How to connect PhonePe to your ecommerce website
Getting the right credentials, setting up the webhook nobody tells you about, and the two mistakes that account for most failed integrations.
The short version: get a PhonePe Business account approved for the Payment Gateway, copy the Client ID, Client Secret and Client Version from Developer Settings → API Keys, give them to your store, and add a webhook so payments still land when a customer closes the tab. The most common failure is pasting the old Merchant ID and Salt Key, which no longer work for new integrations.
Step 1 — Get a PhonePe Business account approved
Before any of this, you need a PhonePe Business account with the Payment Gateway product enabled. Signing up is free at business.phonepe.com. They will ask for your business details, PAN, and a bank account to settle into.
Approval is PhonePe's decision, not something a website builder can speed up, and it can take a few days. Two practical notes while you wait:
- • You do not have to sit idle. Cash on delivery and WhatsApp checkout need no gateway at all, so a store can be live and taking orders while the application is in review.
- • Apply to more than one. Gateways decline plenty of genuine small sellers, and they do not decline the same ones. Cashfree and Razorpay are worth applying to in parallel — you can connect whichever approves you, and there is no cost to having two.
Step 2 — Find your API keys (and avoid the v1 trap)
This is where most integrations die, so it is worth being precise. PhonePe has issued two different kinds of credential over the years, and they are not interchangeable.
| Old (v1) | Current (Standard Checkout v2) | |
|---|---|---|
| What you are given | Merchant ID, Salt Key, Salt Index | Client ID, Client Secret, Client Version |
| How requests are signed | An X-VERIFY checksum per request | An OAuth access token |
| Works with current integrations | No | Yes |
To get the current set:
- Sign in at business.phonepe.com with the account that should receive the money.
- Open Developer Settings in the left-hand menu.
- Go to the API Keys tab.
- Copy the Client ID, reveal and copy the Client Secret, and note the Client Version — usually just
1.
If you only have a Merchant ID and Salt Key: ask PhonePe support to move your account to Standard Checkout credentials. It is a routine request and they do it regularly — new merchants get the v2 keys by default. No amount of integration work will make the old pair authenticate against the current API.
Step 3 — Connect it to your store
What happens next depends entirely on how your store was built. There are three realistic paths.
If you built the site yourself
You are writing five pieces, and the fifth is the one people skip:
- Exchange your Client ID, Secret and Version for an OAuth access token. Cache it — it lasts a while, and minting one per payment will get you rate-limited.
- Create the payment server-side, with the amount in paise and a merchant order reference that is unique forever on your account. PhonePe returns a redirect URL.
- Send the customer to that URL.
- When they come back, call the order-status API and confirm only if it says COMPLETED. Never trust the return URL itself — the customer can edit it.
- Handle the webhook, for the customer who pays and never comes back.
Two details that cause real money bugs. Amounts are in paise, so ₹499.50 is 49950 — sending 499.5 charges someone ₹4.99. And a merchant order reference cannot be reused, so a customer whose first attempt fails cannot be sent back under the same one; you need a per-attempt reference that still maps back to the order.
If you are on a plugin-based platform
Install the PhonePe plugin for your platform, paste the same three values into its settings, and check which API version the plugin targets before you trust it. A plugin still on v1 will ask you for a Salt Key — which tells you it has not been updated for the current API.
If you are on a builder that supports it
Paste the three values, tick a box. On SitesPlaced, PhonePe lives under Settings → Payments & invoices: paste the Client ID, Secret and Version, and the credentials are checked against PhonePe before anything is saved — so a wrong key fails there rather than at a customer's checkout. The amount conversion, the unique-reference handling and the server-side status check are already done.
Step 4 — Set up the webhook (do not skip this)
Here is the scenario that costs people orders. A customer pays on PhonePe. Their phone switches from wifi to mobile data, or they hit home, or the redirect stalls. The money has moved. Your store never hears about it. The order sits pending, you do not get an email, and the customer is now messaging you asking where their thing is.
The webhook is what closes that gap. PhonePe calls your store directly, independently of the customer's browser.
