RAZORPAY — orders / webhooks / capture

Secrets stay in Secret Manager. Client checkout is provisional. Donation capture requires signed webhook + replay protection. CAPTURED never regresses.

API keys and mode

Server duties

Platform creates orders, verifies signatures, processes webhooks, posts ledger entries and issues receipts after verification.

Key secret

Configured in Secret Manager via backend only. Clients cannot view or set payment secrets.

Webhook secret

Configured in Secret Manager via backend only. Never placed in HTML, JS or localStorage.

Enabled instruments