Payment Gateway Setup

Configure Razorpay for online fee collection

Overview

OptiCRM supports two payment gateway models. Each institution chooses the option that works best for them.

Option A: Own Razorpay Account

If your institution already has a Razorpay account:

  1. Go to Institution Settings > Payments tab
  2. Under "Option A," enter:
    • Razorpay Key ID (starts with rzp_live_ or rzp_test_)
    • Razorpay Key Secret
    • Webhook Secret (optional, for webhook verification)
  3. Click Verify & Save Credentials
  4. System validates the credentials with a test API call
  5. Once verified, online payments are enabled

Money flow: Payments go directly to your institution's bank account. No middleman.

Webhook Setup

For real-time payment status updates, set up a webhook in your Razorpay Dashboard:

  1. Go to Razorpay Dashboard > Settings > Webhooks
  2. Add webhook URL: https://<your-subdomain>.opticrm.app/api/webhooks/razorpay
  3. Select events: payment.captured, payment.failed, refund.processed
  4. Copy the webhook secret and paste it in the institution settings

Option B: Platform Linked Account

If your institution doesn't have a Razorpay account:

  1. Go to Institution Settings > Payments tab
  2. Under "Option B," fill in:
    • Contact person name and email
    • Phone number
    • Legal business name
    • PAN number (mandatory)
    • GST number (optional)
    • Bank account details (IFSC, account number, beneficiary name, account type)
  3. Click Create Linked Account
  4. System creates a Razorpay Route sub-merchant account

Money flow: Parents pay via the platform's Razorpay. The payment is automatically split — your institution receives the fee amount minus a small service charge (default 2%).

Disabling Online Payments

Click Disable Online Payments in the Payments tab. This removes all gateway configuration and disables the "Pay Now" button on the portal.

Security

  • API keys are encrypted at rest using AES-256-GCM
  • Keys are never exposed to the frontend
  • Webhook signatures are verified on every callback