How to Integrate PhonePe Payment Gateway in Bagisto (Step-by-Step Guide)

WebbyTroops has closed an official partnership with PhonePe. As a result, PhonePe is no longer something you need to custom-build into your Bagisto store — it now ships as a default, ready-to-use payment method across the Bagisto stores we build and support. If you're a WebbyTroops client, there's nothing to install, configure, or maintain — it's already there. Read the full announcement: WebbyTroops Partners with PhonePe to Power Bagisto Checkouts.

For everyone else evaluating PhonePe on Bagisto, this post also walks through how the integration works under the hood.

TL;DR Summary

• What changed: WebbyTroops x PhonePe partnership means PhonePe now comes enabled by default on Bagisto builds — no custom module, no separate dev cycle.
• For existing WebbyTroops clients: Reach out to your account manager to switch it on; most stores can go live within a day.
• For everyone else: We still cover the full technical architecture below — SHA256 signature validation, webhook handling, and the checkout flow — for teams that want to understand or self-host the integration.
• Core Endpoints (reference): /pg/v1/pay for initiation and /pg/v1/status/{merchantId}/{merchantTransactionId} for server-to-server transaction verification.

What is PhonePe Payment Gateway?

The PhonePe Payment Gateway is an enterprise-grade online payment aggregation solution managed by PhonePe Business. It enables web applications to accept payments across multiple channels, including the Unified Payments Interface (UPI), credit/debit cards, net banking, and digital wallets, while dynamically routing traffic across banking routes to minimize transaction drop-offs.

Why PhonePe by Default Matters for Bagisto Merchants

Historically, adding PhonePe to a Bagisto store meant commissioning a custom Laravel payment module — credentials, signature logic, webhook handling, and testing, all built and maintained in-house. Our partnership with PhonePe removes that entire step:

• Zero Custom Development: PhonePe ships as a first-class, pre-built payment option on every Bagisto store WebbyTroops delivers — not a bolt-on module you have to commission separately.
• Faster Time-to-Launch: Skip the build-and-test cycle. Enabling PhonePe is now a configuration step, not a development project.
• Maintained for You: Signature validation, webhook retries, and API version changes on PhonePe's side are handled and kept current by WebbyTroops — you're never stuck patching a bespoke integration.
• Dominant UPI Market Share: Taps directly into India's largest UPI user base, minimizing checkout friction.
• Robust Security Infrastructure: Fully compliant with PCI DSS regulations, using HTTPS webhooks and cryptographic checksums, audited as part of our standard build process.

Comparison Frameworks

PhonePe vs Razorpay vs Cashfree in Bagisto

Sandbox vs Production Environment

Hosted Checkout vs Custom Checkout

Getting PhonePe Live on Your Store

If you're a WebbyTroops client: PhonePe is already part of your Bagisto build. To activate it, you just need:

1. A verified PhonePe Business Merchant Account (we'll guide you through setup if you don't have one).
2. Your Merchant ID, Salt Key, and Salt Index, which we securely wire into your store's configuration.
3. A short go-live check — sandbox test, then a small live-value order — handled as part of our standard rollout.

No custom code, no separate development sprint, no ongoing maintenance burden on your team.

If you're evaluating this independently (not a WebbyTroops-managed store), here's how our integration is architected, for reference.

How the Integration Works Under the Hood

Understanding the transactional flow is useful whether you're auditing our implementation or debugging your own:

[Customer Checkout] ---> [Bagisto Generates Order & Payload]
                             |
                             v
                 [SHA256 Header Computed]
                             |
                             v
               [Redirected to PhonePe Page] ---> (Customer Pays)
                             |
                             +------------------------+
                             |                        |
                             v                        v
                [Async Webhook/Callback]     [User Redirect Route]
                             |                        |
                             v                        v
                 [Validate SHA256 Header]    [Verify Status API Check]
                             |                        |
                             +-----------+------------+
                                         |
                                         v
                            [Update Bagisto Invoice]

The Building Blocks

Our default PhonePe module for Bagisto is composed of a few core pieces — useful context if your team wants to understand what's running under your storefront:

