Applies to: Bebaak (app.bebaak.co) — any organisation, including Bebaak itself. Last checked: 5 November 2026.
Provider menus change from time to time; if a name below differs slightly, look for the nearest match. Never e-mail or share your keys — paste them only into Bebaak.
What you get: payment links and “Pay now” buttons on invoices that collect money into your own PayU (India) account. Bebaak never holds the money and never sees card details — PayU (India) hosts the payment page. When a payment succeeds, Bebaak marks the invoice paid and records the receipt in Books. You can also check a payment's status and request a refund from Bebaak.
Before you start
- A PayU (India) account for your business (test access is enough to begin).
- In Bebaak you must be the organisation's admin.
- Keep PayU (India) in test mode until the check in step 7 passes (the Test / Live mode selector in the dashboard).
Steps
- Open the wizard in Bebaak. Settings → Integrations, choose PayU under Payments and start the wizard. The status shows “Not connected”.
- Get the keys from PayU (India). Sign in at dashboard.payu.in. Developers (or Payment Gateway → Settings) → API Keys / Key & Salt. Copy the Merchant Key and the Salt (use Salt version 1 unless PayU asks otherwise). For testing, PayU gives separate test credentials.
- Paste the keys in Bebaak (step 2 of the wizard) and leave Test mode ticked:
| Field in Bebaak | What to paste |
|---|---|
| Merchant key | Merchant Key |
| Salt | Salt |
| Webhook secret | not needed — PayU's response hash is checked with your Salt |
- Press Save. Status becomes “Keys saved — not tested”. Keys are stored encrypted and are never shown again.
- Press Test connection. Bebaak makes one real, read-only call to PayU (India). Only if it succeeds does the status become “Connected (test passed)”.
- Webhook (so payments show as paid automatically): copy the Webhook URL shown in the wizard. In PayU (India): Settings → Webhooks (or Developers → Webhooks). Add Bebaak's webhook URL for Successful payment and Failed payment.
- Test-mode check: create a small payment request in Bebaak (Banking → Payment links, or “Pay now” on a test invoice) and pay it with test details. In Test mode Bebaak uses test.payu.in with your test key and salt. PayU's documentation lists test cards and UPI handles. Within a minute the request should show Paid, and Settings → Integrations → Health & log should show the calls as OK.
Go-live checklist
- Complete PayU onboarding, get live Key and Salt, replace them in Bebaak, untick “Test mode”, and set the webhooks for live.
- Press Test connection again — it must pass in live mode.
- Make one small real payment (for example ₹1–₹10) and refund it from Bebaak to see the full cycle.
- Only then share payment links with customers.
Refunds and status
- On a paid request, Check status reads the payment from PayU (India) (it does not change anything).
- Refund (admin only) asks PayU (India) to return all or part of the amount; Bebaak refuses more than what is left unrefunded. Bebaak asks PayU to refund against the PayU payment ID (mihpayid); PayU processes it from your settlement.
- Record the refund in Books (Payments → refund) so the customer's account is right — the gateway moves the money, Books keeps the accounts.
Troubleshooting
- “Invalid hash” — Key and Salt do not belong together, or a test key is used with the live host. Copy both again from the same screen.
- Refund refused — PayU allows refunds only up to the captured amount and within its refund window.
- Anything else: Settings → Integrations → Health & log shows each call, whether it worked, the number of tries (Bebaak retries a call up to 3 times if the provider is briefly unavailable) and the provider's message. Keys are never written to the log.
Security notes
- Keys are entered only by you in Bebaak and stored encrypted; Bebaak staff cannot read them back.
- Webhooks are accepted only with a valid signature (or, for PhonePe, a valid X-VERIFY), and repeats are ignored.
- To stop using PayU (India): Settings → Integrations → PayU → Disconnect (keys are deleted; payment links stop using it).
