A raw upi://pay hyperlink launches a compatible UPI app; it does not automatically call a merchant URL after payment. To obtain a trustworthy result, capture a platform response when one is available, send it to your server, and verify the transaction with the acquiring PSP, gateway, or bank. A hosted UPI Payment Link is different: it can redirect to a configured callback URL, but that callback still requires signature and payment-status verification.
First identify which “UPI hyperlink” you are using
The term can describe two different products with different response mechanisms.
| Type | What it does | How a result is obtained |
|---|---|---|
| Raw UPI deep link | Opens a UPI app with payment details | Platform-specific activity or browser response, when supported, followed by server-side PSP verification |
| Gateway-hosted Payment Link | Opens the provider’s HTTPS checkout and handles the payment flow | Provider callback or redirect, plus signature validation, webhooks, and status lookup |
Do not treat the two as interchangeable. A gateway callback is an HTTPS feature defined by that provider; a raw link is an app-launch request.
What a raw UPI hyperlink contains
A typical request looks like this:
upi://pay?pa=merchant%40upi&pn=Merchant%20Name&am=100.00&cu=INR&tr=ORDER123&tn=Order%20payment| Parameter | Purpose | Implementation note |
|---|---|---|
pa |
Payee UPI ID (VPA) | Required for a payment request |
pn |
Payee or business name | Required by many standard integrations |
am |
Amount | Use appropriate decimal formatting and verify the received amount later |
cu |
Currency | Normally INR for Indian UPI |
tr |
Merchant transaction reference | Generate and persist a unique value for each payment attempt |
tn |
Transaction note | Optional and subject to app length limits |
url |
Transaction or reference URL | Not automatically a webhook or return endpoint |
Google’s UPI request documentation describes the payee, amount, currency, transaction reference, and URL fields. The presence of url does not make the browser issue a GET or POST to that address when the payment finishes.
#1 Best Overall
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
A safe way to build the link
const params = new URLSearchParams({
pa: "merchant@upi",
pn: "Example Merchant",
am: "100.00",
cu: "INR",
tr: "ORDER-20260818-8F42C1",
tn: "Order ORDER-20260818-8F42C1"
});
const upiUrl = `upi://pay?${params.toString()}`;
document.querySelector("#upi-pay").href = upiUrl;<a id="upi-pay" href="#" rel="nofollow">Pay with UPI</a>- Encode every value, including spaces and the
@in a VPA. - Do not concatenate unescaped customer input.
- Never put API keys, signing secrets, or webhook credentials in the URI.
- Create the order and reference on your server before rendering this link.
- Do not reuse one reference for unrelated payment attempts unless your PSP explicitly supports that behavior.
What response can a raw link return?
There is no universal browser callback for a plain anchor tag. The possible flow is:
- Your server creates an order and reference.
- Your page or app launches
upi://pay?...tr=REFERENCE. - The customer approves, declines, or abandons the request in a UPI app.
- The operating system or browser may return a client-side result.
- Your client sends that result to your server.
- Your server verifies the transaction with the PSP, gateway, or bank status service.
- The order is marked paid, failed, pending, or requiring reconciliation.
NPCI’s published intent guidance identifies fields such as txnId, TrtxnRef, Status, and responseCode, while also documenting cases in which PSP apps did not return control or merchants did not receive confirmation consistently. These fields should therefore be treated as guidance, not a guarantee that every current app returns the same payload. See the NPCI circular.
Response behavior by platform
Mobile web with a plain HTML link
A visible tap may open an app chooser or a selected UPI app. The browser may not regain focus, and custom schemes can be blocked, ignored, or rewritten. Desktop browsers generally cannot complete this mobile-app flow. Returning to the page is not evidence that payment succeeded.
