Integrating an online payment gateway is a common requirement for Laravel applications. Whether you are building an e-commerce website, booking platform, subscription system, or digital product store, you need a reliable and secure way to accept payments.

Razorpay is a popular payment gateway that supports multiple payment methods, including:

• UPI
• Credit cards
• Debit cards
• Net banking
• Wallets
• Other supported payment methods

In this guide, you will learn how to integrate Razorpay with Laravel, create Razorpay orders, open the Razorpay Checkout page, verify payment signatures securely, store payment details, and handle payment failures.

---

How Does Razorpay Integration Work in Laravel?

A typical Razorpay payment flow looks like this:

Customer
   ↓
Clicks Pay Now
   ↓
Laravel Creates Razorpay Order
   ↓
Razorpay Checkout Opens
   ↓
Customer Completes Payment
   ↓
Payment Details Return to Laravel
   ↓
Laravel Verifies Payment Signature
   ↓
Payment Status Updated

The most important part of this process is server-side payment verification.

You should never mark an order as paid simply because the frontend reports a successful payment. Your Laravel backend must verify the payment data using your Razorpay secret.

---

Prerequisites

Before integrating Razorpay with Laravel, you need:

• A Laravel application
• A Razorpay account
• Razorpay Key ID
• Razorpay Key Secret
• Composer installed

For development and testing, start with Razorpay Test Mode credentials.

After testing your complete payment flow, you can switch to live credentials for production.

---

Step 1: Install the Razorpay PHP SDK

Open your Laravel project and install the Razorpay PHP SDK:

composer require razorpay/razorpay

This package allows your Laravel backend to communicate with the Razorpay API.

---

Step 2: Add Razorpay Keys to the .env File

Add your Razorpay credentials to your .env file:

RAZORPAY_KEY=your_razorpay_key_id
RAZORPAY_SECRET=your_razorpay_key_secret

Never hardcode your Razorpay secret directly inside a controller.

Avoid this:

$secret = 'your-secret-key';

Instead, keep sensitive credentials in environment variables.

This makes your application easier to configure across development, staging, and production environments.

Important: Never expose your RAZORPAY_SECRET key in frontend JavaScript or commit it to a public Git repository.

---

Step 3: Add Razorpay Configuration

Open:

config/services.php

Add Razorpay configuration:

'razorpay' => [
    'key' => env('RAZORPAY_KEY'),
    'secret' => env('RAZORPAY_SECRET'),
],

Now you can access your Razorpay configuration using:

config('services.razorpay.key');

and:

config('services.razorpay.secret');

If configuration caching is enabled, run:

php artisan config:clear

Or, in production:

php artisan config:cache

---

Step 4: Create a Payments Table

It is a good practice to store payment information in your database.

Create a migration:

php artisan make:migration create_payments_table

A simple migration can look like this:

Schema::create('payments', function (Blueprint $table) {
    $table->id();

    $table->string('order_id')->unique();

    $table->string('razorpay_order_id')
        ->nullable();

    $table->string('razorpay_payment_id')
        ->nullable();

    $table->decimal('amount', 10, 2);

    $table->string('currency')
        ->default('INR');

    $table->string('status')
        ->default('pending');

    $table->timestamps();
});

Then run:

php artisan migrate

Your payment table will store information such as:

• Your application’s order ID
• Razorpay order ID
• Razorpay payment ID
• Payment amount
• Currency
• Payment status

---

Step 5: Create the Payment Model

Create a model:

php artisan make:model Payment

Then define the fillable fields.

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;

class Payment extends Model
{
    protected $fillable = [
        'order_id',
        'razorpay_order_id',
        'razorpay_payment_id',
        'amount',
        'currency',
        'status',
    ];
}

---

Step 6: Create a Payment Controller

Create a controller:

php artisan make:controller PaymentController

Import the required classes:

<?php

namespace App\Http\Controllers;

use App\Models\Payment;
use Illuminate\Http\Request;
use Razorpay\Api\Api;
use Illuminate\Support\Str;

---

Step 7: Create a Razorpay Order

Before opening Razorpay Checkout, your Laravel backend should create an order.

