API Documentation

On this page

Overview

PAY ABHRO MODZ is a self-hosted UPI payment gateway. The entire API is a single endpoint — every operation is selected with the action field in the JSON request body. This keeps integrations tiny: one URL, one HTTP method, one header.

Authentication

Every action except health requires a valid API key. Generate keys from your dashboard under API Keys. Keys are shown once at creation — store them securely.

Send the key in the request header (recommended):

X-API-Key: YOUR_64_CHARACTER_KEY

Or, if your HTTP client cannot set custom headers, pass it in the JSON body instead:

{ "api_key": "YOUR_64_CHARACTER_KEY", "action": "health" }

Request format

All requests are POST to https://wa.abhromodz.in/v1 with a JSON body. The action field determines what happens; all other fields depend on the action.

POST https://wa.abhromodz.in/v1
X-API-Key: YOUR_64_CHARACTER_KEY
Content-Type: application/json

{
  "action": "create",
  "amount": 499
}

Responses & errors

Every response is JSON and always contains a status field, either "success" or "error".

{
  "status": "success",
  "order_id": "PAM-8F2K9DLA31"
}

{
  "status": "error",
  "message": "Invalid or inactive API key."
}

HTTP status codes

Safe retries (Idempotency-Key)

If your create request times out you cannot tell whether the order was created or not, and retrying blindly can produce two orders for one checkout. Send an Idempotency-Key header and the retry is answered with the original response instead.

POST https://wa.abhromodz.in/v1
X-API-Key: YOUR_64_CHARACTER_KEY
Idempotency-Key: 7f9a2c4e-1b6d-4a58-9c31-0d5e8f2a7b43
Content-Type: application/json

{ "action": "create", "amount": 499, "purpose": "ORDER1024" }

• Use a new random key per checkout (a UUID is ideal) — never a fixed string.
• A replayed response carries the header Idempotent-Replay: true.
• Keys are remembered for 24 hours and are scoped to your merchant account.
• Reusing a key with different parameters is refused with 422, so a key can never return the wrong order.
• If the first call is still running you get 409 — wait a moment and retry the same key.
• The header is optional. Without it, create behaves exactly as before.

Order lifecycle & statuses

A fresh order starts as PENDING. When a matching bank/UPI confirmation email is parsed, it becomes VERIFIED automatically. Orders that are not paid within the expiry window become EXPIRED.

Actions

create — Create a payment order

Creates a new order and returns a hosted pay page URL plus a ready-to-render UPI URI.

Request

curl -X POST https://wa.abhromodz.in/v1 \
  -H "X-API-Key: YOUR_64_CHARACTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "create",
    "amount": 499,
    "purpose": "ORDER1024",
    "customer_id": "CUST-88",
    "callback_url": "https://yoursite.com/webhooks/pam",
    "redirect_url": "https://yoursite.com/payment/return",
    "expires_in": 900,
    "extra_data": {
      "invoice": "INV-1024",
      "plan": "pro"
    }
  }'

Response 200

{
  "status": "success",
  "order_id": "PAM-8F2K9DLA31",
  "amount": 499,
  "purpose": "ORDER1024",
  "pay_url": "https://wa.abhromodz.in/pay/9f3c...48chars",
  "upi_uri": "upi://pay?pa=7430096522%40fam&pn=PAY%20ABHRO%20MODZ&am=499.00&tn=ORDER1024&cu=INR",
  "qr_png": "https://wa.abhromodz.in/qr/9f3c...48chars.png",
  "qr_svg": "https://wa.abhromodz.in/qr/9f3c...48chars.svg",
  "expires_in": 900
}

qr_png and qr_svg are hosted images of the same UPI code, returned here so one call is enough to show a QR — see action: "qr" below.

status — Query order status

The authoritative outcome of an order, read from the gateway's own record. This is the only thing you may fulfil on. It returns everything fulfilment needs in one call, so you never have to trust anything the customer's browser brought you. Automatically transitions the order to EXPIRED if its window has passed.

