Auto Upi API documentation

X-API-Key: aupi_live_xxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json

{
  "ok": true,
  "order_id": "ORD20260915A1B2C3",
  "slug": "9fkq2wra",
  "amount": 1499,
  "payable_amount": 1499.37,
  "status": "active",
  "payment_url": "https://autoupi.in/pay/9fkq2wra"
}

{
  "ok": true,
  "order": {
    "order_id": "ORD20260915A1B2C3",
    "slug": "9fkq2wra",
    "customer_name": "Rahul Sharma",
    "amount": 1499,
    "payable_amount": 1499.37,
    "status": "paid",
    "payer_name": "RAHUL SHARMA",
    "paid_at": "2026-09-15T10:21:44.120Z",
    "detected_at": "2026-09-15T10:21:52.480Z",
    "expires_at": "2026-09-15T10:26:00.000Z"
  }
}

POST https://yoursite.com/autoupi-webhook.php
X-AutoUpi-Signature: t=1789453200,v1=6f3c…9ab

{
  "event": "payment.paid",
  "order_id": "ORD20260915A1B2C3",
  "amount": 1499,
  "payable_amount": 1499.37,
  "status": "paid",
  "payer_name": "RAHUL SHARMA",
  "paid_at": "2026-09-15T10:21:44.120Z"
}

signed_payload = "{t}." + raw_request_body
v1 = hex(hmac_sha256(webhook_secret, signed_payload))

<script src="https://autoupi.in/checkout.js"></script>
<button id="pay">Pay now</button>
<p id="payment-status" role="status"></p>
<script>
  const payButton = document.getElementById("pay");
  const paymentStatus = document.getElementById("payment-status");
  document.getElementById("pay").onclick = async () => {
    payButton.disabled = true;
    paymentStatus.textContent = "Starting payment…";
    try {
      // Your server uses the saved cart price, not a browser-supplied amount.
      // Protect this request with your app's session and CSRF controls.
      const response = await fetch("/checkout.php", { method: "POST" });
      const order = await response.json();
      if (!response.ok || !order.ok || !order.payment_url) {
        throw new Error("Could not start payment. Please try again.");
      }
      if (!window.AutoUpi) throw new Error("Checkout could not load. Please try again.");
      AutoUpi.open({
        url: order.payment_url,
        onSuccess: (result) => {
          paymentStatus.textContent = "Confirming payment…";
          // Call YOUR server's buyer-scoped order-status endpoint here.
          // Show success only after it reads paid from Auto Upi.
          // The signed webhook can also confirm the order independently.
          payButton.disabled = false;
        },
        onFailure: (result) => {
          paymentStatus.textContent = "Payment failed or expired. Please try again.";
          payButton.disabled = false;
        },
      });
      paymentStatus.textContent = "Waiting for payment…";
    } catch (error) {
      paymentStatus.textContent = error.message || "Could not start payment.";
      payButton.disabled = false;
    }
  };
</script>

<?php
$ch = curl_init("https://autoupi.in/api/public/v1/create-order");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ["Content-Type: application/json", "X-API-Key: " . getenv("AUTOUPI_KEY")],
  // Example price only: use your server's saved cart amount in production.
  CURLOPT_POSTFIELDS => json_encode(["amount" => 100, "webhook_url" => "https://yoursite.com/autoupi-webhook.php"]),
]);
// For complete order saving and error handling, see checkout.php below.
header("Content-Type: application/json");
echo curl_exec($ch);

<?php
class AutoUpi {
  private string $key;
  private string $base;

  public function __construct(string $key, string $base = "https://autoupi.in/api/public/v1") {
    $this->key = $key;
    $this->base = $base;
  }

  private function request(string $url, ?array $body = null): array {
    $ch = curl_init($url);
    $headers = ["X-API-Key: {$this->key}"];
    if ($body !== null) {
      $headers[] = "Content-Type: application/json";
      curl_setopt($ch, CURLOPT_POST, true);
      curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body));
    }
    curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => $headers, CURLOPT_TIMEOUT => 20]);
    $res = json_decode(curl_exec($ch), true);
    curl_close($ch);
    return is_array($res) ? $res : ["ok" => false, "error" => "network_error"];
  }

  public function createOrder(float $amount, string $customer = "", string $webhook = ""): array {
    return $this->request($this->base . "/create-order", [
      "amount" => $amount,
      "customer_name" => $customer,
      "webhook_url" => $webhook,
    ]);
  }

  public function status(string $orderId): array {
    return $this->request($this->base . "/order-status?order_id=" . urlencode($orderId));
  }

  public static function verify(string $raw, string $header, string $secret): bool {
    parse_str(str_replace(",", "&", $header), $p);
    if (empty($p["t"]) || empty($p["v1"])) return false;
    return hash_equals(hash_hmac("sha256", $p["t"] . "." . $raw, $secret), $p["v1"]);
  }
}

<?php
require "autoupi.php";
// Require POST, authenticate the buyer, and validate CSRF using your app.
$api = new AutoUpi(getenv("AUTOUPI_KEY"));

$order = $api->createOrder(1499, "Rahul Sharma", "https://yoursite.com/autoupi-webhook.php");

if (empty($order["ok"])) {
  http_response_code(400);
  header("Content-Type: application/json");
  echo json_encode(["ok" => false, "error" => "Could not start payment"]);
  exit;
}

// store it so the webhook can find the buyer later
save_order($order["order_id"], $_SESSION["user_id"], $order["amount"]);

// save_order is your application's function, not an Auto Upi SDK method.
header("Content-Type: application/json");
echo json_encode(["ok" => true, "order_id" => $order["order_id"], "payment_url" => $order["payment_url"]]);
exit;

<?php
require "autoupi.php";

$raw = file_get_contents("php://input");
$sig = $_SERVER["HTTP_X_AUTOUPI_SIGNATURE"] ?? "";

if (!AutoUpi::verify($raw, $sig, getenv("AUTOUPI_WEBHOOK_SECRET"))) {
  http_response_code(401);
  exit("bad signature");
}

$event = json_decode($raw, true);
if (($event["event"] ?? "") === "payment.paid") {
  // amount = your original order value; payable_amount = what the customer actually paid
  // Look up the saved order and verify its amount before fulfilment.
  // Your mark_order_paid function must handle duplicate delivery atomically.
  mark_order_paid($event["order_id"], $event["amount"]);
}

http_response_code(200);
echo "ok";