Create a method inside your controller:

public function createOrder(Request $request)
{
    $request->validate([
        'amount' => 'required|numeric|min:1',
    ]);

    $amount = $request->amount;

    $api = new Api(
        config('services.razorpay.key'),
        config('services.razorpay.secret')
    );

    $receiptId = (string) Str::uuid();

    $razorpayOrder = $api->order->create([
        'receipt' => $receiptId,
        'amount' => $amount * 100,
        'currency' => 'INR',
    ]);

    $payment = Payment::create([
        'order_id' => $receiptId,
        'razorpay_order_id' => $razorpayOrder['id'],
        'amount' => $amount,
        'currency' => 'INR',
        'status' => 'pending',
    ]);

    return response()->json([
        'key' => config('services.razorpay.key'),
        'order_id' => $razorpayOrder['id'],
        'amount' => $amount * 100,
        'currency' => 'INR',
        'payment_id' => $payment->id,
    ]);
}

---

Why Do We Multiply the Amount by 100?

Razorpay expects the amount in the smallest currency unit.

For Indian Rupees:

₹1 = 100 paise

So:

1000 * 100

becomes:

100000 paise

which represents:

₹1000

Forgetting to convert the amount is a common mistake during Razorpay integration.

---

Step 8: Add Payment Routes

Add routes in:

routes/web.php

use App\Http\Controllers\PaymentController;
use Illuminate\Support\Facades\Route;

Route::get('/payment', function () {
    return view('payment');
});

Route::post(
    '/create-order',
    [PaymentController::class, 'createOrder']
)->name('payment.create');

Route::post(
    '/verify-payment',
    [PaymentController::class, 'verifyPayment']
)->name('payment.verify');

---

Step 9: Create the Razorpay Payment Page

Create a Blade file:

resources/views/payment.blade.php

Add a simple payment button:

<!DOCTYPE html>
<html>
<head>
    <title>Laravel Razorpay Payment</title>
</head>
<body>

    <h1>Make Payment</h1>

    <button id="pay-button">
        Pay ₹1000
    </button>

    <script src="https://checkout.razorpay.com/v1/checkout.js"></script>

    <script>
        document
            .getElementById('pay-button')
            .addEventListener('click', payNow);

        async function payNow() {
            // Payment logic
        }
    </script>

</body>
</html>

---

Step 10: Create the Order From JavaScript

When the customer clicks the payment button, send a request to Laravel.

async function payNow() {

    const response = await fetch('/create-order', {
        method: 'POST',

        headers: {
            'Content-Type': 'application/json',

            'X-CSRF-TOKEN':
                document.querySelector(
                    'meta[name="csrf-token"]'
                ).content
        },

        body: JSON.stringify({
            amount: 1000
        })
    });

    const data = await response.json();

    openRazorpayCheckout(data);
}

Make sure your page contains the CSRF token:

<meta
    name="csrf-token"
    content="{{ csrf_token() }}"
>

---

Step 11: Open Razorpay Checkout

Create the openRazorpayCheckout() function:

function openRazorpayCheckout(data) {

    const options = {

        key: data.key,

        amount: data.amount,

        currency: data.currency,

        name: 'My Laravel Store',

        description: 'Order Payment',

        order_id: data.order_id,

        handler: function (response) {

            verifyPayment(
                response,
                data.payment_id
            );
        },

        theme: {
            color: '#3399cc'
        }
    };

    const razorpay = new Razorpay(options);

    razorpay.open();
}

After the customer completes the payment, Razorpay returns payment information to the handler function.

The response contains values such as:

razorpay_payment_id
razorpay_order_id
razorpay_signature

These values must be verified on your Laravel backend.

---

Step 12: Verify the Razorpay Payment Signature

This is one of the most important steps.

Create the verifyPayment() method:

public function verifyPayment(Request $request)
{
    $request->validate([
        'razorpay_payment_id' => 'required',
        'razorpay_order_id' => 'required',
        'razorpay_signature' => 'required',
        'payment_id' => 'required|exists:payments,id',
    ]);

    $api = new Api(
        config('services.razorpay.key'),
        config('services.razorpay.secret')
    );

    try {

        $api->utility->verifyPaymentSignature([
            'razorpay_order_id' =>
                $request->razorpay_order_id,

            'razorpay_payment_id' =>
                $request->razorpay_payment_id,

            'razorpay_signature' =>
                $request->razorpay_signature,
        ]);

        $payment = Payment::findOrFail(
            $request->payment_id
        );

        $payment->update([
            'razorpay_payment_id' =>
                $request->razorpay_payment_id,

            'status' => 'paid',
        ]);

        return response()->json([
            'success' => true,
            'message' =>
                'Payment verified successfully.',
        ]);