Request

curl -X POST https://wa.abhromodz.in/v1 \
  -H "X-API-Key: YOUR_64_CHARACTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "action": "status", "order_id": "PAM-8F2K9DLA31" }'

Response 200

{
  "status": "success",
  "order_id": "PAM-8F2K9DLA31",
  "order_status": "VERIFIED",
  "is_paid": true,
  "amount": 499,
  "currency": "INR",
  "purpose": "ORDER1024",
  "customer_id": "CUST-88",
  "utr": "412198765432",
  "transaction_id": "T2607270405120001",
  "paid_amount": 499,
  "paid_at": "2026-07-27T04:05:09+05:30",
  "expires_in": 0,
  "verified_at": "2026-07-27T04:05:12+05:30",
  "extra_data": { "invoice": "INV-1024", "plan": "pro" }
}

Orders belong to the API key that created them: calling status with another merchant's order_id returns 403, and an unknown one returns 404.

verify — Force a verification check

Immediately runs the verification engine against the order instead of waiting for the background poller. Useful right after the payer confirms they've paid.

Request

curl -X POST https://wa.abhromodz.in/v1 \
  -H "X-API-Key: YOUR_64_CHARACTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "action": "verify", "order_id": "PAM-8F2K9DLA31" }'

Response 200

{
  "status": "success",
  "order_id": "PAM-8F2K9DLA31",
  "order_status": "VERIFIED",
  "decision": "VERIFIED",
  "reason": "Matched email: amount, purpose, UTR and txn id all unique."
}

decision is one of VERIFIED, REJECTED or PENDING; reason explains why.

cancel — Cancel a pending order

Cancels an order that is still PENDING. Verified, expired or already-cancelled orders are returned unchanged.

Request

curl -X POST https://wa.abhromodz.in/v1 \
  -H "X-API-Key: YOUR_64_CHARACTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "action": "cancel", "order_id": "PAM-8F2K9DLA31" }'

Response 200

{
  "status": "success",
  "order_id": "PAM-8F2K9DLA31",
  "order_status": "CANCELLED"
}

refund — Record a refund

Marks an order as REFUNDED for your records. This is a bookkeeping status — the actual money movement happens in your UPI app / bank.

Request

curl -X POST https://wa.abhromodz.in/v1 \
  -H "X-API-Key: YOUR_64_CHARACTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "action": "refund", "order_id": "PAM-8F2K9DLA31" }'

Response 200

{
  "status": "success",
  "order_id": "PAM-8F2K9DLA31",
  "order_status": "REFUNDED"
}

invoice — Get the invoice URL

Returns the hosted, printable invoice URL for an order.

Request

curl -X POST https://wa.abhromodz.in/v1 \
  -H "X-API-Key: YOUR_64_CHARACTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "action": "invoice", "order_id": "PAM-8F2K9DLA31" }'

Response 200

{
  "status": "success",
  "order_id": "PAM-8F2K9DLA31",
  "invoice_url": "https://wa.abhromodz.in/invoice/PAM-8F2K9DLA31",
  "amount": 499,
  "purpose": "ORDER1024",
  "order_status": "VERIFIED"
}

qr — Get UPI URI + QR image URLs

Returns the raw UPI URI plus two hosted image URLs for the same code — a PNG and an SVG. They are plain images: drop them in an <img>, load them in an app, or hand the PNG URL straight to a chat API.

Request

curl -X POST https://wa.abhromodz.in/v1 \
  -H "X-API-Key: YOUR_64_CHARACTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "action": "qr", "order_id": "PAM-8F2K9DLA31" }'

Response 200

{
  "status": "success",
  "order_id": "PAM-8F2K9DLA31",
  "upi_uri": "upi://pay?pa=7430096522%40fam&pn=PAY%20ABHRO%20MODZ&am=499.00&tn=ORDER1024&cu=INR",
  "pay_url": "https://wa.abhromodz.in/pay/TOKEN",
  "qr_png": "https://wa.abhromodz.in/qr/TOKEN.png",
  "qr_svg": "https://wa.abhromodz.in/qr/TOKEN.svg"
}

Website

<img src="https://wa.abhromodz.in/qr/TOKEN.png" alt="Scan to pay" width="320" height="320">

Telegram bot

curl -X POST https://api.telegram.org/bot$TOKEN/sendPhoto \
  -d chat_id=$CHAT_ID \
  -d photo="https://wa.abhromodz.in/qr/TOKEN.png" \
  -d caption="Scan to pay Rs 499"

Telegram fetches the URL itself, so no upload and no base64. Optional ?size= between 128 and 1024 (default 512) sets the pixel width; the image is cached and revalidates with an ETag, and the URL needs no API key — it shows only what the checkout page already shows to the same token holder.

health — Health check (no key)

The only unauthenticated action. Use it for uptime monitoring.

