Payu

@sam-ael/medusa-plugin-payu

Production-focused PayU India payment provider for Medusa v2 with redirect checkout flow, callback handling, and fraud-aware verification.

Highlights

• Redirect-based PayU checkout integration for Medusa payment sessions
• Hash generation and reverse-hash verification flow
• Webhook/callback handling for asynchronous payment status
• Hardened callback processing with replay protection
• Constant-time hash comparison and amount discrepancy guards
• Timeout configuration and retry-classification utilities

Install

yarn add @sam-ael/medusa-plugin-payu

Medusa Configuration

1modules: [
2  {
3    resolve: "@medusajs/medusa/payment",
4    options: {
5      providers: [
6        {
7          resolve: "@sam-ael/medusa-plugin-payu/providers/payu",
8          id: "payu",
9          options: {
10            merchantKey: process.env.PAYU_MERCHANT_KEY,
11            merchantSalt: process.env.PAYU_MERCHANT_SALT,
12            environment: process.env.PAYU_ENVIRONMENT || "test",
13          },
14        },
15      ],
16    },
17  },
18]

Environment Variables

1PAYU_MERCHANT_KEY=your_merchant_key
2PAYU_MERCHANT_SALT=your_merchant_salt
3PAYU_ENVIRONMENT=test
4
5STOREFRONT_URL=http://localhost:8000
6PAYU_REDIRECT_URL=/order/confirmed
7PAYU_REDIRECT_FAILURE_URL=/checkout
8PAYU_API_TIMEOUT_MS=30000

Callback Endpoint

Security and Reliability Notes

• Replay guard for repeated callback payloads
• Constant-time hash comparison for webhook verification
• Normalized callback parsing for structured and URL-encoded payload variants
• Amount discrepancy path for underpaid callback reports
• Timeout defaults centralized in provider config helpers

Quality Gates

1yarn typecheck
2yarn lint
3yarn test
4yarn build

Smoke tests are available under src/tests.

License

MIT