Payment Gateway Integration in India: 2026 Developer Guide

Payment gateway integration in India in 2026 means one dominant rail and four fallbacks. UPI carries most consumer transaction volume, cards and netbanking carry the rest, and the hard part is not the checkout screen. It is webhooks, idempotency and reconciliation.

Standing up a hosted checkout on Razorpay, PhonePe Payment Gateway, Cashfree, PayU or Stripe India takes a competent developer two days. Making it correct takes another one to two weeks, and five to nine weeks once subscriptions and reconciliation are in scope. That time goes into surviving a dropped callback, a double-submitted order, and a UPI payment that succeeds eleven minutes after the customer closed the tab.

The short answer

Question	What we tell clients
Which gateway?	Razorpay if you want the best documentation and the widest product surface. PhonePe Payment Gateway or Cashfree if UPI is most of your volume. PayU for high-ticket enterprise. Stripe India only if you bill in USD.
Build cost	₹60,000 to ₹1,40,000 for a hosted checkout on an existing product. ₹3,50,000 to ₹9,00,000 for subscriptions, UPI AutoPay, refunds and a reconciliation dashboard, roughly $4,000 to $11,000.
Timeline	3 to 10 working days for hosted checkout. 5 to 9 weeks for a full payments module including reconciliation.
Fees to budget	UPI is still zero MDR for merchants in practice, but legislation passed in August 2026 to remove the blanket statutory bar, so a threshold-based charge on large merchants is now possible and nothing has been notified yet. Domestic credit cards are commonly quoted around 2%, international cards 3% and above. Add 18% GST on the gateway fee. Confirm current rates on the provider's own pricing page.
Settlement	T+1 to T+3 business days depending on your category and risk profile. Same-day or instant settlement is a paid add-on almost everywhere.
Onboarding documents	Company PAN, certificate of incorporation with CIN, GSTIN, cancelled cheque or bank statement, director PAN and Aadhaar, plus live policy pages on your site.
Hardest part	Reconciliation, not integration. The amount settled to your bank never equals the amount ordered.
Skip the custom build if	You are under roughly ₹5,00,000 a month in online GMV. Use the gateway's own payment pages or a stock WooCommerce or Shopify plugin.

What Indian buyers actually pay with

Design the checkout around what your customers use, not what your gateway earns on.

• UPI intent. A deep link opens Google Pay, PhonePe, Paytm or the bank's app and control returns to your page. This is the default; handle the app-switch return badly and you lose orders. Collect and dynamic QR cover invoices and desktop.
• Cards. Credit cards still dominate high-ticket, travel and EMI. Debit card share online fell sharply as UPI absorbed it.
• Netbanking and wallets. Fifty-plus banks with varying uptime; keep the top eight visible. Paytm, Amazon Pay and Mobikwik are cheap to enable and sometimes the only rail up during a bank outage.
• EMI. Card EMI, cardless EMI and pay-later. These start to earn their keep above roughly ₹8,000, where the whole ticket in one debit is what makes a buyer close the tab.

UPI AutoPay changes how you model subscriptions

A UPI mandate is not a card on file. The customer approves a maximum amount and a frequency, and every debit runs against it. RBI's Digital Payments E-Mandate Framework, 2026, notified in April, folded the earlier circulars into one set of rules covering cards, wallets and UPI. Two consequences for billing design. The issuer sends a pre-transaction notification at least 24 hours before each debit, so the customer sees each debit coming. And a debit above ₹15,000 needs additional factor authentication every time, with a higher ceiling for a named list that includes insurance premiums, mutual funds and credit card bills. Those limits have moved before, so confirm the current figure rather than hard-coding it. Keep your Indian plan under the ceiling where you can, and build dunning that assumes some debits need a tap.

COD is a reconciliation problem, not a payment method

No gateway touches your cash-on-delivery money. The courier collects it and remits on its own cycle, commonly seven to fifteen days, minus its fee and minus return-to-origin freight. So you run two pipelines over one orders table: the gateway settlement file for prepaid orders, the courier remittance file for the rest. Build the remittance import on day one, tag RTO returns against the original order, and track prepaid share by pincode. That last number is uncomfortable for many D2C brands, because in some pincodes the right call is to switch COD off entirely.

The five gateways worth shortlisting

All five move money. They differ on how fast they onboard you, how the money lands, and how much of your week disappears into their documentation. Treat the table as shape, not price list: MDR is negotiated per merchant and rates change. Confirm current numbers on each provider's pricing page.