Native Android
A provider SDK or native intent flow can return an activity result. Google’s Merchant SDK reference describes handling a returned PaymentDataResponse through the activity-result mechanism. Use the current SDK contract rather than assuming that a raw deep link has identical behavior.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Browser Payment Request API
Google documents a structured web integration in which the merchant calls show(), receives a PaymentResponse, serializes it, and posts it to the retailer server:
Rank #2
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
- DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
- CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
- PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
- BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.
try {
const paymentResponse = await paymentRequest.show();
const responsePayload = {
methodName: paymentResponse.methodName,
details: paymentResponse.details
};
const result = await fetch("/api/payments/upi/confirm", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify(responsePayload)
});
await paymentResponse.complete("success");
} catch (error) {
// Cancelled, unavailable, or failed payment UI
}This proves that the browser produced a response; it does not prove that funds reached you. Follow Google’s response-handling guidance and verify with the PSP.
iOS, WebViews, and cross-platform apps
Return behavior depends on the provider’s iOS, Flutter, React Native, or WebView integration. Embedded browsers are especially unreliable for UPI intent. Razorpay recommends native SDK handling for WebView scenarios and documents platform-specific limitations in its UPI Intent guidance. Open a supported external browser, use the provider SDK, or offer QR or collect as a fallback.
Desktop web
Provide a QR code, collect flow, or hosted checkout instead of assuming that upi://pay will open a useful desktop experience. Razorpay’s documentation states that desktop web uses a QR path rather than UPI Intent.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe server-side confirmation pattern
1. Create an order first
Persist at least:
- Internal order ID
- Unique merchant transaction reference
- Expected amount and currency
- Expected payee VPA
- Status, such as
CREATED - Creation and expiry timestamps
The reference should be unique per payment attempt, generated server-side, within the provider’s character and length limits, and mapped to the customer’s order.
2. Accept the client result as a notification
Parse the response, but do not fulfill the order from a front-end status, a query parameter, or a screenshot. A user can open a return URL directly, lose connectivity, or see an app success screen before the acquiring system has a final result.
Rank #3
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
3. Verify identity and payment details
Verify any provider signature, then match:
- Transaction reference to the stored order
- Payee VPA to your expected VPA
- Amount and currency to the order
- Provider transaction ID and UPI reference number
- Final status returned by the PSP, gateway, or bank
Google’s signature guidance requires rejecting responses without a valid signature and checking the VPA, transaction ID, amount, and status. Its transaction-status documentation includes states such as SUCCESS, FAILURE, IN_PROGRESS, PAYMENT_NOT_INITIATED, DECLINED, and EXPIRED.
4. Make fulfillment idempotent
if (order.status === "PAID") {
return { status: "PAID" };
}
const providerStatus = await psp.getPaymentStatus(reference);
if (providerStatus.status === "SUCCESS" &&
providerStatus.amount === order.expectedAmount &&
providerStatus.currency === order.currency &&
providerStatus.payeeVpa === order.expectedPayeeVpa) {
await db.orders.markPaidIfUnpaid(order.id, providerStatus);
return { status: "PAID" };
}
if (providerStatus.status === "IN_PROGRESS") {
return { status: "PENDING" };
}
return { status: "NOT_PAID" };The method names are illustrative; field names and status APIs are PSP-specific.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Using a gateway-hosted UPI Payment Link
A hosted link is often the practical choice when you need a return URL, webhooks, status lookup, and less platform-specific app handling.
Razorpay example
Razorpay’s Payment Link API accepts a callback URL and requires callback_method to be get when that URL is supplied:
{
"upi_link": true,
"amount": 10000,
"currency": "INR",
"reference_id": "ORDER-20260818-8F42C1",
"description": "Order payment",
"callback_url": "https://merchant.example/payments/return",
"callback_method": "get"
}The documented amount is in the smallest currency unit, so ₹100 is represented as 10000 paise. The callback can include razorpay_payment_id, razorpay_payment_link_id, razorpay_payment_link_reference_id, razorpay_payment_link_status, and razorpay_signature. Verify the signature and retrieve or reconcile the payment before fulfillment. See the create-link API and Payment Links API documentation.
