API Documentation

How the integration works

1. Your server calls Create order with the amount and customer details, signed with your API secret.
2. We return a payment_url — redirect your customer there.
3. The customer pays on our secure hosted checkout (UPI, cards, net banking).
4. We notify you via webhook (server-to-server) and you can also call Verify payment.
5. The settled amount (minus the 2% fee) appears in your dashboard balance. Request a payout anytime.

1. Authentication

Send two headers on every request. The signature proves the request came from you: it is the HMAC-SHA256 of the raw request body, using your API secret as the key.

// PHP — building the signature
//  POST: hash of the JSON body you send
$signature = hash_hmac('sha256', $requestBody, $YOUR_API_SECRET);
//  GET : hash of the empty string
$signature = hash_hmac('sha256', '', $YOUR_API_SECRET);

2. Create a payment order

POST /api/v1/create-order

// Request (PHP)
$body = json_encode([
    'amount'          => 199.00,
    'customer_email'  => 'buyer@example.com',
    'customer_phone'  => '9876543210',
    'customer_name'   => 'Rahul Sharma',
    'client_order_id' => 'INV-1001',
    'description'     => 'Premium Plan - Monthly',
]);

$ch = curl_init('https://payment.rankhostzone.in/api/v1/create-order');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $body,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'X-API-Key: ' . $YOUR_API_KEY,
        'X-Signature: ' . hash_hmac('sha256', $body, $YOUR_API_SECRET),
    ],
]);
$res = json_decode(curl_exec($ch), true);

// >> redirect the customer >>
header('Location: ' . $res['payment_url']);

// Response
{
  "status": "success",
  "order_id": "RZ20260813125433999901",
  "client_order_id": "INV-1001",
  "amount": 199.00,
  "currency": "INR",
  "payment_url": "https://payment.rankhostzone.in/checkout.php?token=8f3a9b2c...",
  "expires_at": "2026-08-13 12:55:04"
}

3. Verify a payment

GET /api/v1/verify-payment?order_id=RZ...

Same headers as above — the signature is HMAC-SHA256 of an empty string for GET requests.

// Response
{
  "status": "success",
  "data": {
    "order_id": "RZ20260813125433999901",
    "client_order_id": "INV-1001",
    "amount": 199.00,
    "fee": 3.98,
    "status": "paid",
    "payment_method": "upi",
    "paid_at": "2026-08-13 12:55:04"
  }
}

4. Check your balance

GET /api/v1/balance — signed with an empty body.

{
  "status": "success",
  "data": {
    "balance": 1250.00,
    "currency": "INR"
  }
}

5. Webhooks (recommended)

We POST to your webhook_url whenever a payment is paid or failed. Verify the signature the same way you sign requests: HMAC-SHA256 of the raw body with your API secret.

// Webhook payload
{
  "event": "payment.paid",
  "order_id": "RZ20260813125433999901",
  "client_order_id": "INV-1001",
  "amount": 199.00,
  "currency": "INR",
  "status": "paid",
  "payment_method": "upi",
  "paid_at": "2026-08-13 12:55:04",
  "timestamp": 1786614904
}

Respond with HTTP 200 within 10 seconds. If the payment succeeded, our webhook is the signal to fulfil the order. Never rely on the checkout redirect alone.

6. Error responses

7. Getting paid

Every successful payment is credited to your dashboard balance (after the 2% fee). From the Withdraw page you can request a payout to any UPI ID or Indian bank account. Payouts are processed by the RankHostZone Pay team — typically within 24 hours on working days.