currencies, regardless of where the merchant is registered.

Note that not every payment method (UPI, netbanking, etc.) is available to merchants outside India; the Payment Methods setting below lets you show only what your account actually supports.

Features

• Multiple payment methods — card, UPI, netbanking, wallet, EMI, and Pay Later via Razorpay Checkout
• Authorize & Capture or Authorize Only — auto-settle immediately, or hold funds and capture later
• Saved cards — returning customers are recognized in Checkout and can pay without re-entering card details
• Payment method restriction — hide unselected methods from the Checkout UI
• Refunds — full or partial refunds initiated from the admin order view
• Webhook handling — server-to-server payment confirmation with HMAC SHA256 signature validation
• Checkout callback validation — a second, independent HMAC SHA256 check on the browser return
• Multi-currency — supports any currency your Razorpay account settles in

Quick Start

Installation

composer require tipowerup/ti-ext-razorpay
php artisan igniter:up

Requirements

• TastyIgniter v4.0+
• PHP 8.2+

Setup

1. Go to Manage > Settings > Payment Gateways in the admin panel
2. Edit the Razorpay payment method
3. Select Transaction Mode (Test or Live) and enter your matching API Key / Key ID and Secret
4. Enter the Webhook Secret for that mode (see Webhook below)
5. Toggle Status to ON and click Save

Configuration

Settings Overview

Razorpay API Keys

Get your API keys from your Razorpay Dashboard under Account & Settings > API Keys. Always test against the test keys before going live.

Transaction Types

Authorize & Capture (default)

Razorpay captures funds automatically as soon as the customer completes payment. The order is marked paid once capture is confirmed, either via the browser callback or the webhook.

Authorize Only

Funds are authorized but not captured immediately. The order is marked processed as soon as authorization is confirmed, so it can proceed to fulfillment — capture is triggered separately, later, once the order's status matches the Capture Status configured above.

Capture window: Razorpay auto-voids an authorization that isn't captured within 2 hours. Make sure your fulfillment workflow moves qualifying orders to the capture status within that window, or the capture attempt will fail and the customer will need to be charged again through a new order.

Razorpay has no void/cancel endpoint for an authorized-but-uncaptured payment — cancelling one instead issues an immediate refund, the closest available equivalent.

Payment Methods

Set Payment Methods to Custom Selection and check which of Card, UPI, Netbanking, Wallet, EMI, and Pay Later should be offered.

This only hides the unselected methods in the Razorpay Checkout UI — it is advisory, not a server-side block, since Razorpay does not expose an API to disable payment instruments on your account. Only enable methods here that you're actually prepared to accept.

Webhook

Razorpay sends webhook events to confirm payments out-of-band. This is the recommended way to ensure orders are marked paid or authorized even if the customer closes the browser before returning to your site.

Webhook URL

The exact webhook URL is shown on the Razorpay payment method edit page.

Configure in Razorpay

1. Log into your Razorpay Dashboard
2. Go to Settings > Webhooks and add a new webhook
3. Paste the webhook URL and subscribe to at least: payment.authorized, payment.captured, order.paid, refund.processed
4. Set a Secret and enter the same value into the matching Test/Live Webhook Secret field on the payment method settings page

Security

Incoming webhook payloads are validated using HMAC SHA256 against your webhook secret (the x-razorpay-signature header) — a different secret from your API key. Requests with an invalid or missing signature are rejected, as are requests where the payment amount doesn't match the order total.

Saved Cards (Payment Profiles)

Enabling Allow Saved Cards lets a returning customer skip re-entering their card at checkout. This requires:

• Tokenisation enabled on your Razorpay account
• Razorpay's on-demand saved-cards feature approved for your account (raised as a support request; approval takes 5-7 working days)
• Transaction Type set to Authorize & Capture — saved cards are unavailable under Authorize Only, since Razorpay typically auto-captures a saved-card charge regardless of that setting

A saved card is always charged by routing back through Razorpay Checkout, which recognizes the returning customer by their Razorpay customer_id — never by a silent server-side charge. Razorpay's direct recurring-charge API is a separately support-gated feature not reliably available on merchant accounts, so this extension doesn't depend on it.

Removing a saved card deletes the local record and the token on Razorpay's side.

Refunds

Refunds (full or partial) can be initiated from the Order view in the admin panel:

1. Open the order
2. Open Payment Logs
3. Click Refund on a successful payment log entry
4. Enter the refund amount (full or partial)
5. Submit

Only payments with a captured status can be refunded. The refund is processed via Razorpay's refund API and recorded as a new payment log entry on the order.

Currency & Amounts

Razorpay expects amounts in the smallest currency unit (paise for INR, cents for USD, etc). The extension multiplies the order total by 100 before sending it to Razorpay, which assumes a 2-decimal currency — no manual conversion needed for INR or similarly structured currencies.

The transaction currency is taken from your TastyIgniter location currency. Make sure it matches a currency your Razorpay account is configured for, otherwise transactions will be rejected.

Technical Details

Entry Points

Order Hash

The order hash is sent to Razorpay in the order's notes.order_hash field and read back from the payment/order entity during both the checkout callback and webhook verification.

Troubleshooting

"Invalid Signature" on webhook

Symptom: Razorpay's webhook delivery log shows a failed/rejected response, or logs show "Invalid signature".

Solution:

• Confirm the Webhook Secret field matches the secret set against that specific webhook endpoint in the Razorpay dashboard, not your API Key Secret — they are different values
• Confirm you're comparing the secret for the correct mode (test vs live)
• Webhook secrets are case- and whitespace-sensitive; re-copy directly from the dashboard

Order remains incomplete after payment

Symptom: Customer completes payment but the order stays unprocessed.

Solution:

• Check Payment Logs on the order for a mismatch or verification failure
• Confirm the webhook is configured and reachable — it's the source of truth if the browser callback doesn't complete (e.g. customer closes the tab)
• Ensure the configured currency on the payment method matches the order currency

Manual capture fails after Authorize Only

Symptom: Capturing a previously authorized payment fails once the order reaches the Capture Status.

Solution: Razorpay auto-voids authorizations after 2 hours. If the order took longer than that to reach the capture status, the authorization has expired and capture will fail — the customer needs to be charged again through a new order.

Saved card not offered at checkout

Symptom: A customer has a saved card on file but Checkout doesn't show it.

Solution:

• Confirm Tokenisation and the on-demand saved-cards feature are both approved on your Razorpay account — without them, Razorpay Checkout won't surface a stored token regardless of what this extension sends
• Confirm Transaction Type is Authorize & Capture; saved cards are disabled under Authorize Only

Support

• Issues & Contributions: GitHub Repository
• Contact: tipowerup.com/contact
• Discord Community: tipowerup.com/social/discord