Backend creates order → frontend opens checkout with order ID → customer pays → Razorpay sends payment ID and signature to frontend → frontend sends to backend → backend verifies signature → backend updates database → Razorpay sends webhook → backend verifies webhook signature → backend updates database (source of truth).
Setup (account, keys, SDK), create order endpoint, frontend checkout, payment verification with signature, webhook handling (payment.captured, payment.failed, refund.processed), subscriptions (plans, recurring billing), security (verify signatures, don't trust frontend amounts), and testing (test mode, test cards, ngrok).
RAZORPAY_KEY_ID (rzp_test_ or rzp_live_), RAZORPAY_KEY_SECRET (from dashboard), and RAZORPAY_WEBHOOK_SECRET (set when creating the webhook in the dashboard). Store in .env, never in code or frontend.
Verify webhook signatures (HMAC-SHA256), use express.raw() for webhooks, get amounts from database (not frontend), verify payment amounts match orders, require admin auth for refunds, use HTTPS only, implement idempotency, and log all webhooks for audit.
Browse all our FAQs or reach out to our support team
Your learning library
Find your next course. Build something great.
