Authentication Type for Cards - Native OTP

Use Razorpay’s Native OTP feature to provide an efficient and simple OTP flow to your customers, reduce payment failures due to low internet speeds and avoid payment failure due to redirects to bank pages.

Prerequisites

Before implementing the Native OTP feature, check if the following requirements are in place:

1. Step 1

   Verify that you are PCI-compliant to accept and process the customer’s card details. Know more about PCI compliance. The compliance certificate should be updated as per the yearly renewal cycle.

2. Step 2

   Raise a request with Razorpay Support to enable this feature on your Checkout page.

3. Step 3

   Understand the payment process.

Create Workflow for Native OTP

1. Step 1

   Creating a Razorpay order

2. Step 2

   Validating authentication type

3. Step 3

   Creating a payment

4. Step 4

   OTP Authentication

5. Step 5

   Payment Verification

API Authentication

Razorpay APIs are authenticated using Basic Auth method, where your_key_id is the Username and your_key_secret is the Password. You can access your API keys from the Dashboard.

1. Create a Razorpay Order

A Razorpay Order creates an Order ID corresponding to the unique order (transaction ID or checkout ID) created at your end. The Order ID is tied to all the payments made against that particular order.

/orders

Order is an important step in the payment process.

• An order should be created for every payment.
• You can create an order using the Orders API. It is a server-side API call. Know how to authenticate Orders API.
• The order_id received in the response should be passed to the checkout. This ties the Order with the payment and secures the request from being tampered.

Watch Out!

Payments made without an order_id cannot be captured and will be automatically refunded. You must create an order before initiating payments to ensure proper payment processing.

API Sample Code

The following is a sample API request and response for creating an order:

Curl

curl -X POST https://api.razorpay.com/v1/orders
-u [YOUR_KEY_ID]:[YOUR_KEY_SECRET]
-H 'content-type:application/json'
-d '{
    "amount": 50000,
    "currency": "INR",
    "receipt": "rcptid_11",
    "partial_payment": true,
    "first_payment_min_amount": 23000
}'
```java: Java
try {
  JSONObject orderRequest = new JSONObject();
  orderRequest.put("amount", 50000); // amount in the smallest currency unit
  orderRequest.put("currency", "INR");
  orderRequest.put("receipt", "order_rcptid_11");

  Order order = razorpay.Orders.create(orderRequest);
} catch (RazorpayException e) {
  // Handle Exception
  System.out.println(e.getMessage());
}
```Python: Python
import razorpay
client = razorpay.Client(auth=("api_key", "api_secret"))

