UPI, cash on delivery, and the gateways shops use

A customer in India already knows how they want to pay. Some will scan a QR code. Some will tap a card. Some will ask you to collect cash when the parcel arrives, and some will transfer the amount to the shop’s account and send a screenshot. Marimart puts those choices on one checkout. The store does not pick a single provider and hide the rest. Payments on this site are an adapter: Razorpay, Cashfree, and Instamojo, plus UPI, cash on delivery with a charge rule, and a bank transfer.

Card numbers are never stored. The customer types a card on the gateway’s page, or in the gateway’s checkout, and the store keeps the outcome. That split is the one to protect. A database backup of your shop should not be a file full of cards.

UPI on the order

UPI is the rail most phones already have. The National Payments Corporation of India describes the product on its UPI overview. On the store, UPI is an intent or a QR code at checkout. The customer approves the payment in their own app. The order does not become paid because the QR was shown. UPI and bank transfer stay pending until a person on the staff marks the payment received.

That pending state is easy to resent on a busy afternoon, and it is the correct one. A QR can be photographed and never paid. A transfer can be promised in chat. The packer should see a marked payment, or an explicit cash-on-delivery order, before the parcel leaves. Staff change that mark in the order. The customer sees the same status on their order page.

If you also take UPI through a gateway, the gateway’s webhook can move the order without a manual mark. The store trusts that call only after the signature check passes. A matching amount and a known event type are part of the same check. A URL that merely says “paid” is not enough. The endpoints to give the gateway are shown in admin, and the steps for each provider are in online gateways.

Gateways, without keeping the card

Razorpay, Cashfree, and Instamojo are the three hosted options. Each one wants its own merchant account, its own keys, and its own webhook. You create those accounts with the provider. Marimart does not sign you up, and it does not hold the secret after you paste it: the keys are encrypted at rest and shown masked in admin.

Razorpay’s docs cover the hosted checkout a customer sees: cards, netbanking, wallets, and UPI inside that flow. Cashfree’s payments overview is the same kind of page for their checkout. Instamojo’s docs describe their hosted payment page. Read the provider’s page when you are opening the account. Read the Marimart gateways guide when you are pasting keys into the store and pointing the webhook back at your domain.

Test in the provider’s sandbox before the domain is the one on your visiting card. A sandbox payment should create an order, fire a signed webhook, and move that order to paid. Then void or refund it inside the sandbox. Do this once per gateway you turn on. A key from the live account, pasted into a test field, is a good way to charge a real card by mistake. Keep the two sets of keys apart.

Instamojo is the secondary option. Razorpay and Cashfree are the ones most shops start with. You do not have to enable all three. Enable the one your accountant and your bank already recognise, and leave the others off so checkout stays short.

Cash on delivery

Cash on delivery is still how a lot of parcels are paid for, especially the first order from a new customer. The store can add a charge for that choice, using the rule you set. The charge should be visible before the customer confirms, on the same checkout, not as a surprise on the invoice. Cash on delivery in the knowledge base is the staff page for that rule.

COD is not a webhook. Nobody notifies your server when the courier collects the cash. The order is placed as cash on delivery, and staff record the money when it arrives at the shop, or when the courier’s statement says it has. Until then the order is honest about being unpaid. Packing can still happen. Shipping can still happen. The books should not say “paid” early.

A charge rule is also how you discourage COD on heavy or distant pin codes without banning it. Pair it with the shipping rule and the pincode check. A pincode you do not serve should fail before payment, whether the customer meant to pay by UPI or by cash.

Bank transfer

Some orders, especially larger ones, are a transfer to the account printed on the pay page. The store shows those details. It does not watch the bank. Like UPI outside a gateway, the payment stays pending until staff mark it received. Offline payments covers that flow.

Put the account name and the account number you are willing to show a customer. Do not put a card. Match the incoming amount to the order before you mark it, including paise. A transfer of the product total, with shipping forgotten, is a common partial payment. The order should stay pending until the rest arrives, or until you edit the order on purpose.

What to turn on first

Start with one gateway and one offline method. For many shops that is Razorpay or Cashfree, plus cash on delivery or a bank transfer. Add UPI intent or QR if your customers already pay you that way in the shop. Turn on a second gateway only when a real customer needs it.

Place a live order for one rupee, or the smallest amount the gateway allows, to your own address. Confirm the webhook, the pending state for a manual UPI payment, and the invoice. The tax lines on that invoice are a separate setup, described in GST invoices on a store you host. Payment and tax meet on the same order: the method, the amount, and, when you are registered, the GST split.

Then write one sentence on the pay page in plain language. Say which methods you take, how long a manual UPI mark takes on a working day, and whether cash on delivery has a fee. The checkout can show the buttons. The sentence stops the WhatsApp argument later.

The reason to keep all of this on a store you host is the same as the reason to keep the catalog there. The gateway holds the card. You hold the order, the mark a person made, and the invoice. If you change gateways next year, you change keys in admin. The old orders stay in your database, with the method they were actually paid by.