Authentication & Signature Generation

Every request sent to Matrix Pay must be authenticated using HMAC-SHA256 signatures generated on your server with your Client ID and API Secret Key. The request body is canonicalized, timestamped, and signed to prevent tampering.

X-Client-Id: mp_live_xxxxxxxxxxxxxxxxxxxx
X-Timestamp: 1772889600
X-Nonce: 4f8a91b2c3d4e5f6
X-Signature: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Content-Type: application/json

Create order (v2)

POST https://matrixpay.vercel.app/api/v2/payment_gateway/create_upi_order creates an order and returns a dynamic UPI intent, QR payload, and hosted checkout URL.

POST https://matrixpay.vercel.app/api/v2/payment_gateway/create_upi_order
Content-Type: application/json
X-Client-Id: mp_live_xxxxxxxxxxxxxxxxxxxx
X-Signature: <hmac_sha256_signature>
X-Timestamp: <unix_timestamp>
X-Nonce: <random_hex>

{
  "amount": "499.00",
  "customer_name": "Ananya R",
  "customer_mobile": "9876543210",
  "customer_email": "ananya@example.com",
  "redirect_url": "https://shop.in/thanks"
}
{
  "success": true,
  "data": {
    "order_id": "MP_MUDSUC61_5228",
    "status": "Pending",
    "amount": "499.00",
    "currency": "INR",
    "payment_url": "https://matrixpay.vercel.app/pay/MP_MUDSUC61_5228"
  },
  "error": null
}

Check status (v2)

POST https://matrixpay.vercel.app/api/v2/payment_gateway/check_upi_order_status returns the live state and bank UTR of an order. Terminal states (Failed, Cancelled, Expired) return HTTP 422 with full order data.

POST https://matrixpay.vercel.app/api/v2/payment_gateway/check_upi_order_status
Content-Type: application/json
X-Client-Id: mp_live_xxxxxxxxxxxxxxxxxxxx
X-Signature: <hmac_sha256_signature>
X-Timestamp: <unix_timestamp>
X-Nonce: <random_hex>

{
  "order_id": "MP_MUDSUC61_5228"
}
{
  "success": true,
  "data": {
    "order_id": "MP_MUDSUC61_5228",
    "amount": "499.00",
    "currency": "INR",
    "status": "Pending",
    "message": "Payment pending from user.",
    "utr_number": null,
    "date_time": null,
    "created_at": "2026-09-23T16:00:00.000Z"
  },
  "error": null
}

Webhooks

Register an endpoint in your Developer dashboard. We POST a signed payload for every status change with automatic retry backoff.

POST https://your-app.com/hooks/matrixpay
X-Webhook-Signature: sha256=...
X-Webhook-Event: payment.success
X-Webhook-Id: 0f5833e7-2ffa-4d44-9774-c044b89dd636

{
  "event": "payment.success",
  "order_id": "MP_MUDSUC61_5228",
  "amount": "499.00",
  "utr_number": "428193746512"
}

Sandbox testing

With test keys the hosted checkout renders a simulated QR you can settle instantly, so you can verify redirects and webhooks end to end before going live.