REST API v1

PayZapy Payment Gateway API Reference

Integrate direct UPI checkout, multi-provider verification (FamPay, BharatPe, Paytm), and HMAC-SHA256 webhooks in minutes.

01. Authentication

Pass your API key (`fam_live_...` or `fam_test_...`) in the `X-API-Key` header or `Authorization: Bearer` header.

X-API-Key: fam_live_your_48_char_hex_key
# OR
Authorization: Bearer fam_live_your_48_char_hex_key

POST /api/v1/create or `/api/v1/{fampay|bharatpe|paytm}/create`

Creates a new UPI payment order, generates a scannable QR code data URL, and returns a hosted checkout URL (`/pay/{order_id}`).

curl -X POST https://freex.mixygrow.in/api/v1/create \
  -H "Content-Type: application/json" \
  -H "X-API-Key: fam_live_xxxxxxxxxxxxxxxx" \
  -d '{
    "amount": 250.00,
    "payment_provider": "fampay",
    "client_order_id": "INV-2026-991",
    "customer_name": "Rohan Gupta",
    "customer_email": "rohan@example.com",
    "description": "Pro Plan Renewal",
    "redirect_url": "https://yourstore.com/thank-you",
    "expiry_minutes": 15
  }'

GET /api/v1/check?order_id=ord_xxx

Retrieves current status (`pending`, `completed`, `expired`, `cancelled`). When called with your `X-API-Key`, returns full customer, metadata, and UTR details.

curl "https://freex.mixygrow.in/api/v1/check?order_id=ord_m9z8x4a1" \
  -H "X-API-Key: fam_live_xxxxxxxxxxxxxxxx"

POST /api/v1/verify

Verifies a 12-digit UPI Reference Number (UTR) against the order's configured payment provider (`fampay`, `bharatpe`, or `paytm`) with strict duplicate-UTR protection.

curl -X POST https://freex.mixygrow.in/api/v1/verify \
  -H "Content-Type: application/json" \
  -d '{"order_id": "ord_m9z8x4a1", "utr": "412389102938"}'

04. Webhook Signature Verification (HMAC-SHA256)

Every webhook POST request includes `X-FamPay-Signature` (and `X-PayZapy-Signature`) computed with your `whsec_...` secret over the raw JSON body.

// PHP Webhook Verification Example
$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_FAMPAY_SIGNATURE'] ?? '';
$expected = hash_hmac('sha256', $rawBody, 'whsec_your_webhook_secret');

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}
$event = json_decode($rawBody, true);
// Handle $event['event'] === 'payment.completed'