Rank #4
- PRIVACY DISPLAY: Automatically hide your screen from those beside you. The built-in privacy display can be preset¹ to turn on when receiving notifications, typing passwords, or using specific apps
- TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist² with Galaxy AI.³ Add objects, restore details, or apply new styles by simply typing or tapping
- NIGHTS, CAPTURED CLEARLY: From gigs to city lights, record and capture moments after dark with clarity using Nightography so your photos and videos stay crisp and clear on your Samsung Galaxy
- MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile phone, whether it’s a special contact photo, custom wallpaper, an invitation or more⁴
- HELP THAT KEEPS UP: Stay in the moment while Now Nudge with Galaxy AI helps you respond faster and stay organized with smart suggestions⁵ that appear exactly when you need them on your phone
A callback is synchronous navigation by the customer’s browser. A webhook is an asynchronous server notification. Razorpay explains the distinction in its callback URL documentation; use webhooks and provider status APIs for robust backend tracking. Do not copy Checkout’s POST callback contract into a Payment Link integration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Cashfree and other providers
Cashfree documents UPI intent, collect, and QR channels, plus redirect-based actions and hosted Payment Links. Its fields and callback semantics are not interchangeable with Razorpay’s. Consult the Cashfree Pay API and Payment Links documentation for the product and account you use.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Failure handling and recovery
The app succeeds but the browser does not return
Keep the order PENDING, poll the provider status endpoint, offer a “Check payment status” action, and reconcile unresolved references periodically. NPCI’s published material acknowledges missing confirmation and failure to return control.
The customer returns without paying
Do not infer failure from visibility or focus events. Query the provider and classify the order as successful, failed, pending, declined, expired, not initiated, or unknown.
The client says success but funds are absent
Reject it unless signature, reference, payee, amount, currency, and final PSP status all match.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
- ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
- CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
- PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
- 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US
Duplicate callbacks or polling requests
Store provider transaction IDs, make the paid transition atomic, and return the existing result when a paid order is checked again. Webhooks and customer retries are commonly repeated.
Partial or incorrect amounts
Some Payment Link products support partial payments. Razorpay exposes options such as accept_partial and an amount_paid value. Compare the received amount with the order total and keep the order unpaid or partially paid according to your business rules. Also verify the actual amount received: NPCI guidance notes that amount editability can depend on the link parameters and specification.
WebView or desktop failure
Use native SDKs, an external browser, QR, collect, or a hosted checkout when intent cannot reliably return control.
Security checklist
- Use HTTPS for your site, callback, webhook, and status endpoints.
- Verify provider signatures with the documented keys and reject invalid responses.
- Keep API keys, webhook secrets, and signing keys off the client.
- Protect return endpoints against open redirects; allow only server-defined destinations.
- Do not put unnecessary personal or banking data in notes or query strings.
- Remember that URLs can appear in browser history, logs, analytics, and referrer data.
- Never treat a redirect, screenshot, or front-end “success” label as accounting proof.
Which approach should you choose?
| Requirement | Best fit |
|---|---|
| Simple mobile-web button for any available UPI app | Raw UPI link plus server status polling or gateway verification |
| Reliable server confirmation and recovery | Gateway or acquiring-PSP API with webhooks and status lookup |
| Native Android application | Provider SDK or native intent with activity-result handling |
| Structured browser response | Google Pay Payment Request API, where eligible and supported |
| Desktop customer | QR code, collect flow, or hosted checkout |
| Link shared by SMS, email, or WhatsApp | Gateway-hosted Payment Link |
| No backend or reconciliation capability | Not suitable for production payment acceptance |
| High-value or fulfillment-sensitive order | Acquirer or gateway integration with signatures, webhooks, and reconciliation |
The Bottom Line
Use a raw upi://pay link only as a launch mechanism. For production payments, create a server-side order, capture any platform response, verify the signature and transaction with your PSP or gateway, handle pending states, and fulfill only after the verified amount and payee match. If you need a dependable return URL, use a gateway Payment Link with its documented callback, webhook, and status APIs.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
