Developer documentation

Create a merchant account, wait for approval, connect your Gmail / UPI account, and create an API key in your dashboard.

Create an order

POST https://pay.stormxp999.com/api.php?action=create-order
Content-Type: application/json
X-Api-Key: YOUR_MERCHANT_KEY
Idempotency-Key: checkout-123

{"amount":"499.00","customer_name":"Your customer"}

The response contains data.order_id, data.checkout_url, data.upi_intent, data.amount and data.status. Open the checkout URL for your customer. API orders have a five-minute checkout window.

Verify on your backend

GET https://pay.stormxp999.com/api.php?action=verify-order&order_id=sx_...
X-Api-Key: YOUR_MERCHANT_KEY

Fulfill only when data.status is paid. Other states are pending and expired. Store INR amounts as decimal strings and use the returned amount. Never accept a screenshot or browser status as authoritative.

Webhook authentication

Configure your HTTPS receiver in the dashboard. Use your separate webhook secret to check HMAC-SHA256 over X-StormPay-Timestamp + "." + raw_body. Compare against X-StormPay-Signature with a constant-time comparison, reject timestamps older than five minutes, and durably deduplicate the event ID. Return a 2xx response only after safely processing or queuing the event.

Matching and delivery

Matching requires a Gmail-authenticated FamApp receipt. Only exact order-reference, amount and time matches auto-confirm; other receipts require merchant review. Confirmation queues payment.success. The one-minute worker delivers events with up to six attempts. A checkout’s expiry does not prevent late UPI transfers; reconcile those against the original order.

Keep your key private

Use header authentication from your backend. Do not put API keys in browser code, public repositories or URLs. Use a unique Idempotency-Key for each checkout and reuse it only when retrying an identical request.