Response URL

The Response URL serves as a bridge to return the payer to your platform after they have completed (or attempted) a payment. While the integration redirects the customer via a browser-level GET request, the data sent allows you to display personalized transaction summaries or statuses, such as Approved, Rejected, Under validation, or Pending payment (for cash transactions). Keep in mind, however, that the payer may close the checkout before reaching the result page.

Integration Methods

The parameter name and location for the Response URL vary depending on the integration type you are using.

Considerations

• Not for Backend Logic: Avoid relying on the Response URL to update your database or trigger orders. Users may close the browser before the redirect occurs. Always use the Confirmation URL (Webhook) for backend processes.

• Hosting Restrictions: Ensure your hosting provider does not block URLs sent as parameter values (e.g., &merchant_url=...).

• Display Recommendations: We recommend showing the customer at least the: status, reference, value, currency, and date.

• Default Behavior: If you don’t provide a Response URL (either in the request or the PayU Management Panel), the process ends at the PayU web checkout page.

Parameters Sent to the Response URL

Regardless of the integration method, PayU sends the following parameters to your URL via an HTTP GET request.

Implementation Example (PHP)

The logic is essentially the same for both integrations once the system redirects the user to your script:

<?php
$apiKey = "4Vj8eK4rloUd272L48hsrarnUA";
$merchant_id = $_GET['merchantId'];
$referenceCode = $_GET['referenceCode'];
$TX_VALUE = (float) $_GET['TX_VALUE'];
$currency = $_GET['currency'];
$transactionState = $_GET['transactionState'];

// Apply rounding for signature validation
$new_value = round($TX_VALUE, 1, PHP_ROUND_HALF_EVEN);

$signature_string = "$apiKey~$merchant_id~$referenceCode~$new_value~$currency~$transactionState";
$calculated_signature = md5($signature_string);
$received_signature = $_GET['signature'];

if (hash_equals(strtolower($received_signature), strtolower($calculated_signature))) {
    echo "<h2>Transaction Verified Successfully</h2>";
    // Display summary to user
} else {
    echo "<h2>Invalid Signature - Data Integrity Compromised</h2>";
}
?>

Sample GET Request:

The following is an example of the query string PayU appends to your Response URL. You can use this to test your script’s ability to capture variables and validate the signature.

http://mytestsite.com/response.php?merchantId=508029&transactionState=6&referenceCode=2015-05-27+13%3A04%3A37&reference_pol=7069375&transactionId=f5e668f1-7ecc-4b83-a4d1-0aaa68260862&signature=e1b0939bbdc99ea84387bee9b90e4f5c&TX_VALUE=100.00&currency=USD&buyerEmail=test%40payulatam.com&lapPaymentMethod=VISA&lapTransactionState=DECLINED&message=Declined

Signature Validation

To ensure the data received at the Response URL hasn’t been tampered with, you must regenerate the signature and compare it to the signature parameter.

Rounding Rule for Response URL

• To calculate the new_value for the signature, round TX_VALUE to one decimal place using the round half to even method:
  • If the first decimal is even and the second is 5 → round down (e.g., 150.25 becomes 150.2).
  • If the first decimal is odd and the second is 5→ round up (e.g., 150.35 becomes 150.4).
  • Otherwise, round normally to the nearest decimal.

Signature Format

Always use the values from the Response URL (merchantId, referenceCode, TX_VALUE, currency, and transactionState) to generate the signature. Do not use the values from your database.

The string to hash is:

apiKey~merchantId~referenceCode~new_value~currency~transactionState

Signature Examples

The following examples illustrate how to generate a signature, in this case, using HMAC-SHA256.

First Decimal is an Even Number and the Second is 5

First Decimal is an Odd Number and the Second is 5

Other Cases

Validate Your Signature

Use this generator to create a signature with any of the available encryption methods. This functionality assists you in verifying the signature value that PayU sends to your Response URL.