Accept Online Payments on a Website in India
To take payments on a website in India, sign up with an RBI-regulated payment aggregator such as Razorpay or Cashfree, complete their business KYC, and add their checkout to your site. Customers can then pay by UPI, cards, netbanking and wallets. Gateways charge a fee per payment plus GST, and RBI rules mean your website must never store customers' card details.
Taking payments on your own website used to mean bank paperwork and weeks of waiting. Today most Indian businesses can sign up with a payment gateway online, finish KYC, and accept UPI, cards and netbanking on their site soon after approval.
The setup is easy to get wrong in small ways that cost money later: the wrong fee plan, a checkout that loses orders, or a site that stores data it should not. This guide explains the options, the costs, the RBI rules at a high level, and the steps to go live.
How online payments work in India
When a customer pays on your site, a payment aggregator collects the money from the customer’s bank, card or UPI app and settles it to your bank account, after deducting its fee. The aggregator also provides the payment gateway, the technology that carries the payment details securely between your site, the customer and the banks.
The Reserve Bank of India regulates both. Its Guidelines on Regulation of Payment Aggregators and Payment Gateways set the rules that aggregators, and the merchants they onboard, must follow.
Payment methods your customers expect
| Method | How the customer pays | Notes |
|---|---|---|
| UPI | Scan a QR or approve a request in their UPI app | Fast for mobile buyers; no card details entered |
| Debit and credit cards | Card details plus authentication | Saved cards work through tokenisation |
| Netbanking | Log in to their bank | Common for larger amounts |
| Wallets | Pay from a prepaid wallet balance | Depends on the gateway |
| International cards | Card issued outside India | Needs approval from the gateway; usually a higher fee |
A good gateway offers all of these in one checkout, so you do not need separate integrations.
Choosing a payment gateway
Razorpay, Cashfree, PayU and others all serve Indian businesses. The differences that matter for a small business are fees, settlement time, the payment methods included, how well the plugin fits your platform, and the quality of support.
What the published fees look like
| Gateway | Standard domestic fee | Setup fee | Source |
|---|---|---|---|
| Razorpay | 2% platform fee on standard domestic methods; up to 3% on international cards | ₹0, and ₹0 annual maintenance | Razorpay pricing |
| Cashfree | From 1.95% platform fee, with 2% shown for some modes | Zero setup fee | Cashfree pricing |
Both pages say GST at 18% is charged on the gateway’s fee, not on your sale. Fees change, and higher volumes may be priced differently, so check the live page and your own agreement before you sign. Hostlyx uses Razorpay for its own Indian billing.
Questions to ask a gateway
- What is the fee for each payment method I will use, and is GST extra?
- How many days after a payment does money reach my bank?
- Is there a plugin for my platform (WooCommerce, Shopify, custom code)?
- How are refunds and chargebacks handled, and what do they cost?
- Do you support payment links and subscriptions if I need them later?
The RBI rules on card data
You do not need to be a payments lawyer, but two rules shape how any website handles cards.
Your website must not store card details
The RBI’s payment aggregator guidelines state that the merchant site “shall not save customer card and such related data”, and that aggregators must check the PCI-DSS compliance of the merchants they onboard. Its circular on card-on-file tokenisation went further: no entity in the card payment chain other than card issuers and card networks may store actual card data. For tracking and reconciliation, entities may keep only the last four digits of the card and the issuer’s name.
That deadline was originally 1 January 2022, and a later RBI circular extended it to 30 June 2022, after which stored data had to be purged.
Saved cards now use tokens
Instead of your site saving a card, the customer can consent to a token, a substitute value that works only for that card with that merchant. Tokenisation needs explicit customer consent with an additional factor of authentication, as the RBI circular sets out. In practice, the gateway does this for you through its hosted checkout.
The simplest way to stay inside these rules is to never let card numbers touch your server: use the gateway’s hosted or embedded checkout, so the customer types card details into the gateway’s form, not yours.
Setting up payments on your website
- Get your website ready. Publish clear product or service descriptions with prices, contact details, terms, privacy, and refund and cancellation policies.
- Apply to the gateway. Submit business KYC: identity, business proof, bank account and your website address.
- Integrate the checkout. Use the official plugin for WooCommerce or Shopify, or the gateway’s API for a custom site.
- Handle confirmations properly. Use the gateway’s webhooks or server-side verification to mark orders paid, rather than trusting the browser redirect alone. This stops orders being lost when a customer closes the tab after paying.
- Test in test mode. Run successful, failed and refunded payments before switching to live keys.
- Go live and reconcile. Match settlements to orders weekly, and keep GST invoices for every sale if you are registered.
Payment links for invoices
If you sell services rather than products, you may not need a full checkout at all. Most gateways let you create a payment link or send an invoice by email or WhatsApp, which the customer pays by UPI or card. That is a quick way to start collecting online while a store or booking system is being built, and the payments still show up in the same dashboard for reconciliation.
Common mistakes that cost money
- Marking orders paid from the browser redirect. If the customer’s connection drops, you get money without an order, or an order without money.
- Storing card details in your database or logs. This breaks RBI rules and creates a data breach risk.
- Leaving out refund and cancellation policies. Gateways may delay approval, and customers lose trust.
- Choosing a gateway without a plugin for your platform. A custom integration costs more to build and maintain.
- Forgetting GST on gateway fees when you budget your margins.
Payments on a store or a custom app
On WooCommerce or Shopify, payments are mostly configuration: install the gateway’s plugin, enter your keys, and test. On a custom web app or mobile app, the developer integrates the gateway’s API, verifies each payment on the server and handles refunds, subscriptions or split payments if you need them. Our e-commerce development work covers both.
Getting a store or checkout built
Hostlyx is an e-commerce website developer in Bengaluru that builds online stores and web apps with payments connected, verified on the server and tested before launch, with the gateway account in your own business name. If you want to start selling online, send us what you sell and how you want to be paid, and we will reply with a fixed written quote.