The Zero-Fee Payment Gateway for Developers in India: Build with VyaparGateway

When software engineers and indie hackers in India sit down to build a new SaaS, digital product, or app, they quickly run into the payment gateway wall.

If you are looking for a payment gateway for developers, traditional aggregators will bombard you with requests for Company Incorporation Certificates, GST Registration, complex board resolutions, and a mandatory 2% tax on your revenue.

At VyaparGateway, we are developers building for developers. We believe you should be able to write an API call, generate a payment intent, and receive funds directly into your bank account instantly—without the 2% fee and without the corporate bureaucracy.

Here is a technical deep dive into how VyaparGateway’s zero-fee direct UPI infrastructure works under the hood.

---

Building Developer-First Payment Infrastructure

Most payment gateways in India are built around a “Nodal Account” or “Escrow” architecture. When your user pays, the money goes to the gateway’s bank account. They hold it for T+2 days, deduct their 2% fee, and batch transfer the rest to you.

VyaparGateway utilizes a Direct-to-Bank architecture over NPCI’s UPI rails.

Your application generates a dynamic UPI Intent (a specific URI schema). When the user pays, the NPCI routes the funds directly from the user’s bank account to your merchant bank account. VyaparGateway acts purely as the software coordination layer—generating the intent and firing the webhook upon success.

---

The Anatomy of a Dynamic UPI Intent

To collect a payment, you don’t need a heavy SDK. You simply generate a standard NPCI UPI URI.

Here is the exact structure of a dynamic UPI intent string:

upi://pay?pa=merchant@bank&pn=YourAppName&am=999.00&tr=ORDER_12345&cu=INR

Parameters:

• pa (Payee Address): Your verified merchant VPA (Virtual Payment Address).
• pn (Payee Name): The display name shown in the user’s UPI app.
• am (Amount): The exact order value locked into the transaction.
• tr (Transaction Ref): Your unique, internal order ID (crucial for reconciliation).
• cu (Currency): Always INR.

On mobile browsers (React Native, Flutter, or PWA), you wrap this string in an <a> tag or a window.location.href redirect. The OS automatically prompts the user to open Google Pay, PhonePe, or Paytm.

On desktop browsers, you feed this exact string into a QR code generator library (like qrcode.react). The user scans it with their phone to pay.

---

Webhook Architecture and Idempotency

Client-side confirmation is inherently insecure. A user can forge a success callback or intercept a browser redirect.

The canonical way to verify a payment is via Server-to-Server Webhooks.

When the NPCI clears the transaction and the funds hit your bank account, VyaparGateway fires an HTTP POST request to your webhook endpoint:

{
  "event": "intent.paid",
  "data": {
    "client_reference_id": "ORDER_12345",
    "amount": 999.00,
    "status": "COMPLETED",
    "utr": "319409827361"
  }
}

Security: HMAC SHA-256 Verification

To prevent bad actors from hitting your webhook endpoint with fake success payloads, you must verify the signature. We pass the signature in the X-VyaparGateway-Signature header.

Node.js Verification Example:

const crypto = require('crypto');

app.post('/webhook/vyapargateway', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-vyapargateway-signature'];
  const secret = process.env.VG_WEBHOOK_SECRET;

  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(req.body) // Must be raw unparsed body
    .digest('hex');

  if (crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature))) {
    // Valid webhook! Parse JSON and fulfill order.
    const payload = JSON.parse(req.body);
    fulfillOrder(payload.data.client_reference_id);
    return res.status(200).send('OK');
  }

  return res.status(401).send('Invalid signature');
});

Idempotency

Network requests fail, timeout, and retry. Your webhook endpoint must be idempotent. Always check your database to see if ORDER_12345 has already been fulfilled before granting access to the product again.

---

Get Started in 5 Minutes

VyaparGateway is the fastest way for Indian developers to start accepting payments.

1. Sign up for a free merchant account.
2. Link your existing bank account.
3. Grab your API keys and Webhook secret from the Developer Dashboard.
4. Implement the intent generation and webhook listener.
5. Launch your product with 0% transaction fees.