PayIN API reference
Create and manage PayIN requests over HTTPS. Your Client Key and Secret live in Dashboard → API — treat both like passwords.
Create PayIN order
POST
/apiv1/create-order
application/x-www-form-urlencoded
| Parameter | Type | Description |
|---|---|---|
| customer_mobile | Integer | Customer's mobile number |
| customer_name | string | Customer's name |
| user_token | string | Your API Client Key |
| amount | float | Payment amount |
| order_id | string | Your unique order identifier |
| redirect_url | url | URL to redirect to after payment (auto-redirects 5s after success) |
| remark1 | string | Custom remark 1 (optional) |
| remark2 | string | Custom remark 2 (optional) |
{
"status": true,
"message": "Order Created Successfully",
"result": {
"orderId": "1234561705047510",
"payment_url": "https://payment.rocketindexer.com/payment/TOKEN"
}
}
{ "status": false, "message": "order_id already exists" }
Check PayIN order status
POST
/apiv1/check-order-status
application/x-www-form-urlencoded
| Parameter | Type | Description |
|---|---|---|
| user_token | string | Your API Client Key |
| order_id | string | Alphanumeric order ID to look up |
{
"status": true,
"message": "Transaction Successfully",
"result": {
"txnStatus": "SUCCESS", // or "PENDING"
"orderId": "784525sdD",
"amount": "1",
"date": "2024-01-12 13:22:08",
"utr": "454525454245" // only when SUCCESS
}
}
Webhook payload
When configured in Dashboard → API, we send a form-urlencoded POST to your webhook URL the moment a payment settles.
| Field | Type | Description |
|---|---|---|
| status | string | Transaction status, e.g. SUCCESS |
| order_id | string | Your original order ID — used to generate the hash |
| customer_mobile | string | Customer phone number |
| amount | string | Transaction amount |
| utr | string | Unique transaction reference number |
| hash | string | HMAC-SHA256 signature for verification |
| remark1 / remark2 | string | Custom remarks passed at order creation |
Verifying webhook signatures
Hash formula:
hash = HMAC-SHA256(order_id, YOUR_SECRET_KEY). Always compare using a constant-time function — never == or ===.
$secret_key = 'YOUR_SECRET'; $expected = hash_hmac('sha256', $order_id, $secret_key); if (!hash_equals($expected, $received_hash)) { http_response_code(403); exit('Invalid signature. Webhook rejected.'); } // Signature verified — safe to mark the order paid if ($status === 'SUCCESS') { updateOrderStatus($order_id, 'paid', $utr); } http_response_code(200); echo 'OK';
const crypto = require('crypto'); const expected = crypto.createHmac('sha256', secretKey).update(orderId).digest('hex'); const a = Buffer.from(receivedHash), b = Buffer.from(expected); const ok = a.length === b.length && crypto.timingSafeEqual(a, b);
Error handling
If status is false in any response, read message for details. Common causes: missing/invalid user_token, a duplicate order_id, or an unrecognized order on status checks.