Request

curl -X POST https://wa.abhromodz.in/v1 \
  -H "Content-Type: application/json" \
  -d '{ "action": "health" }'

Response 200

{
  "status": "success",
  "gateway": "PAY ABHRO MODZ",
  "time": "2026-07-27T04:05:12+05:30",
  "version": "v1"
}

Webhooks (callbacks)

If you pass a callback_url when creating an order, PAY ABHRO MODZ sends a server-to-server POST to that URL when the order is verified. The request has a 15-second timeout, and a delivery that does not answer 2xx is retried up to 5 times over roughly 80 minutes. Every attempt is logged in Logs → Callbacks.

Payload

POST https://yoursite.com/webhooks/pam
X-PAM-Signature: 9a1c...hmac-sha256-hex
X-PAM-Signature-V2: 4be7...hmac-sha256-hex
X-PAM-Timestamp: 1785312312
Content-Type: application/json

{
  "order_id": "PAM-8F2K9DLA31",
  "status": "VERIFIED",
  "is_paid": true,
  "amount": 499,
  "currency": "INR",
  "purpose": "ORDER1024",
  "customer_id": "CUST-88",
  "utr": "412198765432",
  "transaction_id": "T2607270405120001",
  "paid_amount": 499,
  "paid_at": "2026-07-27T04:05:09+05:30",
  "verified_at": "2026-07-27T04:05:12+05:30",
  "extra_data": {
    "invoice": "INV-1024",
    "plan": "pro"
  }
}

Same fields as action: "status", so a webhook alone is enough to fulfil once you have verified its signature — you do not need a follow-up call. Still compare amount with what you charged, and keep fulfilment idempotent per order_id: a retry can deliver the same event twice.

Verifying the signature

Both signatures are HMAC-SHA256 keyed with your active API key. Verify X-PAM-Signature-V2 if you can: it covers timestamp + "." + raw body, so you can reject a stale delivery. X-PAM-Signature (the raw body alone) is still sent for existing integrations, but on its own it cannot tell a fresh callback from one captured and replayed a month later.

// PHP
$raw = file_get_contents('php://input');
$ts  = $_SERVER['HTTP_X_PAM_TIMESTAMP']   ?? '';
$sig = $_SERVER['HTTP_X_PAM_SIGNATURE_V2'] ?? '';

// Reject anything older than 5 minutes so a captured callback cannot be replayed.
if (! ctype_digit((string) $ts) || abs(time() - (int) $ts) > 300) {
    http_response_code(400);
    exit('Stale callback');
}

$expected = hash_hmac('sha256', $ts . '.' . $raw, $YOUR_API_KEY);

if (! hash_equals($expected, $sig)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($raw, true);
if ($event['status'] === 'VERIFIED') {
    // mark $event['order_id'] as paid in your database - ignore it if you
    // already have, since a retry can deliver the same event twice
}
http_response_code(200);
echo 'ok';

UPI URI format

The upi_uri returned by create and qr is a standard UPI deep link. Encode it into a QR code, or use it as an href so mobile users open their UPI app directly.

upi://pay?pa=7430096522%40fam&pn=PAY%20ABHRO%20MODZ&am=499.00&tn=ORDER1024&cu=INR

Integration in every language

Pick your language and copy a complete create request. Every snippet sends the POST to https://wa.abhromodz.in/v1 and prints the JSON Response shown at the bottom. The endpoint below is your live gateway URL, filled in automatically — just paste your API key. The same one-function pattern works for status, verify, cancel, refund, invoice, qr and health: only the JSON body changes.