• Payment Method Registration — registers phonepe as an active Bagisto payment method with its own title, description, and sort order.
• Configuration Layer — Merchant ID, Salt Key, Salt Index, callback and redirect URLs, and the sandbox/production base URL switch, all wired via environment configuration.
• Payment Driver Class — a class extending Bagisto's Webkul\Payment\Payment\Payment, responsible for pointing checkout at the correct redirect route.
• Routing Layer — dedicated routes for initiating the order (/phonepe/process), handling the user-facing redirect (/phonepe/redirect), and receiving PhonePe's asynchronous webhook (/phonepe/callback).
• Signature & API Service — isolates SHA256 signature generation, Base64 payload encoding, and calls to PhonePe's /pg/v1/pay (initiate) and /pg/v1/status/{merchantId}/{merchantTransactionId} (verify) endpoints.
• Controller Layer — orchestrates order creation, initiates payment, verifies transaction status server-side, and finalizes the Bagisto order/invoice state once payment is confirmed.

A Note on Security Design

A few principles our implementation follows — worth checking for if you're auditing any PhonePe integration:

• Never trust the browser redirect alone. The user-facing redirect route should only be used to check status, not to mark an order paid. That decision is always confirmed server-to-server via the Status API or the signed webhook.
• Always re-validate the webhook signature. Every incoming callback recomputes the SHA256 signature from the payload and salt key before trusting the content.
• Keep sensitive data out of logs. Log integration events for troubleshooting, but never log full financial payloads.
• Rate-limit callback and redirect routes to reduce exposure to automated probing.

Testing in PhonePe Sandbox

Whether it's part of your WebbyTroops rollout or a self-managed build, the same checklist applies before going live:

• Confirm environment variables point to sandbox.
• Run success and failure test cases using PhonePe's simulation instruments.
• Check storage/logs/laravel.log to confirm signature generation and API calls are behaving as expected.

Going Live in Production

1. Switch the environment flag to production.
2. Swap in your live Merchant ID, Salt Key, and Salt Index from the PhonePe Business dashboard.
3. Confirm all webhook and redirect URLs use https://.
4. Run one small live-value order (e.g., ₹1.00) to confirm end-to-end processing before opening checkout to customers.

Common Integration Errors & Solutions

Frequently Asked Questions

Does Bagisto support PhonePe natively out of the box?

As of our partnership with PhonePe, yes — for stores built and supported by WebbyTroops, PhonePe is available as a default payment method with no custom development needed. Outside of a WebbyTroops-managed store, Bagisto still requires a custom payment provider extension, which this article also explains.

Can PhonePe be integrated with Bagisto?

Yes. Bagisto's modular, Laravel-based architecture supports PhonePe either through WebbyTroops' default integration or via a custom payment provider extension built the same way we've architected ours.

How do I get my PhonePe Merchant ID and Salt Key?

You can get your credentials (MID, Salt Key, and Salt Index) from the technical integration panel inside your verified PhonePe Business Dashboard. If you're a WebbyTroops client, we'll walk you through this as part of activation.

How do PhonePe callbacks work?

When a transaction finishes, PhonePe's servers send an asynchronous server-to-server HTTP POST request to the configured callback URL. This webhook payload contains a Base64-encoded transaction block and a signature header for validation.

Is PhonePe suitable for B2B marketplaces built on Bagisto?

Yes. PhonePe supports high-volume transactions and real-time split payouts, making it well-suited for high-throughput enterprise marketplaces and multi-vendor networks — and it's available by default across our B2B Bagisto builds.

Can PhonePe accept international payments?

By default, PhonePe focuses on regional payment methods inside India — UPI, domestic credit/debit cards, and local net banking. International card acceptance requires requesting that service explicitly through your PhonePe account manager.

Final Word

Our partnership with PhonePe means Bagisto merchants no longer have to choose between "build a custom integration" and "go without a leading UPI gateway." PhonePe now comes standard. If you're already working with WebbyTroops, talk to your account manager about switching it on. If you're building or maintaining your own integration, the architecture above should give your team everything needed to do it securely.