Shopify India UPI Payment Gateway Integration: 2026 Guide

Indian Shopify merchants often want UPI intent, a desktop QR, and automatic order confirmation. The desired customer experience is simple; Shopify’s integration model is not. A theme script cannot safely become a payment gateway, and the official payments platform is restricted.

The right implementation depends on what Shopify has approved for your store and provider. This guide covers the supported paths and makes the limitations explicit.

Choose a supported Shopify path

There are three materially different options:

Path	Best for	Order experience	Core limitation
Listed third-party or additional payment provider	Merchants whose chosen provider is available for India	Native Shopify checkout handoff	Shopify and provider fees/terms apply
Approved Shopify Payments App	Payment companies accepted into Shopify’s platform	Native payment option, on-site or offsite flow	Payments platform is invitation-only
Custom manual UPI method plus merchant app	A merchant-controlled workflow where manual methods fit	Order is initially unpaid; app verifies and records payment	Not equivalent to a native payment gateway

Start in Shopify Admin → Settings → Payments and use Shopify’s region-filtered provider list. Shopify’s own payment-gateway availability guidance says this list is the primary source for what a store can activate.

Do not inject a gateway through the theme

Avoid tutorials that tell you to:

• alter checkout HTML with old checkout.liquid code;
• post API keys from Liquid or browser JavaScript;
• hide a real payment method and replace it visually;
• mark an order paid from a customer-controlled URL parameter;
• ask the customer to upload a payment screenshot as proof.

Shopify states that checkout.liquid is unsupported for the information, shipping, and payment steps. Modern checkout customisation uses extensions, but a checkout UI extension is not permission to process payments.

Manual UPI with verified reconciliation

Shopify’s manual payment documentation allows a merchant to create a custom manual payment method. A useful name is “UPI — pay after placing order”. The instructions should explain:

1. the order will remain unpaid until UPI is verified;
2. the customer will see a unique payment link or QR after placing the order;
3. fulfilment begins only after confirmation;
4. the payment window expires after a stated duration.

Shopify creates the order first. Your custom app receives an ORDERS_CREATE webhook, checks that the selected gateway is the manual UPI method, then creates a UPI payment order from its backend.

Customer places Shopify order with manual UPI
                    │
                    ▼
Shopify ORDERS_CREATE webhook
                    │ verified Shopify HMAC
                    ▼
Merchant app backend ──► UPI create-order API
                    │
                    ├── payment page: QR + intent
                    │
                    ▼
Signed UPI success webhook
                    │ verify amount + reference
                    ▼
Shopify Admin GraphQL: record/mark order paid

Verify Shopify’s webhook first

Shopify signs app webhooks. Verify the exact raw request bytes before trusting the order payload:

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyShopifyWebhook(
  rawBody: Buffer,
  receivedBase64: string,
  appClientSecret: string,
) {
  const expected = createHmac("sha256", appClientSecret)
    .update(rawBody)
    .digest();
  const received = Buffer.from(receivedBase64, "base64");

  return (
    expected.length === received.length &&
    timingSafeEqual(expected, received)
  );
}

Then create the UPI order with a stable idempotency key:

const clientTxnId = `shopify_${shopifyOrder.id}`;

const response = await fetch(
  "https://vyapargateway.com/api/v1/create_order",
  {
    method: "POST",
    headers: {
      "content-type": "application/json",
      "x-api-key": process.env.VYAPARGATEWAY_API_KEY!,
    },
    body: JSON.stringify({
      client_txn_id: clientTxnId,
      amount: Number(shopifyOrder.current_total_price),
      p_info: `Shopify ${shopifyOrder.name}`,
      customer_name: shopifyOrder.customer?.first_name,
      redirect_url: `${process.env.APP_URL}/pay/${clientTxnId}`,
      callback_url: `${process.env.APP_URL}/webhooks/vyapargateway`,
    }),
  },
);

if (!response.ok) {
  throw new Error(`UPI order creation failed: ${response.status}`);
}

Use the shop’s presentment/shop currency carefully. A direct INR UPI flow should reject non-INR orders unless your commercial and accounting model explicitly converts them.

Give the customer a stable payment surface

A manual method’s instructions are static. For a unique QR, send the customer to an app-hosted, signed URL keyed to the Shopify order. The page should retrieve only public payment-session data, never an Admin API token.