https://yoursite.com/payment/return?order_id=PAM-8F2K9DLA31

curl -X POST https://yourgateway.com/v1 \
  -H "X-API-Key: YOUR_64_CHARACTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "create",
    "amount": 499,
    "purpose": "ORDER1024",
    "customer_id": "CUST-88",
    "callback_url": "https://yoursite.com/webhooks/pam",
    "redirect_url": "https://yoursite.com/payment/return"
  }'

<?php
$body = [
    'action'       => 'create',
    'amount'       => 499,
    'purpose'      => 'ORDER1024',
    'customer_id'  => 'CUST-88',
    'callback_url' => 'https://yoursite.com/webhooks/pam',
    'redirect_url' => 'https://yoursite.com/payment/return',
];

$ch = curl_init('https://yourgateway.com/v1');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'X-API-Key: YOUR_64_CHARACTER_KEY',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => json_encode($body),
]);

$response = json_decode(curl_exec($ch), true);
curl_close($ch);

print_r($response);            // ['status' => 'success', 'order_id' => 'PAM-...', ...]
echo $response['pay_url'];     // send the customer here

import requests

BASE = 'https://yourgateway.com/v1'
HEADERS = {
    'X-API-Key': 'YOUR_64_CHARACTER_KEY',
    'Content-Type': 'application/json',
}

payload = {
    'action': 'create',
    'amount': 499,
    'purpose': 'ORDER1024',
    'customer_id': 'CUST-88',
    'callback_url': 'https://yoursite.com/webhooks/pam',
    'redirect_url': 'https://yoursite.com/payment/return',
}

resp = requests.post(BASE, json=payload, headers=HEADERS, timeout=15)
data = resp.json()
print(data)                 # {'status': 'success', 'order_id': 'PAM-...', ...}
print(data['pay_url'])      # send the customer here

const BASE = 'https://yourgateway.com/v1';
const KEY  = 'YOUR_64_CHARACTER_KEY';

const res = await fetch(BASE, {
  method: 'POST',
  headers: {
    'X-API-Key': KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    action: 'create',
    amount: 499,
    purpose: 'ORDER1024',
    customer_id: 'CUST-88',
    callback_url: 'https://yoursite.com/webhooks/pam',
    redirect_url: 'https://yoursite.com/payment/return',
  }),
});

const data = await res.json();
console.log(data);            // { status: 'success', order_id: 'PAM-...', ... }
console.log(data.pay_url);    // send the customer here

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

var client = HttpClient.newHttpClient();

String json = """
  {"action":"create","amount":499,"purpose":"ORDER1024","customer_id":"CUST-88","callback_url":"https://yoursite.com/webhooks/pam","redirect_url":"https://yoursite.com/payment/return"}
  """;

HttpRequest req = HttpRequest.newBuilder()
    .uri(URI.create("https://yourgateway.com/v1"))
    .header("X-API-Key", "YOUR_64_CHARACTER_KEY")
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(json))
    .build();

HttpResponse<String> res = client.send(req, HttpResponse.BodyHandlers.ofString());
System.out.println(res.body());   // {"status":"success","order_id":"PAM-...", ...}

import okhttp3.*
import okhttp3.MediaType.Companion.toMediaType
import okhttp3.RequestBody.Companion.toRequestBody

val client = OkHttpClient()

val json = """{"action":"create","amount":499,"purpose":"ORDER1024","customer_id":"CUST-88","callback_url":"https://yoursite.com/webhooks/pam","redirect_url":"https://yoursite.com/payment/return"}"""
val body = json.toRequestBody("application/json".toMediaType())

val request = Request.Builder()
    .url("https://yourgateway.com/v1")
    .addHeader("X-API-Key", "YOUR_64_CHARACTER_KEY")
    .post(body)
    .build()

client.newCall(request).execute().use { res ->
    println(res.body?.string())   // {"status":"success","order_id":"PAM-...", ...}
}

import Foundation

var request = URLRequest(url: URL(string: "https://yourgateway.com/v1")!)
request.httpMethod = "POST"
request.setValue("YOUR_64_CHARACTER_KEY", forHTTPHeaderField: "X-API-Key")
request.setValue("application/json", forHTTPHeaderField: "Content-Type")

