Overview

TezzPay provides production-ready UPI payment APIs. Use these APIs to:

Create UPI payment orders and deep-links
Verify and track payment status in real time
Use our hosted checkout page (no frontend needed)
Receive webhook notifications on payment events

link Base URL

https://pay.tezzcorp.in/api/v1

Authentication

All API requests require two headers:

HTTP Headers

X-API-Key: upipg_live_your_api_key_here
X-API-Secret: your_api_secret_here
Content-Type: application/json

ℹ Get your API Key and Secret by registering here for ₹499 one-time activation.

Error Handling

All errors return a JSON body with success: false and an error message.

Error Response

{
  "success": false,
  "error": "Invalid API key",
  "code": "AUTH_001"
}

HTTP Code	Error Code	Meaning
401	AUTH_001	Missing or invalid API key / secret
400	VAL_001	Missing required fields
404	NOT_FOUND	Order or session not found
429	RATE_LIMIT	Too many requests (60/min)
500	SERVER_ERR	Internal server error

CORS & Whitelisting Domains

TezzPay's gateway APIs and hosted checkout endpoints support browser-based calls (AJAX, Fetch, single-page web apps) through a dynamic database-driven origin whitelist.

How CORS Works:

Server-to-Server (cURL / Backend SDKs): Never blocked by CORS. Backend servers communicate directly with TezzPay without browser restrictions.
Client-Side Calls (AJAX / Fetch): If your JavaScript directly calls /api/v1/create-order or your recharge form submits via AJAX, your website domain must be whitelisted.
Automatic Subdomain Match: Whitelisting https://yourdomain.com automatically permits https://www.yourdomain.com as well.

How to Whitelist Your Website Domain:

Log into your Merchant Panel and navigate to API Credentials.
Under the Whitelisted Web Domains (CORS) section, enter your website URL (e.g. https://allyonogamelists.com) and click Whitelist.
Your origin is instantly active in the gateway database — no server reboot required.

⚠ The AJAX 302 Redirect Trap: If your frontend form is submitted using $.ajax() or fetch(), your backend PHP script must return JSON containing the checkout_url, and JavaScript must do window.location.href = res.checkout_url. Do NOT do header("Location: $url") inside an AJAX request, or the browser will attempt a background cross-origin fetch and trigger a CORS error.

Create Order

POST /create-order

Create a new payment order. Returns a UPI deep-link and a hosted checkout URL.

Request Body

JSON

{
  "amount": 499.00,
  "order_id": "ORD_1234567890",
  "customer_name": "Arjun Sharma",
  "customer_email": "arjun@example.com",
  "customer_phone": "9876543210",
  "description": "Course enrollment fee",
  "redirect_url": "https://yourapp.com/payment/callback",
  "webhook_url": "https://yourapp.com/api/webhook"
}

Response

JSON

{
  "success": true,
  "session_id": "sess_8f3a2b1c9d4e",
  "order_id": "ORD_1234567890",
  "amount": 499.00,
  "upi_deep_link": "upi://pay?pa=merchant@okaxis&pn=TezzCorp&am=499.00&tn=ORD_1234567890&cu=INR",
  "checkout_url": "https://pay.tezzcorp.in/pay/sess_8f3a2b1c9d4e",
  "qr_url": "https://pay.tezzcorp.in/api/v1/qr/sess_8f3a2b1c9d4e",
  "qr_image_url": "https://pay.tezzcorp.in/api/v1/payments/sess_8f3a2b1c9d4e/qr",
  "data": {
    "session_id": "sess_8f3a2b1c9d4e",
    "order_id": "ORD_1234567890",
    "amount": 499.00,
    "checkout_url": "https://pay.tezzcorp.in/pay/sess_8f3a2b1c9d4e",
    "upi_deep_link": "upi://pay?pa=merchant@okaxis&pn=TezzCorp&am=499.00&tn=ORD_1234567890&cu=INR",
    "qr_url": "https://pay.tezzcorp.in/api/v1/qr/sess_8f3a2b1c9d4e",
    "qr_image_url": "https://pay.tezzcorp.in/api/v1/payments/sess_8f3a2b1c9d4e/qr"
  },
  "expires_at": 1719993600
}

Note: Both checkout_url at the root level and data.checkout_url are provided for full client compatibility.

Headless QR Code & Custom UI

HEADLESS CHECKOUT

Collect payments completely inside your own custom website, mobile app, or modal dialog without redirecting customers to TezzPay's hosted checkout.

Integration Steps:

Call POST /api/v1/create-order from your backend server using your API credentials.
The response returns qr_image_url, upi_deep_link, and session_id.
Pass the qr_image_url to your frontend and render it in an <img> tag: <img src="qr_image_url" alt="Scan to pay" />.
Poll GET /api/v1/payments/{session_id}/status every 2 seconds from your client or wait for our secure server-to-server Webhook.
When status updates to SUCCESS, display your custom celebration/receipt UI!