DATA = {
    "amount": 50000,
    "currency": "INR",
    "receipt": "receipt#1",
    "notes": {
        "key1": "value3",
        "key2": "value2"
    }
}
client.order.create(data=DATA)
```php: PHP
$order  = $client->order->create([
  'receipt'         => 'order_rcptid_11',
  'amount'          => 50000, // amount in the smallest currency unit
  'currency'        => 'INR'// [See the list of supported currencies](/payments/international-payments#supported-currencies).)
]);
```csharp: .NET
Dictionary options = new Dictionary();
options.Add("amount", 50000); // amount in the smallest currency unit
options.add("receipt", "order_rcptid_11");
options.add("currency", "INR");
Order order = client.Order.Create(options);
```ruby: Ruby
options = amount: 50000, currency: 'INR', receipt: ''
order = Razorpay::Order.create
```javascript: Node.js
var options = {
  amount: 50000,  // amount in the smallest currency unit
  currency: "INR",
  receipt: "order_rcptid_11"
};
instance.orders.create(options, function(err, order) {
  console.log(order);
});
```json: Response
{
    "id": "order_DBJOWzybf0sJbb",
    "entity": "order",
    "amount": 50000,
    "amount_paid": 0,
    "amount_due": 50000,
    "currency": "INR",
    "receipt": "rcptid_11",
    "status": "created",
    "attempts": 0,
    "notes": [],
    "created_at": 1566986570
}

Request Parameters

Here is the list of parameters and their description for creating an order:

amount mandatory : integer Payment amount in the smallest currency sub-unit. For example, if the amount to be charged is 299, then pass 29900 in this field. In the case of three decimal currencies, such as KWD, BHD and OMR, to accept a payment of 295.991, pass the value as 295990. And in the case of zero decimal currencies such as JPY, to accept a payment of 295, pass the value as 295.

Watch Out!

As per payment guidelines, you should pass the last decimal number as 0 for three decimal currency payments. For example, if you want to charge a customer 99.991 KD for a transaction, you should pass the value for the amount parameter as 99990 and not 99991.

currency mandatory : string The currency in which the transaction should be made. See the list of supported currencies. Length must be 3 characters.

Handy Tips

Razorpay has added support for zero decimal currencies, such as JPY and three decimal currencies, such as KWD, BHD and OMR, allowing businesses to accept international payments in these currencies. Know more about Currency Conversion (May 2024).

receipt optional : string Your receipt id for this order should be passed here. Maximum length is 40 characters.

notes optional : json object Key-value pair that can be used to store additional information about the entity. Maximum 15 key-value pairs, 256 characters (maximum) each. For example, "note_key": "Beam me up Scotty”.

partial_payment optional : boolean Indicates whether the customer can make a partial payment. Possible values:

• true: The customer can make partial payments.
• false (default): The customer cannot make partial payments.

id mandatory : string Unique identifier of the customer. For example, cust_1Aa00000000004.

Know more about Orders API.

Response Parameters

Descriptions for the response parameters are present in the Orders Entity table.

Error Response Parameters

The error response parameters are available in the API Reference Guide.

2. Validate Authentication Type

Validate the authentication type to set the value of auth_type in payment creation. The transaction will fail if the value of auth_type is sent as otp for a BIN, which is not validated successfully.

The following API endpoint allows Razorpay to verify the OTP-based authentication flow for a specific card:

/payment/flows

Example Request

curl -X POST https://api.razorpay.com/v1/payment/flows \
-u : \
-H 'content-type: application/json'
-d '{
  "card_number": "4242424242424242"
}'
```json: Validation Success
{
  "otp": true,
  "pin": true/false
}

```json: Validation Failure
{
  []
}

3. Create a Payment

Use the following API to create a payment using the Order ID.

/payments/create/redirect

Request Parameters

currency mandatory : string The currency of the payment amount. Pass INR for Indian rupees as currently, we do not support foreign currencies.

amount mandatory : integer The payment amount in paise. For example, if the payment amount is ₹195.55, pass 19555.

order_id mandatory : string The unique identifier of the order created in step 1.

email mandatory : string The customer’s email address. For example, [e-mail].

contact mandatory : string The customer’s contact number. For example, [phone].

method mandatory : string The payment method selected by the customer. The only allowed value is card.

card[number] mandatory : integer Unformatted card number. This field is required if value of method is card. Use one of our test cards to try out the payment flow.

card[name] mandatory : string The name of the cardholder.

card[expiry_month] mandatory : integer The expiry month of the card in MM format. For example, 01 for January and 12 for December.

card[expiry_year] mandatory : integer Expiry year for card in YY format. For example, 22 for 2022.

card[cvv] mandatory : integer 3-digit code on the back of Master or Visa card or 4-digit code on the front of the AMEX card.

notes optional : object A set of key-value pairs that you can attach to an entity. Maximum 15 pairs. Maximum 256 characters for each pair. This can be useful for storing additional information about the entity.

ip mandatory : string The client’s IP address.

referer mandatory : string The client’s referer URL.

user_agent mandatory : string The client’s User-Agent.

auth_type mandatory : string Indicates the authentication type for this integration method. Defaults to 3ds. Upon successful validation, pass auth_type=otp. @// Passing auth_type=otp when the validation has failed, will result in payment failure.

Response Parameters

razorpay_payment_id : string Specifies the unique identifier of a payment. A sample payment ID: pay_29QQoUBi66xm2f

next : array Lists the subsequent payment actions available: otp_submit and otp_resend Know more about next actions.

The following example request creates a payment of ₹50:

Handy Tips

The payment data is passed in form-urlencoded format, which ensures that nested keys are correctly passed.

Example Request with auth_type

curl -X POST \
'https://api.razorpay.com/v1/payments/create/redirect' \
-u : \
-H "Content-Type: application/x-www-form-urlencoded" \
-d 'amount=5000&currency=INR&contact=9123456780&email=[e-mail]&method=card&card[number]=4386289407660153&card[name]=Gaurav%20Kumar&card[expiry_month]=01&card[expiry_year]=17&card[cvv]=111&user_agent=Razorpay%20SDK&ip=1.160.10.240&referer=https://www.example.com&auth_type=otp'
```json: Response with OTP
{
"next": [
"otp_submit",
"otp_resend"
],
"razorpay_payment_id": "pay_Bf9GPSOEQg0NTi"
}
@// {
@// "razorpay_payment_id": "pay_29QQoUBi66xm2f",
@//  "razorpay_order_id": "order_9A33XWu170gUtm",
@// "razorpay_signature": "9ef4dffbfd84f1318f6739a3ce19f9d85851857ae648f114332d8401e0949a3d",
@// "next": ["otp_submit", "otp_resend"]
@// }