request.httpBody = try JSONSerialization.data(withJSONObject: [
    "action": "create",
    "amount": 499,
    "purpose": "ORDER1024",
    "customer_id": "CUST-88",
    "callback_url": "https://yoursite.com/webhooks/pam",
    "redirect_url": "https://yoursite.com/payment/return"
])

let (data, _) = try await URLSession.shared.data(for: request)
print(String(data: data, encoding: .utf8)!)   // {"status":"success", ...}

import 'dart:convert';
import 'package:http/http.dart' as http;

final res = await http.post(
  Uri.parse('https://yourgateway.com/v1'),
  headers: {
    'X-API-Key': 'YOUR_64_CHARACTER_KEY',
    'Content-Type': 'application/json',
  },
  body: jsonEncode({
    'action': 'create',
    'amount': 499,
    'purpose': 'ORDER1024',
    'customer_id': 'CUST-88',
    'callback_url': 'https://yoursite.com/webhooks/pam',
    'redirect_url': 'https://yoursite.com/payment/return',
  }),
);

final data = jsonDecode(res.body);
print(data);                // {status: success, order_id: PAM-..., ...}
print(data['pay_url']);     // send the customer here

package main

import (
    "bytes"
    "fmt"
    "io"
    "net/http"
)

func main() {
    body := []byte(`{"action":"create","amount":499,"purpose":"ORDER1024","customer_id":"CUST-88","callback_url":"https://yoursite.com/webhooks/pam","redirect_url":"https://yoursite.com/payment/return"}`)

    req, _ := http.NewRequest("POST", "https://yourgateway.com/v1", bytes.NewBuffer(body))
    req.Header.Set("X-API-Key", "YOUR_64_CHARACTER_KEY")
    req.Header.Set("Content-Type", "application/json")

    res, _ := http.DefaultClient.Do(req)
    defer res.Body.Close()

    out, _ := io.ReadAll(res.Body)
    fmt.Println(string(out))   // {"status":"success","order_id":"PAM-...", ...}
}

require 'net/http'
require 'json'
require 'uri'

uri  = URI('https://yourgateway.com/v1')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = (uri.scheme == 'https')

req = Net::HTTP::Post.new(uri)
req['X-API-Key']    = 'YOUR_64_CHARACTER_KEY'
req['Content-Type'] = 'application/json'
req.body = {
  action: 'create',
  amount: 499,
  purpose: 'ORDER1024',
  customer_id: 'CUST-88',
  callback_url: 'https://yoursite.com/webhooks/pam',
  redirect_url: 'https://yoursite.com/payment/return',
}.to_json

res = http.request(req)
puts res.body   # {"status":"success","order_id":"PAM-...", ...}

using System.Net.Http;
using System.Text;

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-API-Key", "YOUR_64_CHARACTER_KEY");

var json = "{\"action\":\"create\",\"amount\":499,\"purpose\":\"ORDER1024\",\"customer_id\":\"CUST-88\",\"callback_url\":\"https://yoursite.com/webhooks/pam\",\"redirect_url\":\"https://yoursite.com/payment/return\"}";
var content = new StringContent(json, Encoding.UTF8, "application/json");

var res = await client.PostAsync("https://yourgateway.com/v1", content);
var out = await res.Content.ReadAsStringAsync();
Console.WriteLine(out);   // {"status":"success","order_id":"PAM-...", ...}

Response 200 — same JSON for every language

{
  "status": "success",
  "order_id": "PAM-8F2K9DLA31",
  "amount": 499,
  "purpose": "ORDER1024",
  "pay_url": "https://wa.abhromodz.in/pay/9f3c...48chars",
  "upi_uri": "upi://pay?pa=7430096522%40fam&pn=PAY%20ABHRO%20MODZ&am=499.00&tn=ORDER1024&cu=INR",
  "qr_png": "https://wa.abhromodz.in/qr/9f3c...48chars.png",
  "qr_svg": "https://wa.abhromodz.in/qr/9f3c...48chars.svg",
  "expires_in": 900
}

The redirect is navigation — the outcome comes from your server

The customer arrives at your redirect_url with nothing but ?order_id=. That is deliberate: anyone can type a URL, so a parameter claiming VERIFIED — signed or not — would be a bypass waiting to happen. Treat the redirect as “this person is back, go look up their order”, and get the answer one of these two ways:

• Ask the gateway directly — a server-to-server status call with the order_id, and release goods only on is_paid: true. Your API key never leaves your server, so the customer cannot make this call or alter its answer.
• Or let the webhook drive it — verify the X-PAM-Signature-V2 header on your callback_url (see Webhooks) and fulfil there. Recommended for anything valuable, because it does not depend on the customer's browser coming back at all.