Client-Side Polling Snippet (JavaScript)

JavaScript

// Poll payment status every 2 seconds
const pollInterval = setInterval(async () => {
  try {
    const res = await fetch('https://pay.tezzcorp.in/api/v1/payments/' + sessionId + '/status');
    const data = await res.json();
    if (data.status === 'SUCCESS' || data.status === 'COMPLETED') {
      clearInterval(pollInterval);
      // Run your custom in-app success state
      onPaymentSuccessful(data);
    }
  } catch (err) {
    console.error('Status check error:', err);
  }
}, 2000);

Vector SVG QR Endpoint (No Auth Required)

You can embed our server-rendered vector SVG QR directly anywhere:

HTML

<img src="https://pay.tezzcorp.in/api/v1/payments/sess_8f3a2b1c9d4e/qr" width="220" height="220" alt="UPI QR" />

Verify Payment

POST /verify

Verify a payment session or order reference server-to-server. Always verify payment status before fulfilling orders or crediting customer accounts.

Request Body (JSON)

cURL

curl -X POST https://pay.tezzcorp.in/api/v1/verify \
  -H "X-API-Key: upipg_live_YOUR_KEY" \
  -H "X-API-Secret: YOUR_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"session_id":"sess_8f3a2b1c9d4e"}'

Response (JSON)

JSON

{
  "success": true,
  "status": "SUCCESS",
  "session_id": "sess_8f3a2b1c9d4e",
  "order_id": "ORD_1234567890",
  "amount": "499.00",
  "utr": "407011234567",
  "payer_vpa": "customer@okhdfcbank",
  "paid_at": "2026-10-02 20:45:10",
  "data": {
    "session_id": "sess_8f3a2b1c9d4e",
    "order_id": "ORD_1234567890",
    "status": "SUCCESS",
    "amount": "499.00",
    "utr": "407011234567",
    "payer_vpa": "customer@okhdfcbank",
    "paid_at": "2026-10-02 20:45:10"
  }
}

Possible status values: PENDING · SUCCESS · FAILED · EXPIRED

Handling Customer Return on `redirect_url`

When the user finishes payment on TezzPay, their browser is redirected to your redirect_url with query parameters:

https://yourapp.com/callback.php?session_id=sess_8f3a2b1c9d4e&order_id=ORD_1234567890

Always verify the session_id via POST /verify on your server before marking the order as paid.

Check Status (Polling)

GET /status/{session_id}

Poll the payment status. Suitable for hosted checkout auto-confirmation (every 3 seconds).

cURL

curl https://pay.tezzcorp.in/api/v1/status/sess_8f3a2b1c9d4e \
  -H "X-API-Key: upipg_live_..." \
  -H "X-API-Secret: your_secret"

Server-Side Vector QR Code

GET /api/v1/payments/{session_id}/qr

Fetch an instant, vector SVG QR code image directly from the server. Ideal for embedding in mobile apps (Flutter, Android, React Native), desktop software, or billing invoices without relying on client-side JavaScript.

HTML & Mobile Embedding

<!-- Embed anywhere as a direct image -->
<img src="https://pay.tezzcorp.in/api/v1/payments/sess_8f3a2b1c9d4e/qr" width="220" height="220" alt="Scan to pay" />

Hosted Checkout

Use our pre-built checkout page — no frontend code needed. Just redirect the user to the checkout_url returned by Create Order.

URL

https://pay.tezzcorp.in/pay/{session_id}

Features:

Animated UPI QR code with live scan line
15-minute session timer with countdown bar
Auto-detection of payment confirmation (polls every 3s)
Redirect to your redirect_url on success/failure
Mobile-first, works on all devices

Webhooks

TezzPay sends an HTTP POST to your webhook_url when payment status changes.

Webhook Payload (JSON)

{
  "event": "payment.success",
  "session_id": "sess_8f3a2b1c9d4e",
  "order_id": "ORD_1234567890",
  "amount": 499.00,
  "upi_txn_id": "407011234567",
  "timestamp": 1719993410,
  "signature": "hmac_sha256_hex_of_payload"
}

⚠ Always verify the HMAC-SHA256 signature using your API Secret before processing webhooks.

Signature Verification (PHP)

PHP

$payload = file_get_contents('php://input');
$sig     = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
$secret  = 'your_api_secret';

$expected = hash_hmac('sha256', $payload, $secret);
if (!hash_equals($expected, $sig)) {
    http_response_code(401);
    exit('Invalid signature');
}

$data = json_decode($payload, true);
// Process $data['event'] ...

