Gravity Forms Paytm Premium Add-on Setup Guide

The Gravity Forms Paytm Premium Add-on lets your Gravity Forms take payments in Indian rupees through the Paytm Payment Gateway. When a form is submitted, the add-on starts a Paytm transaction for the exact total and sends the customer to the Paytm payment page, where they pay by UPI, card, net banking or Paytm wallet. When Paytm sends the result back, the add-on checks its checksum with your merchant key and then reads the transaction back from Paytm before it marks the entry as paid. Refunds, full or partial, are made from the entry screen. This guide covers every setting, the feed, what happens during a payment, refunds, testing in the Paytm staging environment and going live.

How a payment works

1. The customer fills in the form. Gravity Forms works out the total; the add-on checks that it is a rupee amount with at most two decimals and at least 1.00 INR.
2. The entry is saved with the status Processing. On your server, the add-on starts a Paytm transaction (Initiate Transaction): the total as a rupee amount with two decimals, a unique order ID, your website name, a signed callback link, a customer id and, when you map them, the customer’s mobile number and email. The request is signed with your merchant key.
3. Paytm answers with a transaction token, which the add-on stores encrypted. If Paytm refuses the request, the customer is told that nothing was charged and the entry is marked Failed with Paytm’s answer in a note.
4. The customer goes to a short page of your site that posts the order to the Paytm payment page. There they pay by UPI (an app, a QR code or a UPI ID), by card, by net banking or with their Paytm wallet. Payment details are entered on Paytm and never reach your website.
5. Paytm posts the result back to the callback link with a checksum. The add-on checks the checksum with your merchant key, the order ID and the MID; a result that fails the check changes nothing.
6. Then, always, the add-on asks Paytm for the transaction status (Transaction Status API) and updates the entry from that answer: Paid, Failed or Cancelled. The Payment Status webhook, the five-minute status check and Refresh status on the entry use the same read-back.

Install and activate

1. In WordPress go to Plugins → Add New → Upload Plugin, upload the zip and activate it.
2. Open Forms → Settings → Paytm, enter your GravityExtra license key and activate it. The settings below appear once the license is active.
3. Open Forms → Settings and choose Indian Rupee as the currency. It is in the list once the add-on is active.

Settings

Open Forms → Settings → Paytm. Both modes have their own MID, merchant key and website name; only those of the mode you choose are used for new transactions. An entry always keeps the mode it was created in, so a transaction started in Test mode is still read from the staging environment after you switch to Live.

Getting your keys

1. Sign in to the Paytm dashboard and open Developer Settings → API Keys.
2. In test mode, copy the staging MID and merchant key into the Test fields; the website name is usually WEBSTAGING. Save: the connection line turns green when Paytm accepts them.
3. When Paytm has activated your account for production, copy the production MID and merchant key into the Live fields; the website name is usually DEFAULT.

Setting up the webhooks

1. Copy the webhook address shown on the settings page. It is your site address with ?callback=gfpaytm.
2. In the Paytm dashboard, open Developer Settings → Webhooks and enter this address as the Payment Status URL and as the Refund notification URL. Paytm sends webhooks to https addresses on port 443.
3. Nothing else to enter: Paytm signs every webhook with your merchant key, and the add-on checks that signature before it reads anything. A webhook with a wrong or missing signature is refused.

The feed

Open your form, go to Settings → Paytm and add a feed. Choose Products and Services or Donations and the payment amount (usually the form total). Then map the customer fields: the mobile number and the email are sent with the transaction so Paytm can show them on the payment page (an Indian mobile number typed as +91 98765 43210, 098765 43210 or 9876543210 is sent as ten digits; other numbers are left out).

• Payment comment: sent with the Paytm transaction and shown in your Paytm dashboard, up to 60 characters. Merge tags work; the default is the form title and the entry number.
• Notifications: tick Send form notifications only after the customer has paid to hold the usual form notifications until the payment is confirmed. They are sent once, when the entry becomes Paid.
• Payment events: in the form notifications you can also choose Payment Completed, Payment Failed or Cancelled and Payment Refunded as the event.

The form and the Paytm page

Use Gravity Forms product, quantity, option and total fields as usual. The amount sent to Paytm is the total Gravity Forms calculated on your server, so a total changed in the browser cannot lower the price. The submit button can say Continue to payment, because the customer goes to the Paytm page next.

When the customer comes back, they see your normal confirmation if the payment is complete. If Paytm has not confirmed it yet (a UPI payment can take a few seconds), a short waiting message checks again by itself every few seconds. If the payment failed or was not completed, the customer is told that nothing was charged and can return to the form. The link to the Paytm page works for 14 minutes, because the Paytm transaction token lives 15 minutes.

Payment statuses

The entry screen

Every Paytm entry has a Paytm box on the right with the status, the amount, the order ID, the MID, the payment mode, the Paytm transaction id, the bank reference, Paytm’s result if the payment failed, and the refunded total and any refund still in progress. Test payments carry a Test badge.

