Guide · 28 August 2026

How to connect Cashfree to your ecommerce website

Two values, one environment switch, and one setting that will waste an hour of your life if nobody warns you about it.

The short version: get your Cashfree account activated for live payments, copy the App ID and Secret Key from Developers → API Keys with the environment set to Production, and give them to your store. If the key has an IP allowlist on it, remove that first — it is the single most common reason a perfectly valid key gets rejected.

Step 1 — Get your account activated

Signing up at cashfree.com is free, and you get sandbox keys immediately. Production keys are a separate thing: your account has to be activated for live payments, which means submitting business details and a bank account and waiting for Cashfree to approve it.

This matters because production keys exist before activation completes — you can copy them, paste them, and watch them get rejected with an error that reads like a bad key. If your dashboard is showing an activation banner, that is your answer.

While you wait, a store can still be live and taking orders on cash on delivery or WhatsApp checkout, neither of which needs a gateway. And it is worth applying to more than one gateway in parallel — they decline different people, so a rejection somewhere is not a rejection everywhere.

Step 2 — Copy the right keys from the right environment

Sign in to your Cashfree dashboard.
Open Developers → API Keys.
Switch the environment selector at the top of the page to Production. This is the step people miss — the page opens on whichever environment you last used.
Copy the App ID, then reveal and copy the Secret Key.

Sandbox and production keys are completely separate and will not work against each other's endpoints. That is deliberate on Cashfree's part, and it is a good thing: the alternative is a store quietly taking "payments" that never settle.

The IP allowlist trap. Cashfree lets you restrict a key to specific IP addresses. It sounds like good hygiene, and for a server you own it is. But a store on any hosted platform — Vercel, Netlify, Shopify, a shared host — does not have one fixed IP, so an allowlisted key can never authenticate. It fails with a message that looks like an invalid key, and you can lose an afternoon to it. Remove the allowlist, next to the key in Developers → API Keys.

Step 3 — Connect it to your store

What happens next depends on how your store was built.

If you built the site yourself

Cashfree's flow is a little unusual, and worth understanding before you start:

Create the order server-side with your App ID and Secret Key. Cashfree returns a payment_session_id.
Hand that session to Cashfree's browser SDK, which opens their hosted payment page. There is no plain URL to redirect to — this is the part that surprises people coming from other gateways.
On return, read the order back from Cashfree server-side and confirm only if it says PAID. The return URL proves nothing; Cashfree's own docs say to verify server-side.
Optionally handle the webhook, for customers who pay and never come back.

One detail that causes real money bugs: Cashfree takes amounts in rupees as a decimal, not in paise. ₹499.50 is 499.50. If you have integrated Razorpay or PhonePe before, that is the opposite of what you are used to, and copying an amount helper across will charge every customer a hundred times too much.

Two more: Cashfree requires a customer phone number on every order, so a checkout that does not collect one will fail at the gateway. And an order id has to be unique on your account forever, so a customer retrying a failed payment needs a fresh reference.

If you are on a plugin-based platform

Install the official Cashfree plugin for your platform and paste the same two values. Check which API version it targets — an unmaintained plugin pinned to an old version will keep working right up until it does not.

If you are on a builder that supports it

Paste two values, tick a box. On SitesPlaced, Cashfree lives under Settings → Payments & invoices. The keys are tested against your real Cashfree account before anything is saved — so an unactivated account or an allowlisted key fails there, with a message telling you which, rather than at a customer's checkout. The rupee-vs-paise handling, the unique reference and the server-side verification are already done.

Step 4 — Webhooks (less work than you expect)

The problem a webhook solves is the customer who pays and then closes the tab. The money moved; your store never heard. The order sits pending and you find out when they message you.

Cashfree makes this easier than most, because it accepts a notification address per order. A well-built integration sends its own with every payment, so there is nothing for you to configure. If you want a belt-and-braces second copy, register the same address in your dashboard under Developers → Webhooks for the Payment Success event.

If you are writing the handler yourself, two things matter. Cashfree signs the message with your secret key over the timestamp plus the raw request body — sign a re-serialised JSON object and the signature will never match, because parsers turn 100.00 into 100. And check the timestamp is recent, or a captured request stays replayable forever.

Step 5 — Test it properly

Rehearse in sandbox with Cashfree's published test UPI IDs and card numbers, then place one real order for the smallest amount you can and refund yourself. Check three things:

• The order shows as paid, with the Cashfree payment id recorded against it.
• The amount matches your Cashfree dashboard exactly — this is where a rupee/paise mix-up shows up.
• Close the tab on Cashfree's page right after paying, to prove the notification path works.

One more worth doing: try the checkout with an ad blocker on. Cashfree's payment page is opened by a script, and aggressive blockers occasionally stop it loading — better to know that yourself than to hear it from a customer.

The errors you are most likely to hit

Symptom	Usual cause
Keys rejected as invalid	An IP allowlist on the key, an unactivated account, or sandbox keys used against production.
Every customer charged 100× too much	Paise sent where rupees were expected. Cashfree is the opposite of Razorpay and PhonePe here.
Order creation fails on some customers	No phone number collected at checkout. Cashfree requires one.
Payment page never opens	The SDK script was blocked — an ad blocker, or a Content-Security-Policy that does not allow it.
Webhook signature never matches	Signing a parsed and re-serialised body instead of the raw request body.

If you do not have the website yet

Everything above assumes you already have an ecommerce site to connect Cashfree to. If you are still selling over Instagram DMs and WhatsApp, the gateway is the easy half — the store is the part worth getting right first.

A SitesPlaced store is free to build and publish, and Cashfree, PhonePe and Razorpay are all on the free plan with 0% commission — the gateway's own fee is the only cut anyone takes. You can import a catalogue straight from Instagram rather than typing products in one by one, publish, and connect the gateway the day your account is activated.

The step-by-step version with exact dashboard paths: connect Cashfree.

Frequently asked questions

Where do I find my Cashfree App ID and Secret Key?

Sign in to your Cashfree dashboard and open Developers, then API Keys. Switch the environment selector at the top of the page to Production for live payments, then copy the App ID and reveal the Secret Key.

Why does Cashfree keep rejecting my keys?

Three usual causes. The keys are from the Sandbox environment while your store is set to Production, or the reverse. Your account has not been activated for live payments yet. Or the key has an IP allowlist on it, which a hosted store can never satisfy because it has no fixed IP address.

Do I need to set up a Cashfree webhook?

Not necessarily. Cashfree accepts a notification address on each individual order, so a well-built integration sends its own with every payment. Registering one in your dashboard under Developers, Webhooks adds a second safety net but is not required.

Do I need to write code to accept Cashfree payments?

Only if you built the store yourself. A custom integration creates an order server-side, hands the payment session to Cashfree's browser SDK, then verifies the result server-side on return. On a store builder that supports Cashfree you paste two values and tick a box.

Can I test Cashfree before going live?

Yes. Copy the App ID and Secret Key from the Sandbox environment and set your store to test mode. Cashfree publish test UPI IDs and card numbers. Switch to production keys before you start selling, because sandbox payments never settle.

Which is better for an Indian store, Cashfree or Razorpay?

They cover the same payment methods, so the practical question is which one approved your business and on what rates. There is no cost to connecting more than one, and a spare gateway means an outage does not stop you taking orders.