Module and release scope
This guide covers Razorpay Payment Links 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.
Open System → Payment gateways (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.
Exact connection fields
These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.
| Key / label | Type | Required | Default / guidance |
|---|---|---|---|
mode — Environment |
select | Yes | Default: "sandbox" Choices: sandbox = Sandbox, live = Live |
key_id — API key ID |
secret | Yes | Use the account-specific value described below. |
key_secret — API key secret |
secret | Yes | Use the account-specific value described below. |
webhook_secret — Webhook signing secret |
secret | Yes | Use the account-specific value described below. |
currencies — Approved invoice currencies |
text | Yes | Comma-separated currencies approved for this merchant. No currency conversion is performed. |
Creates standard hosted Payment Links with partial payments disabled. Customers use the methods Razorpay has approved for the merchant. Supported invoice currencies: INR, MYR, SGD, USD, EUR, GBP, AUD, CAD, AED, SAR. International and regional currencies require Razorpay approval for that account.
Configure
- In Razorpay Dashboard, generate the matching Test or Live API key pair. Enter API key ID and API key secret. Environment must match
rzp_test_orrzp_live_. - Grant Payment Links create/read and Payments read API access; no refund, transfer or payout access is used. Test authenticates a read-only
/v1/payment_links?count=1request and discards its customer data. - Add the saved connection’s webhook endpoint in Settings → Webhooks. Set a separate signing secret and save the same value in Webhook signing secret. Subscribe to
payment_link.paid; other events cannot settle an invoice. Signing uses HMAC-SHA256 over the exact raw notification body. - Enter only the invoice currencies approved by Razorpay for the account, then Test. Checkout uses
api.razorpay.comand a hostedrzp.ioURL. Both test and live use the official API host; the key pair determines the environment.
A completed link must have one captured payment for the entire amount. The module reads the link, verifies its reference/notes and then retrieves the linked payment, checking order, capture and refund state. Callback signatures are not used as a substitute for those authenticated reads.
Installation and activation
The package contains generic product code only. Installation leaves the module disabled and does not create, enable or populate a merchant account. In System → Payments → Provider library, enable the module only when ready, add a connection, enter your own credentials, run Test and explicitly enable that connection. Keep sandbox and live accounts separate. Existing enabled gateways are unaffected.
Use the exact HTTPS webhook URL displayed on that saved connection; do not enter the storefront home page. One connection endpoint can serve invoices across storefront domains because payment attempts retain their connection and invoice identity. Keep it reachable without login or a browser challenge. Return URLs are generated and signed by the application per invoice; do not replace them with a static merchant callback.
The module never collects PAN, CVV or customer wallet credentials. Checkout creation is submitted once, with a unique attempt reference; a timeout requires reconciliation, not an automatic second charge. Browser success parameters never prove payment. Final amount, currency, checkout identity and application metadata are checked against authenticated provider reads. Notifications use stable payment IDs for duplicate protection. A partial or ambiguous payment stays under billing review.
No currency conversion is performed. Only the listed two-decimal invoice currencies are accepted, and only those explicitly entered under Approved invoice currencies are offered. Availability of cards, wallets and local methods remains subject to the merchant account, shopper location and provider checkout; installing a module does not enable provider payment products. Refund, recurring billing and token charging operations are not implemented.
Validation
Run php tests/gateway-growth.php for isolated HTTP fixtures covering checkout creation, server verification, signed notifications, exact amounts, identity mismatches, invalid URLs, incomplete billing profiles and no checkout POST retries. These checks do not certify credentials, merchant underwriting or a live payment. Complete a provider sandbox checkout and callback test before enabling live traffic.
Official implementation references
Reviewed 2026-10-21. Provider contracts may change; recheck these sources before changing API versions.
- https://razorpay.com/docs/api/payments/payment-links/create-standard
- https://razorpay.com/docs/api/payments/payment-links/fetch-id-standard
- https://razorpay.com/docs/api/payments/payment-links/fetch-all-standard
- https://razorpay.com/docs/webhooks/validate-test/