Pay2Core API Documentation

Quickstart for merchants

1. Log in to the merchant dashboard.
2. Open API & Webhooks and copy your live API key. Keep your API secret private; it is used to verify Pay2Core webhooks.
3. Submit your server IP for approval in the IP whitelist section if your account uses whitelist enforcement.
4. Configure pay-in and payout callback URLs.
5. Use the examples below from your backend server, never from browser JavaScript.

Authentication

Send your live merchant API key on every API request.

x-api-key: pk_live_your_merchant_key
Content-Type: application/json

POSTCreate payment

Creates a pay-in and returns hosted checkout URLs plus app-specific UPI deeplinks. order_id is idempotent per merchant: retrying the same order returns the existing transaction.

curl -X POST https://pay2core.com/api/payment/create \
  -H "x-api-key: pk_live_your_merchant_key" \
  -H "Content-Type: application/json" \
  -d '{
    "order_id": "ORD-10001",
    "amount": 1500.00,
    "currency": "INR",
    "customer_name": "Ramesh Kumar",
    "customer_email": "ramesh@example.com",
    "customer_phone": "9999999999",
    "description": "Order #10001",
    "callback_url": "https://merchant.example/webhooks/payin",
    "redirect_url_after": "https://merchant.example/thank-you"
  }'

{
  "txn_id": "TXN...",
  "order_id": "ORD-10001",
  "status": "PENDING",
  "amount": 1500,
  "currency": "INR",
  "redirect_url": "/api/payment/redirect/TXN...",
  "checkout_url": "/checkout.html?id=TXN...",
  "payment_links": {
    "ready": true,
    "upi_deeplink": "upi://pay?...",
    "phonepe_intent": "phonepe://pay?...",
    "gpay_intent": "tez://upi/pay?...",
    "paytm_intent": "paytmmp://pay?...",
    "qr_image_url": null,
    "expires_at": "2026-06-23T...",
    "error": null
  }
}

Hosted vs custom checkout

• Hosted checkout: redirect the customer to checkout_url.
• Custom checkout: open the correct value from payment_links for PhonePe, GPay, Paytm, or generic UPI.

GETPayment links refresh

Use this if payment_links.ready is false, if a QR/deeplink provider returns an error, or if you want to refresh UPI links for a pending transaction.

curl "https://pay2core.com/api/payment/TXN.../payment-links?retry=true" \
  -H "x-api-key: pk_live_your_merchant_key"

{
  "txn_id": "TXN...",
  "order_id": "ORD-10001",
  "status": "PENDING",
  "payment_links": { "ready": true, "upi_deeplink": "upi://pay?..." }
}

GETPayment status

curl https://pay2core.com/api/payment/status/TXN... \
  -H "x-api-key: pk_live_your_merchant_key"

{
  "txn_id": "TXN...",
  "order_id": "ORD-10001",
  "merchant_id": "m_...",
  "amount": 1500,
  "currency": "INR",
  "status": "SUCCESS",
  "completed_at": 1782220000000
}

Payment statuses: PENDING, SUCCESS, FAILED.

GETWallet balance

Returns pay-in wallet and payout wallet balances. API payouts debit the payout wallet.

curl https://pay2core.com/api/wallet/balance \
  -H "x-api-key: pk_live_your_merchant_key"

{
  "merchant_id": "m_...",
  "currency": "INR",
  "payin_wallet": {
    "balance": 150000,
    "pending_settlement": 5000,
    "pending_topup": 0,
    "pending_total": 5000,
    "available": 145000
  },
  "payout_wallet": { "balance": 80000, "available": 80000 },
  "balance": 150000,
  "payout_wallet_balance": 80000,
  "available": 145000
}

POSTCreate API payout

Sends an IMPS/bank payout from your payout wallet. Your merchant account must have API payout commission configured. total_debit = amount + payout_commission. order_id is idempotent per merchant.

curl -X POST https://pay2core.com/api/payout/create \
  -H "x-api-key: pk_live_your_merchant_key" \
  -H "Content-Type: application/json" \
  -d '{
    "order_id": "WD-10001",
    "amount": 500.00,
    "beneficiary_name": "Ramesh Kumar",
    "account_number": "123456789012",
    "ifsc": "HDFC0001234",
    "callback_url": "https://merchant.example/webhooks/payout"
  }'

{
  "payout_id": "PAYOUT...",
  "order_id": "WD-10001",
  "merchant_id": "m_...",
  "amount": 500,
  "status": "PROCESSING",
  "payout_commission": 10,
  "total_debit": 510,
  "provider_ref": "PAYOUT...",
  "utr": ""
}

GETPayout status

curl https://pay2core.com/api/payout/status/PAYOUT... \
  -H "x-api-key: pk_live_your_merchant_key"

{
  "payout_id": "PAYOUT...",
  "order_id": "WD-10001",
  "status": "SUCCESS",
  "amount": 500,
  "payout_commission": 10,
  "total_debit": 510,
  "provider_ref": "PAYOUT...",
  "utr": "123456789012"
}

Payout statuses: PROCESSING, SUCCESS, FAILED.

Webhooks from Pay2Core

Pay2Core sends webhooks to your saved callback URL or the per-request callback_url. Verify the signature against the exact raw request body using your merchant API secret.

POST https://merchant.example/webhooks/payin
Content-Type: application/json
X-Pay2Core-Signature: hex_hmac_sha256(api_secret, raw_body)
X-Pay2Core-Event: payment.pending | payment.success | payment.failed
X-Pay2Core-Delivery-Id: uuid

Payment webhook body

{
  "txn_id": "TXN...",
  "order_id": "ORD-10001",
  "merchant_id": "m_...",
  "amount": 1500,
  "currency": "INR",
  "status": "SUCCESS",
  "gateway": "Rebel Rupee",
  "gateway_ref": "...",
  "utr": "123456789012",
  "completed_at": 1782220000000
}

Payout webhook body

{
  "payout_id": "PAYOUT...",
  "order_id": "WD-10001",
  "merchant_id": "m_...",
  "amount": 500,
  "status": "SUCCESS",
  "utr": "123456789012",
  "payout_commission": 10,
  "total_debit": 510,
  "completed_at": "2026-06-23T..."
}

Node.js verification

const crypto = require("crypto");

function verifyPay2Core(rawBody, signature, apiSecret) {
  const expected = crypto
    .createHmac("sha256", apiSecret)
    .update(rawBody)
    .digest("hex");
  return expected === signature;
}

Error responses

Typical error body:

{ "detail": "message or validation details" }