How do I accept UPI and card payments on my website in India?

The key points

• You do not need a licence yourself. The payment aggregator holds the RBI authorisation and onboards you as a merchant after due diligence.
• Use the aggregator's hosted or embedded checkout so card data never touches your server. RBI rules say merchants must not store card credentials.
• On mobile, UPI now runs on Intent and QR flows. New Razorpay merchants are told to use UPI Intent rather than the older collect request.
• Subscriptions and EMIs run on RBI's e-mandate framework, with authentication at registration and a notification before each debit.

Who actually processes the payment?

A payment aggregator. RBI's Master Direction on payment aggregators, issued on 15 September 2025, defines a PA as an entity that collects payments from customers through the merchant's interface and then settles the money to that merchant. PAs need RBI authorisation, minimum net worth, governance and security controls, and they may only collect for merchants they have a contract with.

For a business, that means you choose a provider rather than build a payment system. Razorpay, Cashfree and PayU are examples of Indian aggregators that serve small and mid-sized merchants. Stripe also operates in India, but its documentation says Indian businesses currently join by invite only, with a focus on businesses selling internationally.

The provider decides, through its own checks, whether to onboard you. RBI requires PAs to carry out merchant due diligence, which can include verifying your business address and documents, so keep your GST registration, PAN, bank details and a live website with clear terms, refund and contact pages ready before you apply.

What does the checkout integration look like?

There are three common options, and they differ mostly in how much of the checkout you control. A payment link or button needs almost no development. A hosted or embedded checkout opens the aggregator's payment screen from your site and returns the result. A custom checkout lets you design the screens while the aggregator still handles the sensitive steps.

For most business websites and online stores, the embedded checkout is the sensible default. It supports UPI, cards, netbanking and wallets in one integration, keeps card details off your server, and updates as payment rules change, so you do not have to rebuild when RBI or NPCI changes a flow.

Whatever you choose, confirm the payment on your server before you mark an order as paid. Use the aggregator's signed webhook or its payment status API, because a customer closing the browser on the success page should not decide whether an order exists.

How does UPI work on a website now?

On a phone, UPI Intent opens the customer's UPI app directly with the amount filled in, and the customer approves with their PIN. On a desktop, a QR code does the same job: the customer scans it with their phone. The older collect flow, where the customer typed a UPI ID and approved a request inside their app, is being phased out.

Razorpay's UPI documentation tells new merchants to use UPI Intent, and existing merchants not covered by exemptions to migrate to Intent or QR to keep accepting UPI. If your site was built a few years ago and still asks customers to type a UPI ID, check with your provider before payments start failing.

What rules apply to cards and saved cards?

RBI's PA Master Direction says customer card credentials must not be stored in the database or on the server the merchant accesses. Saved cards work through tokenisation: the card network or issuer holds the card, and your checkout uses a token. You get the convenience of one-click repeat payment without holding card numbers.

In practice this means the aggregator's checkout must collect card details, never a form on your own page that posts card numbers to your server. It also means a custom-built checkout still has to use the provider's secure fields or SDK. The Master Direction also says any charge other than the price, such as a convenience fee, must be shown to the customer before they pay.

How do subscriptions and recurring payments work?

Through e-mandates. RBI consolidated its rules into the Digital Payments E-mandate Framework, 2026, issued on 21 April 2026. A mandate is registered only after additional authentication, such as an OTP, and the first payment also needs it. Before each later debit, the customer's bank or card issuer must send a notification at least twenty-four hours ahead and let the customer opt out.

Recurring payments up to fifteen thousand rupees each can then run without fresh authentication, with a higher limit for insurance premiums, mutual fund subscriptions and credit card bills. Aggregators package this as subscriptions or UPI AutoPay. If your business model depends on monthly billing, such as software subscriptions or memberships, design the plan, retry and cancellation logic around these rules from day one.

Steps to start taking payments

1. 1

   Prepare the business documents

   Keep PAN, GST registration, bank account proof and business address ready, plus published terms, refund, privacy and contact pages.

2. 2

   Choose an aggregator

   Compare supported methods, settlement timing, fees, dashboard and support. Check that the provider is RBI-authorised.

3. 3

   Complete merchant onboarding

   Submit KYC and website details and wait for activation. Test in the provider's sandbox meanwhile.

4. 4

   Integrate the checkout

   Add the embedded checkout or payment links and verify every payment on the server with signed webhooks. The launch checklist covers what to test before going live.

5. 5

   Go live and reconcile

   Match settlements to orders daily for the first weeks, and set up refunds and failed-payment handling.