Gateway	Onboarding	Settlement	Recurring and UPI AutoPay	International cards	Developer experience
Razorpay	Fast for a registered Pvt Ltd with GSTIN. Standard document set, sandbox available before full activation.	T+1 typical for most categories. Instant settlement is a paid add-on.	Mature. Subscriptions, UPI AutoPay and card e-mandates are all first class.	Supported after separate approval. Expect a higher band and more documentation.	Best in class in India. Clear docs, a real sandbox, good server SDKs, webhook tooling that works.
PhonePe Payment Gateway	Straightforward for registered entities. Strongest fit when PhonePe is already a large share of your UPI traffic.	T+1 typical.	UPI mandates supported. Card recurring is thinner than Razorpay's.	Limited. Not the choice for a global customer base.	Improving quickly. Docs are leaner and there are fewer community answers when something breaks at 11pm.
Cashfree Payments	Quick. Popular with D2C brands and marketplaces.	T+1 standard, with instant and on-demand settlement products.	Good UPI AutoPay support. Strong payouts and split-settlement side.	Supported. Verify your category is approved before you build.	Solid docs and a genuinely useful payouts API. Split settlement is the reason marketplaces shortlist it.
PayU	Slower and more enterprise-flavoured. Worth it once ticket sizes are large.	T+1 to T+2 depending on the agreement.	Supported, including standing instructions on cards.	Long-standing support and often competitive on cross-border.	Functional rather than pleasant. Older API surface, capable support once you have an account manager.
Stripe India	Requires an Indian entity and category approval. Availability varies, so confirm before you architect around it.	Longer than the Indian incumbents by default.	Global subscription tooling is excellent. Indian rails still need RBI e-mandate handling.	The strongest of the five by a distance.	The best developer experience anywhere, applied to a market where the local rails matter more than the API.

The choice usually collapses to one question: where do your customers' cards live?

• You bill in dollars. A Hyderabad SaaS company invoicing US and EU customers should reach for Stripe and treat rupee collection as secondary.
• UPI is most of your volume. A D2C brand shipping to Vijayawada and Visakhapatnam should not touch Stripe. Take PhonePe Payment Gateway or Cashfree.
• You settle money to other people. Marketplaces need split settlements and payouts, which cuts the shortlist before price is even discussed.
• Whichever you pick, keep a second gateway behind a feature flag so one bank outage cannot close your store. That failover is the cheapest insurance in any web platform build carrying real volume.

The engineering half of payment gateway integration in India

Every quickstart shows the happy path. Money is lost on the others.

Never trust the client-side success callback

The browser callback, the redirect handler, the SDK's success event: none are proof of payment. Anyone with developer tools can fire them, and a customer on patchy 4G in Kondapur will never fire them even when the payment went through. Treat the callback as a signal to go and check: call the gateway's server-side fetch API with your order identifier, compare amount, currency and status against what you expected, then mark the order paid. Verify the amount, because a checkout tampered down to ₹1 still returns a valid captured payment.

Verify webhook signatures over the raw request body

Webhooks are the authoritative channel. Every gateway signs them, typically as an HMAC SHA-256 of the request body using a secret you configure. Two mistakes are near-universal. The first is computing the signature over a re-serialised JSON object instead of the exact bytes received: it passes in testing and breaks in production when key ordering or Unicode escaping shifts. Capture the raw body before body-parser middleware touches it. The second is comparing with == rather than a constant-time comparison.

Then respond 200 fast and process asynchronously. Gateways retry hard, and a handler doing inventory allocation, invoicing and email inline will time out, be redelivered, and turn one order into three invoices.

Idempotency is not optional

Assume every write arrives twice: retried webhooks, a customer double-tapping Pay, your retry queue. Three cheap defences:

• Create one order record with a unique receipt before you call the gateway, and make it the deduplication key everywhere downstream.
• Store the gateway's event ID behind a unique constraint, so a second delivery is a no-op instead of a duplicate credit.
• Make the state transition idempotent in the database. Update to paid only where status is still pending, inside a transaction, and check the affected row count. Never read, branch in application code, then write.

Design for pending, because pending is common

UPI has a genuine third state: the customer approved, the bank is slow, and it resolves minutes later. If a job marks anything not successful within five minutes as failed, you will either refund against goods you already shipped or take payment twice. Keep an explicit pending state with copy telling the buyer not to pay again, and reconcile pending orders on a schedule against the gateway's status API. RBI's turnaround-time framework already sets deadlines for auto-reversal of failed transactions and compensation when they are missed, so the failed case largely handles itself. Your job is to not double-charge on top of it.

Refunds

Refunds are asynchronous and can fail. Model one as its own record with its own lifecycle, never a boolean on the order, and expose that state to support so nobody refunds twice off a stale dashboard. Partial refunds need line-item allocation or your GST credit notes will not tie out.

