Cashfree Payments Add-on for HTML + PHP Shops
Take UPI, card and netbanking payments in the Code Craft PHP shops through Cashfree Payments
Everything included
- Cashfree PG API 2023-08-01 + JS checkout
- Order re-read from Cashfree before marking paid
- Webhook signature and timestamp checked
- Sandbox and production modes
- Offered only for orders charged in INR
- Settings and licence key in Admin → Add-ons
From order to a live website
- 1
Buy the add-on
One-time price. Your download link and licence key arrive by email and in My Account.
- 2
Drop it in
Upload the folder into addons/ on your hosting.
- 3
Switch it on
Turn it on in Admin → Add-ons, add the licence key and your settings.
What it does
Adds Cashfree Payments as a payment method to the Code Craft HTML + PHP shop templates, for shops that sell in INR. The add-on creates a Cashfree order for the exact server-calculated total and opens Cashfree's checkout. When the customer comes back, and when Cashfree's signed webhook arrives, the add-on reads the order back from Cashfree and marks it paid only if Cashfree says it is PAID for the right amount. You need your own Cashfree merchant account. The add-on follows Cashfree's PG API (version 2023-08-01) and was tested against mocked Cashfree responses, not with real payments.
- Cashfree PG API 2023-08-01 + JS checkout
- Order re-read from Cashfree before marking paid
- Webhook signature and timestamp checked
- Sandbox and production modes
Works with
This add-on is for the 12 Code Craft HTML + PHP shop templates (Kora, Annapurna, Bunkar, Giftsy, Harit, Mithas, Nazar, Petal, PhoneZone, Pukka, Pustak, WoodCraft). It is sold separately and has its own licence key. Upload its folder into the website's addons/ folder and switch it on in Admin → Add-ons; no code changes.
- Site core 1.1 or later
- Drop-in folder, no code changes
- Its own settings screen and licence key
Who it is for
It is for owners of one of the 12 Code Craft HTML + PHP shop templates (Kora, Annapurna, Bunkar, Giftsy, Harit, Mithas, Nazar, Petal, PhoneZone, Pukka, Pustak and WoodCraft) who sell in India and use, or want to use, Cashfree Payments for UPI, cards, netbanking and wallets. You need a Cashfree merchant account with PG API keys. Customers need a 10-digit Indian mobile number, and the method is offered only when the order is charged in INR. Nothing is installed with Composer.
- One of the 12 shop templates, site core 1.1+
- Your own Cashfree account
- INR orders and Indian mobile numbers
Setting it up
Upload the cashfree folder into addons/, switch on Cashfree payments in Admin → Add-ons and open its Settings. Sandbox (test) mode is ticked by default; paste the App ID and Secret key from Merchant Dashboard → Developers → API Keys, plus the add-on licence key, and change the name at checkout if you like (default: Pay online (UPI, cards, netbanking)). There is no webhook to add by hand: the notify URL is sent to Cashfree with every order. The settings screen shows it anyway, in case you also want it in the Cashfree dashboard. Keep the method ticked in Admin → Shop → Payments and untick Sandbox mode when you paste production keys.
- Sandbox mode on by default
- Notify URL sent with every order
- Secret key also checks webhook signatures
What the customer sees
When the order is placed, the add-on creates a Cashfree order (API version 2023-08-01) for the exact total with a fresh Cashfree order id and the customer's 10-digit phone, then opens Cashfree's JavaScript checkout with the payment session id; the secret key never reaches the browser. When the customer returns, the add-on re-reads the order from Cashfree and accepts only PAID for that shop order's own Cashfree order. The webhook signature (Base64 HMAC-SHA256 of timestamp and body with your secret key) must match and be under 10 minutes old, and the order is still re-read from Cashfree before it is marked paid. An unpaid order can be retried with Pay now.
- Cashfree JS checkout (v3)
- Order re-read from Cashfree on return and webhook
- Retry from the order page
Honest limits
It was tested only on local copies of the Kora and Pustak templates with real PHP 8.3 and every Cashfree call answered by a mock server (47 checks per shop with the other gateways): the order with amount, INR and phone, the pay page without the secret, a return while ACTIVE not paid, another Cashfree order id refused, a tampered webhook refused and a signed one accepted. It has not processed real money. Refunds, payouts and disputes are handled in your Cashfree dashboard. cashfree.js is loaded from sdk.cashfree.com and cannot be pinned with an integrity hash.
- Mocked responses only
- INR only
- Refunds are made in Cashfree
More ready-made websites
Built by the same team, with the same setup service and support.
Browse every ready-made website, or compare our custom website packages if you need a site designed from scratch. Want more guests to find you on Google Maps? See our local SEO service, or talk to our web design team.