- In PhonePe Business, open Developer Settings → Webhooks and click Create Webhook.
- Paste the webhook URL your store gives you.
- Choose SHA-256 as the authentication type and set a username and password.
- Subscribe to checkout.order.completed and checkout.order.failed.
A security note worth understanding: PhonePe does not sign the webhook body. It sends the SHA-256 of username:password in a header, and that is the entire authentication. So the pair must be random, not memorable — and a well-built integration will also re-check the payment with PhonePe before confirming anything, rather than believing the message on its own. On SitesPlaced both halves are generated for you and the re-check is not optional.
Step 5 — Test it properly
Place a real order on your own store for the smallest amount you can, and refund yourself afterwards from the PhonePe dashboard. Check three things, not one:
- • The order shows as paid, with the PhonePe transaction ID recorded against it.
- • The amount on the order matches the amount in your PhonePe dashboard exactly.
- • Close the tab on PhonePe's page right after paying. This is the only way to prove the webhook works, and it is the test everyone forgets.
If PhonePe gave you UAT credentials you can rehearse all of this in their test environment first. UAT credentials only work against UAT, and no real money moves — just remember to switch back to production keys before you start selling, or you will take orders that never settle.
The errors you are most likely to hit
| Symptom | Usual cause |
|---|---|
| Credentials rejected | You have the v1 Merchant ID and Salt Key, or the Client Secret was truncated on copy — it is long. |
| Works in UAT, fails in production | UAT credentials pointed at the production endpoint, or the reverse. The two are strictly separate. |
| Customer charged 100× too little | Rupees sent where paise were expected. ₹499 is 49900, not 499. |
| Duplicate order reference | A retry reusing the same merchant order id. Each attempt needs its own. |
| Orders stuck pending after real payments | No webhook configured. Everything works until a customer closes the tab. |
If you do not have the website yet
Everything above assumes you already have an ecommerce site to connect PhonePe to. If you are still at the stage of selling over Instagram DMs and WhatsApp, the gateway is the easy half — the store is the part worth getting right first.
A SitesPlaced store is free to build and publish, and PhonePe, Cashfree and Razorpay are all on the free plan with 0% commission — the gateway's own fee is the only cut anyone takes. You can import an existing catalogue from Instagram or a PDF rather than typing products in one by one, publish, and connect the gateway the day your account is approved.
The step-by-step version of the PhonePe setup, with the exact dashboard paths: connect PhonePe.
Frequently asked questions
What do I need before I can connect PhonePe?
A PhonePe Business account with the Payment Gateway product approved. Signing up is free at business.phonepe.com, and they will ask for your business details, PAN and a bank account to settle into. Approval is PhonePe's decision and can take a few days.
Where do I find my PhonePe Client ID and Client Secret?
Sign in to PhonePe Business, open Developer Settings in the left-hand menu, then the API Keys tab. Your Client ID, Client Secret and Client Version are there; the Secret is hidden until you reveal it.
I have a Merchant ID and a Salt Key. Why won't they work?
Those are PhonePe's older v1 credentials. Current integrations use Standard Checkout v2, which authenticates with a Client ID, Client Secret and Client Version instead. Ask PhonePe support to move your account to the newer keys — it is a routine request.
Do I need to write code to accept PhonePe payments?
Only if you built your store yourself. A custom integration means an OAuth token call, a create-payment call, a redirect, a status check and a webhook handler. On a store builder that supports PhonePe you paste three values and tick a box.
What is the PhonePe webhook for?
It covers the customer who pays and then closes the tab before being redirected back. Without it, that payment succeeds at PhonePe while your order sits unconfirmed. With it, PhonePe tells your store directly and the order completes anyway.
Can I test PhonePe before going live?
Yes, if PhonePe issued you UAT credentials. They only work against PhonePe's UAT environment and move no real money, so remember to switch to production keys before you start selling.
Skip the integration work entirely
Build the store free, paste three values, tick a box. PhonePe, Cashfree and Razorpay are all on the free plan with 0% commission.
