Android Integration (Java)

Java (Android OkHttp)

OkHttpClient client = new OkHttpClient();

String json = new JSONObject()
    .put("amount", 499.00)
    .put("order_id", "ORD_" + System.currentTimeMillis())
    .put("customer_name", "Customer Name")
    .put("customer_email", "customer@email.com")
    .put("customer_phone", "9876543210")
    .put("description", "Purchase")
    .put("redirect_url", "yourapp://payment/result")
    .toString();

Request request = new Request.Builder()
    .url("https://pay.tezzcorp.in/api/v1/create-order")
    .addHeader("X-API-Key", "upipg_live_your_key")
    .addHeader("X-API-Secret", "your_secret")
    .addHeader("Content-Type", "application/json")
    .post(RequestBody.create(json, MediaType.parse("application/json")))
    .build();

client.newCall(request).enqueue(new Callback() {
    @Override
    public void onResponse(Call call, Response response) throws IOException {
        String body = response.body().string();
        JSONObject res = new JSONObject(body);
        String checkoutUrl = res.getString("checkout_url");
        // Open checkout_url in WebView or Custom Tab
        Intent intent = new Intent(Intent.ACTION_VIEW, Uri.parse(checkoutUrl));
        startActivity(intent);
    }
});

PHP Integration (Complete End-to-End Flow)

A production-ready integration consists of three simple files: Order Creation, Customer Callback Verification, and Webhook Notification.

Step 1: create-order.php (Handles Both AJAX & Standard Forms)

PHP — create-order.php

<?php
define('TEZZ_API_BASE', 'https://pay.tezzcorp.in/api/v1');
define('TEZZ_API_KEY', 'your_api_key_here');
define('TEZZ_API_SECRET', 'your_api_secret_here');

function tezzpay_create_order(array $data): array {
    $ch = curl_init(TEZZ_API_BASE . '/create-order');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => json_encode($data),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => [
            'X-API-Key: ' . TEZZ_API_KEY,
            'X-API-Secret: ' . TEZZ_API_SECRET,
            'Content-Type: application/json',
        ],
    ]);
    $res = curl_exec($ch);
    if (curl_errno($ch)) {
        return ['success' => false, 'error' => curl_error($ch)];
    }
    curl_close($ch);
    return json_decode($res, true) ?: ['success' => false, 'error' => 'Invalid JSON'];
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $amount   = (float) ($_POST['amount'] ?? 0);
    $order_id = 'ORD_' . time() . '_' . rand(100, 999);

    $order = tezzpay_create_order([
        'amount'         => $amount,
        'order_id'       => $order_id,
        'customer_name'  => $_POST['name'] ?? 'Customer',
        'customer_email' => $_POST['email'] ?? 'customer@example.com',
        'customer_phone' => $_POST['mobile'] ?? '9876543210',
        'description'    => 'Order Payment',
        'redirect_url'   => 'https://' . $_SERVER['HTTP_HOST'] . '/callback.php',
    ]);

    $checkout_url = $order['data']['checkout_url'] ?? $order['checkout_url'] ?? '';

    // Check if called via AJAX (avoids cross-origin 302 redirect CORS trap)
    $is_ajax = (!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest')
               || (strpos($_SERVER['HTTP_ACCEPT'] ?? '', 'application/json') !== false);

    if (!empty($order['success']) && $checkout_url) {
        if ($is_ajax) {
            // For AJAX: Send JSON so client-side JS redirects via window.location.href
            header('Content-Type: application/json');
            echo json_encode(['success' => true, 'checkout_url' => $checkout_url, 'order_id' => $order_id]);
            exit;
        } else {
            // For standard HTML form post: Redirect directly
            header('Location: ' . $checkout_url);
            exit;
        }
    } else {
        header('Content-Type: application/json');
        echo json_encode(['success' => false, 'message' => $order['error'] ?? 'Order creation failed']);
        exit;
    }
}
?>

Step 2: callback.php (Customer Return & Verification)

When payment is finished on TezzPay, customer returns to your redirect_url with session_id and order_id:

PHP — callback.php

<?php
define('TEZZ_API_BASE', 'https://pay.tezzcorp.in/api/v1');
define('TEZZ_API_KEY', 'your_api_key_here');
define('TEZZ_API_SECRET', 'your_api_secret_here');

function tezzpay_verify(string $sessionId): array {
    $ch = curl_init(TEZZ_API_BASE . '/verify');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => json_encode(['session_id' => $sessionId]),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => [
            'X-API-Key: ' . TEZZ_API_KEY,
            'X-API-Secret: ' . TEZZ_API_SECRET,
            'Content-Type: application/json',
        ],
    ]);
    $res = curl_exec($ch);
    curl_close($ch);
    return json_decode($res, true) ?: [];
}

$session_id = trim($_GET['session_id'] ?? '');
if (!$session_id) {
    die('Missing session_id');
}