• Refresh status reads the transaction and any pending refund from Paytm again and applies them.
• Refund with Paytm sends a full or partial refund to the customer. Type the amount in rupees (the field starts with the amount left) and confirm.

Refunds

Before a refund is sent, the add-on reads the transaction from Paytm and checks that it is successful for the entry amount with the same Paytm transaction id, and that the refund fits what is left after earlier and pending refunds (from 1.00 INR). Each refund form can be used once, so a double click or a reloaded page cannot refund twice. Paytm processes refunds with the bank in the background: the amount is reserved at once, and the refund is recorded on the entry as a transaction with a note when Paytm reports it successful (by the signed refund webhook, the status check or Refresh status). If Paytm refuses or fails the refund, the amount is free again. When the whole amount has been refunded the entry becomes Refunded. Refunds you make in the Paytm dashboard are recorded too, when Paytm sends the signed refund webhook.

Testing in the staging environment

1. Leave the mode on Test and save your staging MID and merchant key.
2. Open the form on your site, fill it in and continue to payment.
3. On the Paytm page, pay with the test wallet, cards, net banking or UPI flows listed in the Paytm test credentials documentation. The failure flows let you check the other paths.
4. Back on your site, check the confirmation, then the entry: it should be Paid with the Test badge, and the held notifications should have been sent.
5. Try a partial refund from the entry screen and watch it move from in progress to completed.
6. Start another payment and leave the Paytm page without paying: the entry ends as Cancelled once Paytm reports it, or 30 minutes after the start when Paytm has no record of a payment.

Going live

1. Complete the Paytm onboarding so Paytm activates your account for production payments.
2. Copy the production MID and merchant key into the Live fields (website name DEFAULT unless Paytm gave you another one), and set the production webhooks to the same address.
3. Switch the mode to Live and save. The connection line should say Connected to Paytm (Live, production).
4. Make one small real payment, check the entry and refund it from the entry screen.

For developers

• gravityextra_paytm_txn_fields filters the transaction before it is sent: it may limit the payment modes (enablePaymentMode, disablePaymentMode), set extendInfo.udf3 or the comment. The amount, the currency, the order ID, the MID, the website name, the callback link and the customer id cannot be changed by it; unknown keys are dropped.
• gravityextra_paytm_max_paise changes the largest total the site accepts (10,00,000 INR, in paise).
• gravityextra_paytm_rate_limit changes the per-visitor limits (payment starts 10, payment page 30, return page 30, webhooks 120 per minute).
• gravityextra_paytm_payments_per_hour changes the site-wide cap of new transactions per hour (300).
• gravityextra_paytm_webhook_base changes the base address of the webhook (for a site behind a proxy).
• gravityextra_paytm_legacy_hosts (return true) sends every request to the former securegw.paytm.in hosts, for an account that Paytm has not moved to the current hosts yet.

// Offer only UPI and net banking on the Paytm page, and keep the class date (udf3), for one form (ID 7).
add_filter( 'gravityextra_paytm_txn_fields', function ( $txn, $feed, $entry, $form ) {
    if ( 7 !== (int) rgar( $form, 'id' ) ) {
        return $txn;
    }
    $txn['enablePaymentMode']  = array( array( 'mode' => 'UPI' ), array( 'mode' => 'NET_BANKING' ) );
    $txn['extendInfo']['udf3'] = rgar( $entry, '8' );
    return $txn;
}, 10, 4 );

How it differs

• Nothing is trusted from the browser, the callback or the webhook body: the checksum is verified with your merchant key first, and then every result is read back from Paytm with the Transaction Status API and checked against the entry’s order ID, MID and amount before the entry changes.
• Every request to Paytm is signed with the Paytm checksum, implemented from Paytm’s published scheme inside the add-on (no extra library is loaded on your site).
• A repeated webhook is dropped, so a payment can only be completed once; a result Paytm still reports as pending never marks an entry paid.
• The MID and the merchant key are checked with Paytm when you save, the key and the transaction token are kept encrypted, and each entry stays with the mode it was created in.
• Refunds from the entry screen are checked against Paytm first, protected by a one-time form, reserved while Paytm processes them and followed until they complete; dashboard refunds are recorded too.
• Payment starts, the payment page, the return page and webhooks have per-visitor limits, and new transactions have an hourly cap, so a flood of form posts cannot start transactions without end.
• Gravity Forms has no Indian rupee: the add-on adds it with the right symbol and separators, so a price of ₹1,250.00 is read as 1,250 rupees in the browser and on the server.

Troubleshooting

Uninstall

Uninstalling the add-on from Forms → Settings → Uninstall removes its settings (including the encrypted merchant keys), the status check schedule, its locks, counters and checks. Entries, their notes and transactions stay in Gravity Forms, and transactions and refunds at Paytm are not touched.

Plans: one site $49 a year, five sites $69 a year, unlimited sites $199 a year. Questions? Contact GravityExtra support.