Developer Documentation

1. Security (AES-256-ECB)

All API requests to our Gateway are secured using AES-256-ECB encryption. This ensures that sensitive data cannot be tampered with or read during transit.

How it Works

• You prepare your payload as a JSON object.
• You encrypt the JSON string using AES-256-ECB with your secret_key.
• You Base64 encode the encrypted bytes.
• You send the request as token=YOUR_TOKEN&payload=ENCRYPTED_STRING

Encryption Code (Node.js Example)

const crypto = require('crypto');
const secretKey = 'YOUR_SECRET_KEY';

function encryptPayload(jsonPayload, secret) {
    const cipher = crypto.createCipheriv('aes-256-ecb', secret, '');
    let encrypted = cipher.update(jsonPayload, 'utf8', 'base64');
    encrypted += cipher.final('base64');
    return encrypted;
}

const payloadJSON = JSON.stringify({ amount: 100, order_id: '123' });
const encryptedPayload = encryptPayload(payloadJSON, secretKey);

Complete PHP SDK Example

You can use this ready-made PHP SDK class to handle encryption and callback verification automatically in your project.

Download PHP SDK (.zip)

class GatewaySDK {
    private $apiUrl, $token, $secretKey;
    public function __construct($apiUrl, $token, $secretKey) {
        $this->apiUrl = rtrim($apiUrl, '/');
        $this->token = $token;
        $this->secretKey = $secretKey;
    }
    public function createOrderForm($amount, $userPhone, $udf1 = '') {
        $data = ['amount' => $amount, 'mobile' => $userPhone, 'udf1' => $udf1];
        $payload = base64_encode(openssl_encrypt(json_encode($data), 'aes-256-ecb', $this->secretKey, OPENSSL_RAW_DATA));
        return '<form id="payForm" action="' . $this->apiUrl . '/create_order.php" method="GET" style="display:none;">
                <input type="hidden" name="token" value="' . htmlspecialchars($this->token) . '">
                <input type="hidden" name="payload" value="' . htmlspecialchars($payload) . '"></form>
                <script>document.getElementById("payForm").submit();</script>';
    }
    public function verifyCallback($postData) {
        if (!empty($postData['payload'])) {
            $decrypted = openssl_decrypt(base64_decode(str_replace(' ', '+', $postData['payload'])), 'aes-256-ecb', $this->secretKey, OPENSSL_RAW_DATA);
            return $decrypted !== false ? json_decode($decrypted, true) : false;
        }
        return false;
    }
}

2. Create Order API (Pay-in)

This API is used to create a payment link and redirect your users to the checkout page.

Endpoint: POST https://api.paisapay.site/create_order.php

Request Parameters

Parameter	Type	Required	Description
token	string	Yes	Your unique API token
payload	string	Yes	Base64 encoded AES-256 encrypted JSON string

Payload JSON Structure (Before Encryption)

{
  "amount": "500.00",
  "mobile": "9876543210",
  "udf1": "ORD_987654321"
}

Note: Minimum order amount is 300 INR.

Form Submission Example (HTML)

<form action="https://api.paisapay.site/create_order.php" method="POST">
    <input type="hidden" name="token" value="YOUR_TOKEN">
    <input type="hidden" name="payload" value="ENCRYPTED_PAYLOAD_STRING">
    <button type="submit">Pay Now</button>
</form>

3. Create Payout API

This API is used to programmatically send money to your customers' bank accounts from your wallet balance. Unlike Pay-in, this API returns a JSON response immediately.

Endpoint: POST https://api.paisapay.site/create_payout.php

Request Parameters

Parameter	Type	Required	Description
token	string	Yes	Your unique API token
payload	string	Yes	Base64 encoded AES-256 encrypted JSON string

Payload JSON Structure (Before Encryption)

{
  "order_id": "PAYOUT_12345",
  "amount": "2500.00",
  "account_number": "01234567890",
  "ifsc_code": "SBIN0001234",
  "holder_name": "John Doe",
  "bank_name": "State Bank of India"
}

Note: Minimum payout amount is 2000.

Response Format (JSON)

When you successfully hit this API, the response will be:

{
    "status": "PENDING",
    "order_id": "PAYOUT_12345",
    "amount": 2500.00,
    "fee": 50.00,
    "total_debited": 2550.00,
    "message": "Payout request queued successfully"
}

4. Webhook Callbacks

When a payment (Pay-in) or a payout is successfully processed or failed, our system will send a POST request to your callback_url.

Callback Request Format

The webhook sends data via POST using URL-encoded form data:

Parameter	Description
token	Your API token (to identify the merchant)
payload	The AES-256-ECB encrypted JSON payload containing the callback data

Decrypted Callback JSON Format

{
  "order_id": "ORDER_1790658932859",
  "amount": 100,
  "status": "SUCCESS",
  "utr": "663820188594",
  "payment_time": "2026-09-29 10:45:54",
  "udf1": "MY_ORDER_1790658931"
}

Decryption Code (PHP Example)

<?php
$secretKey = 'YOUR_SECRET_KEY';
$payload = $_POST['payload'] ?? '';
$payload = str_replace(' ', '+', $payload); // Ensure Base64 is preserved

$decrypted = openssl_decrypt(base64_decode($payload), 'aes-256-ecb', $secretKey, OPENSSL_RAW_DATA);
$callback_data = json_decode($decrypted, true);

if ($callback_data) {
    if ($callback_data['status'] === 'SUCCESS') {
        // Update user balance in your system
    }
    echo "success"; // Important: Acknowledge the webhook
}
?>