WooCommerce UPI checkout with signed webhooks

Prerequisites

Decide the supported checkout surface

Steps 2–3

Register the gateway and create a payment order

Create `wp-content/plugins/vyapargateway-upi/vyapargateway-upi.php` with this complete classic-checkout gateway. The stable `client_txn_id` makes a retry for the same WooCommerce order idempotent.

<?php
/**
 * Plugin Name: VyaparGateway UPI for WooCommerce
 * Description: Redirect-based UPI checkout with signed payment callbacks.
 * Version: 1.0.0
 * Requires Plugins: woocommerce
 */

defined('ABSPATH') || exit;

add_action('before_woocommerce_init', static function (): void {
    if (class_exists(\Automattic\WooCommerce\Utilities\FeaturesUtil::class)) {
        \Automattic\WooCommerce\Utilities\FeaturesUtil::declare_compatibility(
            'custom_order_tables',
            __FILE__,
            true
        );
    }
});

add_filter('woocommerce_payment_gateways', static function (array $gateways): array {
    $gateways[] = 'WC_Gateway_VyaparGateway_UPI';
    return $gateways;
});

add_action('plugins_loaded', static function (): void {
    if (!class_exists('WC_Payment_Gateway')) {
        return;
    }

    final class WC_Gateway_VyaparGateway_UPI extends WC_Payment_Gateway
    {
        public function __construct()
        {
            $this->id = 'vyapargateway_upi';
            $this->method_title = 'VyaparGateway UPI';
            $this->method_description =
                'Creates a hosted UPI payment order and verifies payment by webhook.';
            $this->has_fields = false;
            $this->supports = ['products'];

            $this->init_form_fields();
            $this->init_settings();

            $this->title = (string) $this->get_option('title');
            $this->description = (string) $this->get_option('description');
            $this->enabled = (string) $this->get_option('enabled');

            add_action(
                'woocommerce_update_options_payment_gateways_' . $this->id,
                [$this, 'process_admin_options']
            );
        }

        public function init_form_fields(): void
        {
            $this->form_fields = [
                'enabled' => [
                    'title' => 'Enable/Disable',
                    'type' => 'checkbox',
                    'label' => 'Enable VyaparGateway UPI',
                    'default' => 'no',
                ],
                'title' => [
                    'title' => 'Checkout title',
                    'type' => 'text',
                    'default' => 'UPI',
                    'desc_tip' => true,
                ],
                'description' => [
                    'title' => 'Checkout description',
                    'type' => 'textarea',
                    'default' => 'Pay securely with a supported UPI app.',
                ],
            ];
        }

        public function process_payment($order_id): array
        {
            if (
                !defined('VG_BASE_URL') ||
                !defined('VG_API_KEY') ||
                VG_BASE_URL === '' ||
                VG_API_KEY === ''
            ) {
                wc_add_notice(
                    'UPI checkout is not configured. Please choose another method.',
                    'error'
                );
                return ['result' => 'failure'];
            }

            $order = wc_get_order($order_id);
            if (!$order instanceof WC_Order) {
                wc_add_notice('Unable to load the order.', 'error');
                return ['result' => 'failure'];
            }

            $client_txn_id = 'WC-' . $order->get_id();
            $body = [
                'client_txn_id' => $client_txn_id,
                'amount' => wc_format_decimal($order->get_total(), 2),
                'p_info' => 'WooCommerce order ' . $order->get_order_number(),
                'customer_name' => trim(
                    $order->get_billing_first_name() . ' ' .
                    $order->get_billing_last_name()
                ),
                'customer_email' => $order->get_billing_email(),
                'customer_mobile' => $order->get_billing_phone(),
                'redirect_url' => $this->get_return_url($order),
                'callback_url' => rest_url('vyapargateway/v1/webhook'),
            ];

            $response = wp_remote_post(
                untrailingslashit(VG_BASE_URL) . '/api/v1/create_order',
                [
                    'timeout' => 15,
                    'redirection' => 0,
                    'headers' => [
                        'Content-Type' => 'application/json',
                        'X-API-Key' => VG_API_KEY,
                    ],
                    'body' => wp_json_encode($body),
                ]
            );

            if (is_wp_error($response)) {
                wc_add_notice(
                    'UPI checkout is temporarily unavailable. Please retry.',
                    'error'
                );
                return ['result' => 'failure'];
            }

            $status_code = wp_remote_retrieve_response_code($response);
            $payload = json_decode(
                wp_remote_retrieve_body($response),
                true,
                512,
                JSON_THROW_ON_ERROR
            );

            if (
                $status_code < 200 ||
                $status_code >= 300 ||
                empty($payload['status']) ||
                empty($payload['data']['order_id']) ||
                empty($payload['data']['payment_url']) ||
                ($payload['data']['client_txn_id'] ?? '') !== $client_txn_id
            ) {
                wc_add_notice('The payment order was rejected.', 'error');
                return ['result' => 'failure'];
            }

            $order->update_meta_data(
                '_vg_order_id',
                sanitize_text_field($payload['data']['order_id'])
            );
            $order->update_meta_data('_vg_client_txn_id', $client_txn_id);
            $order->update_status('pending', 'Awaiting verified UPI payment.');
            $order->save();

            return [
                'result' => 'success',
                'redirect' => esc_url_raw($payload['data']['payment_url']),
            ];
        }
    }
});

Catch `JsonException` around malformed provider responses in a hardened plugin and log a redacted correlation ID through `wc_get_logger()`. Do not log the API key or full customer payload.

Test matrix

Prove the unhappy paths in staging