    } catch (\Exception $exception) {

        return response()->json([
            'success' => false,
            'message' =>
                'Payment verification failed.',
        ], 400);
    }
}

---

Step 13: Send Payment Details for Verification

After Razorpay Checkout reports success, send the payment details to your Laravel backend.

async function verifyPayment(
    response,
    paymentId
) {

    const verifyResponse = await fetch(
        '/verify-payment',
        {
            method: 'POST',

            headers: {
                'Content-Type':
                    'application/json',

                'X-CSRF-TOKEN':
                    document.querySelector(
                        'meta[name="csrf-token"]'
                    ).content
            },

            body: JSON.stringify({
                razorpay_payment_id:
                    response.razorpay_payment_id,

                razorpay_order_id:
                    response.razorpay_order_id,

                razorpay_signature:
                    response.razorpay_signature,

                payment_id:
                    paymentId
            })
        }
    );

    const result =
        await verifyResponse.json();

    if (result.success) {

        alert('Payment successful');

    } else {

        alert(
            'Payment verification failed'
        );
    }
}

The complete payment process now becomes:

User Clicks Pay
      ↓
Laravel Creates Order
      ↓
Razorpay Checkout Opens
      ↓
User Completes Payment
      ↓
Frontend Receives Payment Response
      ↓
Send Response to Laravel
      ↓
Laravel Verifies Signature
      ↓
Mark Payment as Paid

---

Why Is Payment Signature Verification Important?

Without server-side verification, someone could potentially manipulate the frontend request and falsely report a payment as successful.

For example, a malicious user could try sending a request containing:

status = paid

Your application should not trust this information.

Instead, your Laravel backend verifies the cryptographic payment signature using the Razorpay secret.

The basic idea is:

Razorpay Payment Data
        +
Razorpay Secret
        ↓
Signature Verification
        ↓
Valid Payment

Only after successful verification should your application mark the payment as completed.

---

Handling Payment Failures

Not every payment will be successful.

A payment can fail because of:

• Insufficient balance
• Bank errors
• UPI failure
• Card rejection
• Network problems
• User cancellation

You can handle Checkout failures on the frontend.

razorpay.on(
    'payment.failed',
    function (response) {

        console.log(
            response.error
        );

        alert(
            response.error.description
        );
    }
);

You should also keep the payment status as:

pending

until successful server-side verification is completed.

---

Using Razorpay Webhooks With Laravel

Frontend callbacks are useful, but webhooks provide an additional server-to-server notification mechanism.

A webhook flow looks like this:

Customer Pays
      ↓
Razorpay Processes Payment
      ↓
Razorpay Sends Webhook
      ↓
Laravel Webhook Endpoint
      ↓
Verify Webhook Signature
      ↓
Update Payment Status

Create a webhook route:

Route::post(
    '/razorpay/webhook',
    [PaymentController::class, 'webhook']
);

Your webhook controller should verify the webhook signature before trusting the payload.

A simplified example:

public function webhook(Request $request)
{
    $signature =
        $request->header(
            'X-Razorpay-Signature'
        );

    $payload = $request->getContent();

    $secret = config(
        'services.razorpay.webhook_secret'
    );

    $expectedSignature = hash_hmac(
        'sha256',
        $payload,
        $secret
    );

    if (
        ! hash_equals(
            $expectedSignature,
            $signature
        )
    ) {
        return response(
            'Invalid signature',
            400
        );
    }

    // Handle webhook event

    return response()->json([
        'success' => true,
    ]);
}

Store your webhook secret separately:

RAZORPAY_WEBHOOK_SECRET=your_webhook_secret

And add it to:

'razorpay' => [
    'key' => env('RAZORPAY_KEY'),

    'secret' => env('RAZORPAY_SECRET'),

    'webhook_secret' =>
        env('RAZORPAY_WEBHOOK_SECRET'),
],

Webhooks should be treated as server-side events and their signatures must always be verified.

---

Important Security Best Practices

1. Never Expose Your Razorpay Secret

Your frontend should only receive the public Razorpay Key ID.

Never expose:

RAZORPAY_SECRET

in:

• JavaScript
• Blade source
• Mobile applications
• Public repositories

---

2. Always Verify Payments on the Backend

Do not trust the frontend success callback alone.

Always verify:

razorpay_order_id
razorpay_payment_id
razorpay_signature

before marking a payment as successful.

---

3. Create Orders on the Server

Do not create Razorpay orders directly from frontend code.

