What is the Razorpay payment flow?
Backend creates order → frontend opens checkout with order ID → customer pays → Razorpay sends payment ID and signature to frontend → frontend sends to backend → backend verifies signature → backend updates database → Razorpay sends webhook → backend verifies webhook signature → backend updates database (source of truth).
Verify This Answer
Cross-check this information using these trusted sources:
More FAQs in Razorpay Summary and Complete Integration Node.js Payment Gateway Guide
Setup (account, keys, SDK), create order endpoint, frontend checkout, payment verification with signature, webhook handling (payment.captured, payment.failed, refund.processed), subscriptions (plans, recurring billing), security (verify signatures, don't trust frontend amounts), and testing (test mode, test cards, ngrok).
RAZORPAY_KEY_ID (rzp_test_ or rzp_live_), RAZORPAY_KEY_SECRET (from dashboard), and RAZORPAY_WEBHOOK_SECRET (set when creating the webhook in the dashboard). Store in .env, never in code or frontend.
Verify webhook signatures (HMAC-SHA256), use express.raw() for webhooks, get amounts from database (not frontend), verify payment amounts match orders, require admin auth for refunds, use HTTPS only, implement idempotency, and log all webhooks for audit.
Still have questions?
Browse all our FAQs or reach out to our support team