Reconciliation: the line item nobody quotes for

Gross order value never equals the money in your current account. What lands is gross, minus MDR, minus 18% GST on that MDR, minus refunds, chargebacks and dispute adjustments, netted across a settlement window and credited as one UTR. So build a three-way match: your orders table, the gateway's settlement report, the bank credit identified by UTR. In our book of work that match is what separates a payments integration that survives an audit from one that produces a monthly argument with a chartered accountant.

1. Pull the settlement report on a schedule; every gateway exposes one.
2. Match each settled payment to an order and flag anything unmatched.
3. Match the settlement's net amount to one bank credit by UTR and date.
4. Post the fee and its GST to separate ledger accounts, so input tax credit is claimable without manual work.
5. Alert on any settlement that has not landed within your expected window plus one day.

Skipping it is defensible at ₹2,00,000 a month and indefensible at ₹20,00,000, because by then the gap exceeds the cost of building it.

Compliance: tokenisation, KYC and the tax on your fees

You are not allowed to store card numbers

Under RBI's card-on-file rules, merchants and aggregators in India cannot store card numbers or CVVs. Saved cards work through merchant-specific network tokens issued by Visa, Mastercard or RuPay: the network holds the card, you hold a token reference. Do not design a schema with a card number column and a plan to encrypt it. That is not compliant, whatever the encryption.

The same decision governs PCI DSS scope. A hosted checkout or gateway iframe keeps you on the lightest self-assessment tier, because card data never touches your servers. Render your own card fields and scope expands, along with the annual cost of proving it. Unless you process card volume at bank scale, a custom card form is vanity.

The onboarding documents, and the one that trips people

• Company PAN and certificate of incorporation showing the CIN. Partnership deed or Udyam registration otherwise.
• GSTIN, unless you are genuinely below the threshold and can evidence it.
• Bank proof: a cancelled cheque or statement in the entity's exact registered name. A one-word mismatch against the incorporation certificate stalls activation for days.
• Director or proprietor PAN and Aadhaar.
• Business category and expected monthly volume. Overstate it and you invite a risk review now; understate it and you trigger one later.
• Live policy pages: terms, privacy, refund and cancellation, shipping, and a contact page with a real address and phone number.

That last bullet delays go-live more often than any code problem. Underwriting opens your site and reads it. A staging URL, a coming-soon page or a refund policy contradicting your product gets the application queued. Publish them first. They also have to line up with the Digital Personal Data Protection Act, 2023, and the DPDP Act compliance checklist covers what changes inside the product.

GST and TDS on gateway fees

Gateway fees attract GST at 18% in India. If you are registered that is input tax credit you should be claiming, so post the fee and the tax separately rather than in one payment charges line. Whether TDS under section 194H applies to aggregator commission has been litigated and turns partly on whether the provider is a bank. Marketplaces paying out to sellers have a separate obligation under section 194-O. Ask your CA and check the current notification. This is not legal or tax advice.

When a custom integration is the wrong call

Most writing on this subject comes from agencies and gateways, so it never says this out loud. Four situations where paying anyone to build a payments integration wastes money.

• Under about ₹5,00,000 a month online. Use Razorpay Payment Pages, a payment link, or the stock WooCommerce or Shopify plugin. It handles refunds and UPI, someone else maintains it, and it costs nothing but MDR. Do not hire us for this. Spend the money getting to ₹5,00,000 a month.
• B2B invoicing on 30-day terms. A ₹12,00,000 invoice paid by card costs roughly ₹24,000 in MDR plus GST. NEFT or RTGS costs almost nothing. Send a payment link for convenience, keep bank transfer the default.
• Product not validated yet. Founders ask for subscriptions, UPI AutoPay, proration and dunning before the hundredth paying customer. Charge manually and extend access by hand. Automate when that hurts. Same logic that should govern how a startup MVP in Hyderabad scopes everything else.
• Everyone told you to use Stripe. Stripe has the best API in the industry and is still the wrong default for a business collecting rupees from Indian consumers on UPI. Match the gateway to the rail your customers use, not to the API you would enjoy.

Where the money is well spent: split settlements, subscription billing at scale, reconciliation feeding an ERP, multi-gateway failover. Those are systems, not integrations, and where API and cloud engineering earns its fee.

What it costs, how long it takes, and the devices it runs on

We quote payments work in three bands, on Hyderabad rates and scope that actually ships.