Error Responses

Normal Error Response

{
  "error": {
    "code": "BAD_REQUEST_ERROR",
    "description": "Your payment was not successful as you have an invalid expiry date. To pay successfully try adding the right details",
    "source": "customer",
    "step": "payment_authentication",
    "reason": "incorrect_card_expiry_date",
    "metadata": {}
  }
}
```json: Feature Unavailable for the BIN
{
  "error": {
    "code": "BAD_REQUEST_ERROR",
    "description": "The otp authentication type is not applicable on the given card",
    "source": "business",
    "step": "payment_initiation",
    "reason": "input_validation_failed",
    "metadata": {
      "payment_id": "pay_IAnwCdYqXiBjZ7"
    }
  }
}

Know More: Know more about API error codes.

4. OTP Authentication

After entering the OTP, the customer can perform either of the two actions, as described in the next parameter:

1. OTP Submit
2. OTP Resend

next : array This array specifies the available actions as a comma-separated list. It can have the following predefined values:

• otp_submit
• otp_resend

In cases where two-factor authentication is not required or not available, the next object will not be returned in the response.

[next]otp_submit : string This value is consumed to display OTP submit option.

[next]otp_resend : string This value is consumed as a retry option for OTP submission. If the parameter is not present, the OTP resend option cannot be shown to the customers. The resend option may be unavailable after a certain number of retries. The bank determines the number of retries and not Razorpay.

OTP Submission

The customer needs to submit the OTP using your application frontend as part of the payment authentication process.

For card payments, the customer receives the OTP using their preferred notification medium - SMS or email.

Handy Tips

Do not perform any validation on the length of the OTP since this can vary across banks. The OTP should not be blank.

The OTP received must be submitted to the following endpoint:

payments/:id/otp/submit

Curl

curl -X POST \
'https://api.razorpay.com/v1/payments/pay_29QQoUBi66xm2f/otp/submit' \
-u : \
-H "Content-Type: application/x-www-form-urlencoded" \
-d 'otp=123456'

```java: Java
RazorpayClient razorpay = new RazorpayClient("[YOUR_KEY_ID]", "[YOUR_KEY_SECRET]");

String paymentId = "pay_29QQoUBi66xm2f";

String jsonRequest = "{\n" +
                "  \"otp\": \"123456\",\n" +
                "}";

JSONObject requestJson = new JSONObject(jsonRequest);

Payment payment = razorpayclient.payments.otpSubmit(paymentId, requestJson);

```ruby: Ruby
require "razorpay"
Razorpay.setup('YOUR_KEY_ID', 'YOUR_SECRET')

para_attr = {
  "otp": "123456"
}

paymentId = "pay_29QQoUBi66xm2f";

Razorpay::Payment.otp_generate(paymentId, para_attr)

```csharp: .NET

RazorpayClient client = new RazorpayClient("[YOUR_KEY_ID]", "[YOUR_KEY_SECRET]");

string paymentId = "pay_Z6t7VFTb9xHeOs";

Dictionary paymentRequest = new Dictionary();
paymentRequest.Add("otp", "123456");

Payment payment = client.Payment.OtpSubmit(paymentId, paymentRequest);

```json: Success
{
  "razorpay_payment_id": "pay_29QQoUBi66xm2f",
  "razorpay_order_id": "order_9A33XWu170gUtm",
  "razorpay_signature": "9ef4dffbfd84f1318f6739a3ce19f9d85851857ae648f114332d8401e0949a3d"
}
```json: Failure
{
  "error": {
    "code": "BAD_REQUEST_ERROR",
    "description": "Payment processing failed because of incorrect OTP",
    "source": "customer",
    "step": "payment_authentication",
    "reason": "incorrect_otp",
    "metadata": {
      "payment_id": "pay_IAnpZpkZriWX1T"
    },
    "action": "RETRY"
  },
  "next": [
    "otp_submit",
    "otp_resend"
  ]
}

Know more about Error Codes.