The Laravel backend should create the order because it has access to the Razorpay secret.

---

4. Never Trust the Amount From the Frontend

This is extremely important.

A user could modify:

amount: 1000

to:

amount: 1

For a real application, the server should calculate the amount.

For example:

$order = Order::findOrFail(
    $request->order_id
);

$amount = $order->total;

Then use the amount stored on your server:

$razorpayOrder = $api->order->create([
    'receipt' => $order->order_number,

    'amount' => $amount * 100,

    'currency' => 'INR',
]);

This is much safer than accepting the final payment amount directly from the client.

---

5. Use Unique Order References

Each payment should have a unique internal reference.

You can generate one using:

Str::uuid();

or use your application’s existing order number.

---

6. Handle Duplicate Requests

Network retries can sometimes cause requests to be sent more than once.

Your payment processing logic should be designed to avoid duplicate payment records or duplicate order processing.

For example, check whether the payment has already been processed before performing important business actions.

if ($payment->status === 'paid') {
    return response()->json([
        'message' =>
            'Payment already processed.',
    ]);
}

---

A Better Production Payment Flow

For a real e-commerce application, the flow should usually be:

User Creates Order
      ↓
Laravel Calculates Total
      ↓
Laravel Saves Order as Pending
      ↓
Laravel Creates Razorpay Order
      ↓
Razorpay Checkout Opens
      ↓
User Pays
      ↓
Laravel Verifies Signature
      ↓
Payment Marked as Paid
      ↓
Order Marked as Confirmed
      ↓
Webhook Provides Additional Confirmation

This approach keeps your payment and order logic controlled by the backend.

---

Common Razorpay Integration Errors in Laravel

Invalid API Key

Check your .env values:

RAZORPAY_KEY=your_key
RAZORPAY_SECRET=your_secret

Also ensure that you are not mixing Test Mode and Live Mode credentials.

---

CSRF Token Mismatch

For web routes, ensure that your request sends the Laravel CSRF token.

<meta
    name="csrf-token"
    content="{{ csrf_token() }}"
>

Then include it in your request headers.

---

Payment Is Successful but Status Is Still Pending

This usually means the backend verification request failed or was never completed.

Check:

• Browser network requests
• Laravel logs
• Payment signature verification
• Route configuration

Do not automatically mark the payment as successful without verification.

---

Incorrect Amount

Remember that Razorpay expects the amount in the smallest currency unit.

For example:

₹500 = 50000 paise

So:

'amount' => 500 * 100

---

Signature Verification Failed

Check that:

• The correct Razorpay secret is being used.
• The razorpay_order_id matches the order created on your backend.
• The payment ID and signature are passed without modification.
• Test and Live Mode credentials are not mixed.

---

Frequently Asked Questions

How do I integrate Razorpay with Laravel?

Install the Razorpay PHP SDK, add your API credentials to Laravel, create a Razorpay order on the backend, open Razorpay Checkout on the frontend, and verify the payment signature on the backend.

---

Can I use Razorpay Test Mode in Laravel?

Yes. You should test your complete payment flow using Test Mode credentials before moving to live payments.

---

Should I verify Razorpay payments in Laravel?

Yes. Always verify the Razorpay payment signature on the Laravel backend before marking an order as paid.

---

Can I store Razorpay payment details in MySQL?

Yes. You can store values such as:

• Razorpay order ID
• Razorpay payment ID
• Amount
• Currency
• Payment status

This helps with order tracking and payment management.

---

Why should I create the Razorpay order from Laravel?

Creating the order on the Laravel backend keeps your Razorpay secret secure and allows your server to control the actual payment amount.

---

Should I use Razorpay webhooks?

Webhooks are highly useful for receiving server-to-server payment events. You should verify the webhook signature before processing any webhook payload.

---

Conclusion

Integrating Razorpay with Laravel is straightforward when the payment flow is implemented correctly.

The basic process is:

Create Order
    ↓
Open Razorpay Checkout
    ↓
Receive Payment Response
    ↓
Verify Signature on Laravel Backend
    ↓
Update Payment Status

The most important security rule is simple:

Never trust the frontend alone to confirm a payment.

Always create payment orders securely on your Laravel backend, calculate the actual amount on the server, verify Razorpay payment signatures, protect your secret credentials, and handle duplicate or failed payment events carefully.

By following these Laravel Razorpay integration best practices, you can build a more secure and reliable payment system for your e-commerce application, booking platform, or any Laravel project that needs to accept online payments.