$res = tezzpay_verify($session_id);

if (!empty($res['success']) && ($res['status'] ?? $res['data']['status'] ?? '') === 'SUCCESS') {
    $data     = $res['data'] ?? $res;
    $order_id = $data['order_id'];
    $utr      = $data['utr'];
    $amount   = $data['amount'];

    // Payment Verified! Credit wallet or mark order completed in your database
    echo "<h2 style='color:#10b981'>Payment Confirmed!</h2>";
    echo "<p>Order ID: " . htmlspecialchars($order_id) . "</p>";
    echo "<p>UTR Number: " . htmlspecialchars($utr) . "</p>";
    echo "<p>Amount: ₹" . htmlspecialchars($amount) . "</p>";
} else {
    echo "<h2 style='color:#ef4444'>Payment Incomplete or Pending</h2>";
}
?>

Step 3: webhook.php (Instant Asynchronous Updates)

PHP — webhook.php

<?php
define('TEZZ_API_SECRET', 'your_api_secret_here');

$raw = file_get_contents('php://input');
$sig = $_SERVER['HTTP_X_SIGNATURE'] ?? '';

// Verify HMAC-SHA256 signature
if (!hash_equals(hash_hmac('sha256', $raw, TEZZ_API_SECRET), $sig)) {
    http_response_code(401);
    exit(json_encode(['error' => 'Invalid signature']));
}

$event = json_decode($raw, true);
if (($event['event'] ?? '') === 'payment.success') {
    $order_id = $event['order_id'];
    $utr      = $event['upi_txn_id'];
    $amount   = $event['amount'];

    // Idempotent database wallet credit here
}

header('Content-Type: application/json');
echo json_encode(['status' => 'ok']);
?>

Frontend JavaScript (AJAX & Fetch)

To avoid browser CORS issues when redirecting cross-origin from an AJAX payment form, receive the checkout_url in JSON and set window.location.href.

jQuery AJAX Form Example

JavaScript (jQuery)

$('#recharge-form').on('submit', function(e) {
    e.preventDefault();
    const $form = $(this);
    const $btn = $form.find('button[type="submit"]');
    $btn.prop('disabled', true).text('Opening payment...');

    $.ajax({
        url: 'create-order.php',
        type: 'POST',
        data: $form.serialize(),
        dataType: 'json',
        success: function(response) {
            if (response.success && response.checkout_url) {
                // Navigate top-level browser tab — NO CORS ERROR!
                window.location.href = response.checkout_url;
            } else {
                alert(response.message || 'Payment initiation failed.');
                $btn.prop('disabled', false).text('Pay Now');
            }
        },
        error: function(xhr) {
            console.error('Error:', xhr.responseText);
            alert('Server error. Please try again.');
            $btn.prop('disabled', false).text('Pay Now');
        }
    });
});

Modern Fetch API Example

JavaScript (Fetch)

async function handlePayment(formElement) {
    const formData = new FormData(formElement);
    try {
        const res = await fetch('create-order.php', {
            method: 'POST',
            body: new URLSearchParams(formData),
            headers: { 'Accept': 'application/json', 'X-Requested-With': 'XMLHttpRequest' }
        });
        const data = await res.json();
        if (data.success && data.checkout_url) {
            window.location.href = data.checkout_url;
        } else {
            alert(data.message || 'Payment failed');
        }
    } catch(err) {
        console.error('Network error:', err);
    }
}

cURL Quick Reference

cURL — Create Order

curl -X POST https://pay.tezzcorp.in/api/v1/create-order \
  -H "X-API-Key: upipg_live_YOUR_KEY" \
  -H "X-API-Secret: YOUR_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 499.00,
    "order_id": "TEST_001",
    "customer_name": "Test User",
    "customer_email": "test@example.com",
    "customer_phone": "9000000000",
    "description": "Test Payment"
  }'

Overview

Authentication

Error Handling

CORS & Whitelisting Domains

How CORS Works:

How to Whitelist Your Website Domain:

Create Order

Request Body

Response

Headless QR Code & Custom UI

Integration Steps:

Client-Side Polling Snippet (JavaScript)

Vector SVG QR Endpoint (No Auth Required)

Verify Payment

Request Body (JSON)

Response (JSON)

Handling Customer Return on redirect_url

Check Status (Polling)

Server-Side Vector QR Code

Hosted Checkout

Webhooks

Signature Verification (PHP)

Android Integration (Java)

PHP Integration (Complete End-to-End Flow)

Step 1: create-order.php (Handles Both AJAX & Standard Forms)

Step 2: callback.php (Customer Return & Verification)

Step 3: webhook.php (Instant Asynchronous Updates)

Frontend JavaScript (AJAX & Fetch)

jQuery AJAX Form Example

Modern Fetch API Example

cURL Quick Reference

Handling Customer Return on `redirect_url`