OTP Resend

For certain situations, the customers may need to re-enter the OTP sent to them. The card issuing bank sets the number of retries the customer is allowed to re-enter the OTP.

payments/:id/otp/resend

Curl

curl -X POST \
'https://api.razorpay.com/v1/payments/pay_29QQoUBi66xm2f/otp/resend' \
-u :
-H "Content-Type: application/x-www-form-urlencoded"

```java: Java
RazorpayClient razorpay = new RazorpayClient("[YOUR_KEY_ID]", "[YOUR_KEY_SECRET]");

String paymentId = "pay_29QQoUBi66xm2f";

Payment payment = razorpayclient.payments.otpResend(paymentId);

```ruby: Ruby
require "razorpay"
Razorpay.setup('YOUR_KEY_ID', 'YOUR_SECRET')

paymentId = "pay_29QQoUBi66xm2f";

Razorpay::Payment.otp_resend(paymentId)

```csharp: .NET

RazorpayClient client = new RazorpayClient("[YOUR_KEY_ID]", "[YOUR_KEY_SECRET]");

string paymentId = "pay_Z6t7VFTb9xHeOs";

Payment payment = client.Payment.OtpResend(paymentId);

```json: Response with OTP
{
  "next": [
    "otp_submit",
    "otp_resend"
  ],
  "razorpay_payment_id": "pay_Bf9GPSOEQg0NTi"
}

```json: Success
{
  "next": ["otp_submit", "otp_resend"],
  "razorpay_payment_id": "pay_29QQoUBi66xm2f"
}

5. Verify the Payment

After the payment process is complete, Razorpay makes a POST request to the callback_url about whether the payment was a success or a failure.

You can easily verify the payment signature using our SDKs:

Java

RazorpayClient razorpay = new RazorpayClient("[YOUR_KEY_ID]", "[YOUR_KEY_SECRET]");

String secret = "EnLs21M47BllR3X8PSFtjtbd";

JSONObject options = new JSONObject();
options.put("razorpay_order_id", "order_9A33XWu170gUtm");
options.put("razorpay_payment_id", "pay_29QQoUBi66xm2f");
options.put("razorpay_signature", "9ef4dffbfd84f1318f6739a3ce19f9d85851857ae648f114332d8401e0949a3d");

boolean status =  Utils.verifyPaymentSignature(options, secret);

```python: Python
params = {
  "razorpay_order_id": "order_9A33XWu170gUtm",
  "razorpay_payment_id": "pay_29QQoUBi66xm2f",
  "razorpay_signature": "9ef4dffbfd84f1318f6739a3ce19f9d85851857ae648f114332d8401e0949a3d"
}
client.utility.verify_payment_signature(params_dict)

```php: PHP
$params = [
  'razorpay_order_id'     =>  'order_9A33XWu170gUtm',
  'razorpay_payment_id'   =>  'pay_29QQoUBi66xm2f',
  'razorpay_signature'    =>  '9ef4dffbfd84f1318f6739a3ce19f9d85851857ae648f114332d8401e0949a3d'
];
Razorpay\Api\Utility::verifyPaymentSignature($params);

```ruby: Ruby
require "razorpay"
Razorpay.setup('YOUR_KEY_ID', 'YOUR_SECRET')

payment_response = {
        razorpay_order_id: 'order_9A33XWu170gUtm',
        razorpay_payment_id: 'pay_29QQoUBi66xm2f',
        razorpay_signature: '9ef4dffbfd84f1318f6739a3ce19f9d85851857ae648f114332d8401e0949a3d'
      }
Razorpay::Utility.verify_payment_signature(payment_response)

If razorpay_payment_id is returned, the payment is successfully created and verified.

Post-processing

A successful transaction results in the creation of the razorpay_order_id in your database. You can mark the corresponding transaction at your end as paid and notify the customer.

Failure

An exception is thrown in the event of unsuccessful signature verification. If the razorpay_payment_id field is missing in the API request, the following error is displayed in the corresponding response body:

Failure POST Request

error%5Bcode%5D=BAD_REQUEST_ERROR&error%5Bdescription%5D=Payment+failed