Whichever you use, do these three checks before releasing anything: the order_id is one you created (look it up in your own database, do not trust it as an identity), the returned amount matches what you charged, and you have not already fulfilled that order_id. And remember PENDING is normal on arrival — the bank email may still be in flight, so show “confirming your payment” rather than a failure.

<?php
$key = 'YOUR_64_CHARACTER_KEY';   // server-side only, never in HTML or JS

// 1) The redirect brings one thing: which order the customer came back from.
$orderId = $_GET['order_id'] ?? '';

// 2) It must be an order YOU created. This is also what stops someone
//    replaying a stranger's order_id to unlock your goods.
$cart = my_find_cart_by_order_id($orderId);   // your own database
if (! $cart) {
    http_response_code(404);
    exit('Unknown order.');
}
if ($cart['fulfilled']) {
    exit('Already delivered.');                // idempotent by order_id
}

// 3) Authoritative answer, server-to-server. The customer cannot touch this.
$ch = curl_init('https://yourgateway.com/v1');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['X-API-Key: ' . $key, 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => json_encode(['action' => 'status', 'order_id' => $orderId]),
]);
$order = json_decode(curl_exec($ch), true);
curl_close($ch);

// 4) Paid, and paid the right amount.
$paid = ($order['is_paid'] ?? false) === true
     && (float) ($order['amount'] ?? 0) === (float) $cart['total'];

if ($paid) {
    my_fulfil($cart, $order['utr'] ?? null);   // deliver the goods
    exit('Payment confirmed.');
}

if (($order['order_status'] ?? '') === 'PENDING') {
    exit('We are confirming your payment - this page will update shortly.');
}

exit('Payment not completed.');                // deliver nothing

const KEY = 'YOUR_64_CHARACTER_KEY';   // server-side only

app.get('/payment/return', async (req, res) => {
  // 1) All the redirect carries.
  const { order_id } = req.query;

  // 2) It must be an order you created, and not one already delivered.
  const cart = await findCartByOrderId(order_id);
  if (!cart) return res.status(404).send('Unknown order');
  if (cart.fulfilled) return res.send('Already delivered');

  // 3) Authoritative answer, server-to-server.
  const r = await fetch('https://yourgateway.com/v1', {
    method: 'POST',
    headers: { 'X-API-Key': KEY, 'Content-Type': 'application/json' },
    body: JSON.stringify({ action: 'status', order_id }),
  });
  const order = await r.json();

  // 4) Paid, and for the right amount.
  if (order.is_paid === true && Number(order.amount) === Number(cart.total)) {
    await fulfil(cart, order.utr);
    return res.send('Payment confirmed');
  }

  if (order.order_status === 'PENDING') {
    return res.send('We are confirming your payment...');
  }

  res.send('Payment not completed');
});

import requests
from flask import request, abort

KEY = 'YOUR_64_CHARACTER_KEY'   # server-side only

@app.get('/payment/return')
def payment_return():
    # 1) All the redirect carries.
    order_id = request.args.get('order_id', '')

    # 2) It must be an order you created, and not one already delivered.
    cart = find_cart_by_order_id(order_id)
    if not cart:
        abort(404)
    if cart['fulfilled']:
        return 'Already delivered'

    # 3) Authoritative answer, server-to-server.
    r = requests.post('https://yourgateway.com/v1',
        headers={'X-API-Key': KEY, 'Content-Type': 'application/json'},
        json={'action': 'status', 'order_id': order_id}, timeout=15)
    order = r.json()

