The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Three Razorpay integration mistakes can leave a payment uncaptured, let an unverified browser response trigger fulfillment, or keep an order stuck in the wrong state: skipping server-created orders, trusting Checkout fields without verifying the signature, and treating authorization or webhook timing as proof of final payment. Razorpay’s documentation describes these risks and the required controls; it does not establish how often they occur or verify personal code-review experience.
1. Checkout is not bound to a server-created order
How the bug appears
The application opens Checkout without first creating an order through the server-side Orders API, or it creates one but does not pass its ID as order_id to Checkout. That breaks the intended link between the payment and the purchase recorded by the application.
Razorpay says an order should be created for every payment. Its integration guidance also warns that payments made without an order_id cannot be captured and will be automatically refunded. See Razorpay’s server-side order creation guidance.
What to check in review
- Is the order created on the backend before the application returns Checkout options?
- Does the backend associate the order ID and amount with the specific purchase the customer intends to make?
- Does Checkout receive the order ID returned by that server-side order creation?
- Can a client-supplied amount or order ID override the server’s purchase record?
How to fix it
Create one order per payment on the server, retain its ID and purchase details in trusted application state, and pass that ID into Checkout. Treat browser input as untrusted: the backend should determine the amount and purchase association rather than accepting either as authoritative from the client.
#1 Best Overall
- Use the, easy-to-use, and customizable POS to get started.
- Accept contactless payments, chip cards, Apple Pay, and Google Pay from anywhere, with improved connectivity, extended battery life, and enhanced security. Pay one low rate for every tap or dip.
- No long-term commitments or contracts, no monthly fees- and with offline payments, keep taking payments for up to 24 hours.
- Safely and securely accepts payments anywhere. Plus, get data security, 24/7 fraud prevention, and payment-dispute management at no extra cost.
- Use the, easy-to-use, and customizable POS to get started.
2. The app trusts Checkout’s response without server-side signature verification
How the bug appears
Checkout returns razorpay_payment_id, razorpay_order_id, and razorpay_signature. A risky implementation treats the success callback as sufficient proof of payment, or uses the returned order ID as the trusted input for verification without checking it against the application’s own record.
Those values arrive through the client, so the backend must validate the result before treating it as authentic. Razorpay’s integration steps describe storing the returned fields server-side and verifying the signature. Its security checklist says the order ID used to generate the HMAC must come from a trusted source.
Rank #2
- Get your money as soon as the next business day.
- Get set up quickly with no long-term commitments. Download the Square Point of Sale app for free, create an account, and start taking payments anywhere.
- Run your business all in one place with the free Square Point of Sale app. Track your sales, manage inventory, accept tips, send receipts digitally, and more.
- Works with Apple devices with a Lightning connector.
What to check in review
- Does the client send the returned fields to a backend endpoint instead of making the fulfillment decision locally?
- Does the backend retrieve the expected order ID from its own trusted state for this purchase?
- Is signature verification performed on the server with the API secret?
- Is the secret absent from browser code, mobile builds, and other client-distributed artifacts?
How to fix it
Send the Checkout response fields to the backend, look up the expected order ID from trusted server-side state, and verify the signature there before accepting the result. Razorpay documents a SHA-256 HMAC over order_id + "|" + razorpay_payment_id using the API secret. Keep that secret on the server; do not let a client-provided order ID become the verification source of truth.
3. Authorization, capture, and webhook delivery are treated as the same event
How the bug appears
An authorized payment is not necessarily captured. If the application fulfills an order at authorization rather than waiting for capture, it can deliver value before Razorpay’s documented fulfillment condition is met. Razorpay says to deliver products or services only after capture; uncaptured payments are automatically refunded. The integration guide covers this payment flow.
Rank #3
- With Square Terminal, you can ring up sales, accept payments, and print receipts, all with one device. Use it at the counter or ring up customers anywhere in your store.
- Accept all major credit and debit cards and pay one low rate with no hidden fees and no long-term contracts.
- Process chip cards in just two seconds.
- Get your money as soon as the next business day.
- Use it cordlessly with the built-in battery, designed to last all day.
A separate timing mistake is assuming an asynchronous webhook will arrive before a user-facing screen needs to show a result. Webhooks are useful for background automation, but their delivery is not a synchronous response to a customer action.
What to check in review
- Is fulfillment gated on a captured payment rather than authorization alone?
- Can the application handle a delayed or missing notification by fetching current payment or order status?
- Does the backend validate webhook signatures before acting on webhook data?
How to fix it
Represent authorization and capture as distinct lifecycle states. Use webhooks to trigger asynchronous work and validate their signatures. If a critical user-facing flow needs an answer before a webhook arrives, fetch the current state from Razorpay’s API rather than assuming the notification has already been delivered.
Rank #4
- Pay one transparent rate per swipe for Visa, Mastercard, Discover and American Express.
- Works in conjunction with most downloadable Square point-of-sale apps on your device. Customers can pay, tip and sign directly on your device. Track payments in cash, gift cards and more. Also lets you send receipts via e-mail or text message, makes it easy to apply discounts, keeps a data and sales history log and more.
- Accepts magstripe credit card payments, including those from Visa, Mastercard, Discover and American Express (fees apply).
- App sends deposits to your bank account within 1 to 2 business days, or enjoy instant deposits (fees apply).
Payment status and order status answer different questions
Razorpay’s order-state documentation says an order becomes attempted when a payment is first attempted and becomes paid after successful capture. It also remains paid if the associated payment is later refunded. Keep refund status distinct from the order’s lifecycle state; a refund does not simply turn that order back into an unpaid one.
This distinction matters when reconciling a screen that says a payment is authorized, an order that remains pending, or an order recorded as paid after a later refund. The application should base each action on the state relevant to that action, not collapse payment, capture, order, and refund into one generic success flag.
Quick Recap
Best Value
- Accept all major credit and debit cards and pay one low rate
- No hidden fees and no long-term contracts
- Mobile card reader that accepts payments anywhere & anytime
- Use the free SumUp App on your smartphone or tablet to start accepting transactions
- Simply pay 2.6% +10 per in-person transaction
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