The page can display:

• Shopify order name and payable INR amount;
• dynamic UPI QR;
• “Pay with any UPI app” link on mobile;
• a two-minute expiry timer;
• a read-only status indicator;
• support and retry instructions.

The app backend must check that the signed URL maps to the correct shop and order. Do not use a sequential order number as the only access control.

Mark the Shopify order paid

After a verified provider event, fetch the Shopify order and compare:

• shop domain;
• Shopify order GraphQL ID;
• expected outstanding amount;
• currency;
• your saved UPI reference;
• current financial status.

Shopify documents the orderMarkAsPaid Admin GraphQL mutation for recording an external payment. The app requires appropriate order scope and the staff/app permission to mark orders paid.

mutation MarkOrderPaid($input: OrderMarkAsPaidInput!) {
  orderMarkAsPaid(input: $input) {
    order {
      id
      name
      displayFinancialStatus
    }
    userErrors {
      field
      message
    }
  }
}

{
  "input": {
    "id": "gid://shopify/Order/1234567890"
  }
}

Call the mutation once. Record the UPI transaction ID in your own idempotency table before or in the same durable workflow as the Shopify mutation. A webhook retry must see the existing event and return success without making a second business transition.

Depending on the order state and store plan, orderCreateManualPayment can be a better semantic fit. Shopify notes plan- and permission-specific behavior for that mutation, so choose from the live 2026-07 Admin API documentation rather than copying an old REST example.

Native payments app architecture

For a provider that wants to appear as a genuine payment option in Shopify checkout, the manual path is not the product. The provider must become an approved Payments Partner and build a payments extension.

Shopify’s payments approval documentation says the platform is invitation-only. Shopify’s requirements include:

• payments-partner and app review;
• a signed revenue-share agreement;
• mutual TLS for payment operation requests;
• restricted payment scopes;
• supported API versioning;
• idempotent payment, capture, void, and refund operations;
• retry behavior;
• merchant support and high availability;
• regulatory and security compliance.

A simplified offsite flow is:

Shopify creates payment session
         │ mTLS request
         ▼
Approved payments app
         │ creates provider payment + redirects buyer
         ▼
Hosted UPI page / app intent
         │ verified provider result
         ▼
Payments Apps GraphQL API
  paymentSessionResolve / paymentSessionReject
         │
         ▼
Shopify finalises checkout

This is payment-company infrastructure, not a weekend theme customisation. A merchant should activate an approved integration when available rather than attempting to impersonate one.

Shopify and gateway fees

Shopify’s third-party transaction fee documentation says:

• third-party transaction fees apply when a third-party provider processes an order;
• the rate depends on the Shopify plan;
• the fee is in addition to the provider’s processing fee;
• third-party transaction fees are not returned when the merchant refunds an order;
• manual payment methods are excluded from third-party transaction fees.

Do not present a universal “Shopify fee is X%” without checking the merchant’s current plan and India billing page. Calculate:

annual payment cost =
  Shopify subscription
  + Shopify third-party transaction fees, if applicable
  + provider transaction/platform fees
  + GST on taxable provider services
  + app subscription
  + operational reconciliation/support cost

For a manual method, confirm with Shopify that your intended workflow remains within its current terms. A manual method is designed for an external/manual collection workflow; it should not be marketed as a way to disguise an unapproved payment gateway.

Launch checklist

Shopify controls

• Provider is listed/approved for the store, or the method is honestly configured as manual.
• App requests only necessary Admin API scopes.
• Shopify app webhooks are HMAC-verified from raw bytes.
• Mandatory compliance webhooks are configured.
• App uninstall removes or rotates merchant credentials.
• GraphQL API version is pinned and reviewed quarterly.

Payment controls

• UPI API keys and webhook secrets exist only on the backend.
• Every Shopify order maps to one stable payment reference.
• Amount and INR currency are checked on every success event.
• Provider webhook signatures use constant-time comparison.
• Duplicate and out-of-order events are harmless.
• Old unpaid orders are reconciled and expired.

Customer experience

• Mobile intent and desktop QR are both available.
• Merchant name, amount, order, and expiry are visible.
• A failed app launch has a QR fallback.
• The customer is never told to trust a screenshot.
• Fulfilment messaging reflects Shopify’s actual financial status.

The durable Shopify UPI integration is the one that stays inside Shopify’s supported payment model. Use an approved provider for a native checkout experience. Use a clearly labelled manual method only when that workflow fits, and automate it with two independently verified webhook boundaries.