    # 4) Paid, and for the right amount.
    if order.get('is_paid') is True and float(order['amount']) == float(cart['total']):
        fulfil(cart, order.get('utr'))
        return 'Payment confirmed'

    if order.get('order_status') == 'PENDING':
        return 'We are confirming your payment...'

    return 'Payment not completed'

Full integration examples

// PAY ABHRO MODZ — all-in-one integration (Node.js 18+, global fetch)
const crypto = require('node:crypto');

const BASE = 'https://wa.abhromodz.in/v1';          // auto-detected gateway endpoint
const KEY  = 'YOUR_64_CHARACTER_KEY';   // from Dashboard -> API Keys

// Single helper — every action goes through this one function.
async function pam(body) {
  const res = await fetch(BASE, {
    method: 'POST',
    headers: { 'X-API-Key': KEY, 'Content-Type': 'application/json' },
    body: JSON.stringify(body),
  });
  const data = await res.json();
  if (data.status !== 'success') throw new Error(data.message || 'API error');
  return data;
}

async function main() {
  // 1) Create an order
  const order = await pam({
    action: 'create',
    amount: 499,
    customer_id: 'CUST-88',
    callback_url: 'https://yoursite.com/webhooks/pam',
    expires_in: 900,
  });
  console.log('Pay page :', order.pay_url);
  console.log('UPI URI  :', order.upi_uri);
  console.log('QR image :', order.qr_png);   // <img src> / sendPhoto - no decoding

  // 2) The same URLs are also available on their own at any time
  const qr = await pam({ action: 'qr', order_id: order.order_id });
  console.log('QR PNG   :', qr.qr_png, '  QR SVG :', qr.qr_svg);

  // 3) Poll every 4s until verified or the window closes
  let status;
  do {
    await new Promise(r => setTimeout(r, 4000));
    status = await pam({ action: 'status', order_id: order.order_id });
    console.log('Status   :', status.order_status);
  } while (status.order_status === 'PENDING');

  console.log('Final    :', status.order_status);   // VERIFIED / EXPIRED / ...
}

// Webhook receiver — verify the signature before trusting the payload.
function verifyWebhook(rawBody, signatureHeader) {
  const expected = crypto.createHmac('sha256', KEY).update(rawBody).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signatureHeader || ''));
}

main().catch(err => console.error('Error:', err.message));

Replace https://yourgateway.com/v1 with the endpoint shown at the top of this page, and YOUR_64_CHARACTER_KEY with your key.

Node.js (fetch)

const BASE = 'https://yourgateway.com/v1';
const KEY  = 'YOUR_64_CHARACTER_KEY';

async function call(body) {
  const res = await fetch(BASE, {
    method: 'POST',
    headers: {
      'X-API-Key': KEY,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify(body),
  });
  return res.json();
}

// 1) Create an order
const order = await call({
  action: 'create',
  amount: 499,
  customer_id: 'CUST-88',
  callback_url: 'https://yoursite.com/webhooks/pam',
});
console.log(order.pay_url, order.upi_uri);

// 2) Poll for status
const status = await call({ action: 'status', order_id: order.order_id });
console.log(status.order_status); // PENDING -> VERIFIED

PHP (cURL)

function pam($body) {
    $ch = curl_init('https://yourgateway.com/v1');
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => [
            'X-API-Key: YOUR_64_CHARACTER_KEY',
            'Content-Type: application/json',
        ],
        CURLOPT_POSTFIELDS => json_encode($body),
    ]);
    $out = curl_exec($ch);
    curl_close($ch);
    return json_decode($out, true);
}

$order = pam([
    'action' => 'create',
    'amount' => 499,
    'customer_id' => 'CUST-88',
]);
echo $order['pay_url'];

Python (requests)

import requests

BASE = 'https://yourgateway.com/v1'
HEADERS = {'X-API-Key': 'YOUR_64_CHARACTER_KEY'}

def call(body):
    return requests.post(BASE, json=body, headers=HEADERS, timeout=15).json()

order = call({'action': 'create', 'amount': 499, 'customer_id': 'CUST-88'})
print(order['pay_url'], order['upi_uri'])

status = call({'action': 'status', 'order_id': order['order_id']})
print(status['order_status'])