Scope	What is included	Quoted range	Timeline
Hosted checkout	One gateway with UPI, cards, netbanking and wallets. Server-side verification, webhook handling, refunds from an admin screen.	₹60,000 to ₹1,40,000	3 to 10 working days
Full payments module	The above plus subscriptions or UPI AutoPay, partial refunds, settlement reconciliation, a finance-facing dashboard and alerting.	₹3,50,000 to ₹9,00,000	5 to 9 weeks
Marketplace or platform	Split settlements, seller onboarding and KYC, payouts, a real ledger, dispute handling, second-gateway failover.	Quoted per scope, typically above ₹9,00,000	10 weeks and up

Two front-end constraints shape this, and neither applies to a US audience.

• The device. Most Indian checkout traffic arrives on a budget Android handset over mobile data, not a desktop on office fibre. A checkout shipping 400 KB of JavaScript before it renders a UPI button loses orders in Warangal that it never loses in Gachibowli.
• The app-switch. Opening a UPI app is a full context change, so the tab may be backgrounded, evicted or restored stale. Persist order state server-side and rebuild from it on return, not from client state.

Then test on a live Jio or Airtel connection at peak evening hours, not office fibre in HITEC City, because the gateway's reported UPI success rate and the rate your customers experience are different numbers. Keeping that measured is what a care plan and a documented delivery process are for.

The go-live checklist

Run this before you switch live keys on. Every row has cost somebody money.

Stage	Check	Why it matters
Apply	Policy pages live: terms, privacy, refund, shipping, contact with address and phone	Underwriting reads them. The most common activation delay.
Apply	Bank account name matches the incorporation certificate exactly	A one-word mismatch stalls activation for days.
Build	Unique receipt created before the gateway is called	One deduplication key for the whole lifecycle.
Build	Server-side verification of amount, currency and status after every success signal	Client callbacks can be forged, and can be lost.
Build	Webhook signature verified over the raw body, constant-time comparison	Re-serialised JSON breaks signatures silently.
Build	Event IDs under a unique constraint, handler returns 200 in under a second	Retries are guaranteed. Duplicates must be free.
Build	Explicit pending state with a status poller and customer-facing copy	UPI resolves late. Do not convert pending into failed.
Build	Refunds as records with a webhook-driven lifecycle	Refunds fail asynchronously and get issued twice.
Launch	Settlement report import and three-way match against the bank UTR	Net settled never equals gross ordered.
Launch	Checkout tested on a budget Android handset on mobile data at peak hours	That is what most Indian checkout traffic looks like.

Then wire three alerts on day one, because payments fail quietly:

1. Settlement not credited within your window.
2. Webhook failure rate above baseline.
3. Success rate by method dropping. A falling UPI number is usually one bank you can route around.

An ecommerce build adds order state machines and courier integration on top. The guide to ecommerce website development in India covers that, and recent project work shows how they fit.

Frequently asked questions

How long does payment gateway integration in India take?

A hosted checkout on one gateway takes three to ten working days once your merchant account is active. A full module with subscriptions, refunds and settlement reconciliation takes five to nine weeks. Activation runs in parallel and depends on your documents, so file the KYC application before development starts.

Which payment gateway is best for a startup in India?

Razorpay for most, because the documentation and sandbox are strongest and the surface covers subscriptions, links and payouts. Choose Cashfree if you need split settlements for a marketplace, PhonePe Payment Gateway if UPI dominates your volume, Stripe only if you bill international customers in foreign currency.

What do payment gateways charge in India?

UPI is still zero MDR for merchants in practice. Legislation passed in August 2026 to remove the blanket statutory bar on charging it, so a threshold-based fee on large merchants is possible but nothing has been notified. Domestic credit cards are commonly quoted around 2% and international cards 3% or more, plus 18% GST. Confirm current pricing with the provider.

Do I need a registered company to accept online payments in India?

Not necessarily a private limited company. Sole proprietorships and partnerships can onboard with the right proofs, though the document set and risk review differ. A registered entity with PAN, GSTIN and a matching current account clears underwriting faster and negotiates better terms. Unregistered individuals are usually limited to payment links.

Can I store customer card details for repeat payments?

No. RBI's card-on-file rules bar merchants and aggregators in India from storing card numbers or CVVs. Saved cards work through merchant-specific network tokens issued by Visa, Mastercard or RuPay. For recurring billing use UPI AutoPay or a card e-mandate, each with its own authentication limits and pre-debit notice.

Where to start this week

Three things, in order. Publish the five policy pages and file the merchant KYC application today, because activation is the long pole. Choose your primary rail from where your customers already are, then pick the gateway that serves it best. Then scope the build to include webhook handling, the pending state and settlement reconciliation, because a quote covering only the checkout button is a quote for a third of the job.

DevXAI Technologies builds and maintains payment infrastructure from Hyderabad for merchants in Bengaluru, Chennai, Mumbai, Pune, Vijayawada and across India. For a second opinion on a scope or a competing quote, send it over.