Card

You can accept card payments directly via this API. PCI-DSS compliance and encryption using RSA 4096-bit key is mandatory.

🔐 Important:

• To integrate with the Custom Card Flow, you must be PCI-DSS certified.

• Card Number and CVV must be encrypted using RSA 4096 with padding method RSA/ECB/PKCS1Padding.

• The encryptionKey and encryptionKeyId will be provided at the MID level.

• If you’re operating with multiple MIDs, note that the encryption credentials will differ for each. Avoid hardcoding these values.

EnvironmentHTTP MethodAPI
SandboxPOSThttps://api-preprod.phonepe.com/apis/pg-sandbox/payments/v2/pay
ProductionPOSThttps://api.phonepe.com/apis/pg/payments/v2/pay

⚠️ Before initiating a payment, install the PhonePe Test App and configure the payment template. Skipping this step may result in HTTP 500 errors.

Request Header
Header NameHeader ValueDescription
Content-Typeapplication/json
AuthorizationO-Bearer <access_token>Pass access_token received in Authorization call
Request Parameters
Parameter NameData TypeMandatoryDescriptionConstraints
merchantOrderIdStringYesUnique merchant order id generated by merchant.Max Length = 63 charactersNo Special characters allowed except underscore “_” and hyphen “-“
amountLongYesOrder amount in paisa.Min Value = 100 (In paise)
expireAfterLongNoOrder expiry in seconds. If not passed default value will be used.Min Value = 300, Max Value = 5184000

Default Value (in Secs):
UPI QR: 480
UPI Intent : 600
UPI Collect: 480
Card : 720
NetBanking : 480
metaInfoObjectNoMerchant defined meta info to store additional information.same data will be returned in status and callback response.
metaInfo.udf1-5StringNoMerchant defined additional informationMax length = 256 characters 
deviceContext.deviceOSStringYesdevice OS required only in case of UPI_INTENTValues Allowed = [IOS, ANDROID]
deviceContext.merchantCallBackSchemeStringYesMerchant Callback Scheme. Required only in case targetApp = PHONEPE and deviceContext.deviceOS = IOS
paymentFlowObjectYesAdditional details required by this flow.
paymentMode.typeStringYesType of payment modeValues Allowed:
• UPI_INTENT
• UPI_COLLECT
• UPI_QR
• NET_BANKING
• TOKEN
• CARD
merchantUrls.redirectUrlStringYesUrl where user will be redirected after completing the payment. Mandatory only for [NET_BANKING, TOKEN, CARD] Payment Mode.Valid Http url. 
headers
body params
Sample Response
{
"orderId": "OMO123456789",
"state": "PENDING",
"expireAt": 1703756259307,
"redirectUrl": ""
}
Field NameData TypeDescription
orderIdStringPG generated internal order id.
stateStringState of the order created, Expected value is CREATED.
expiryAtLongOrder expiry date in epoch (in milliseconds).
redirectUrlStringUrl where merchant is supposed to redirect user to complete payment.
Is this article helpful?