Cashfree Payment Gateway - Common Integration Mistakes

Webhook signature verification usually fails because the JSON body was parsed and re-serialized before hashing, which changes decimals, field order, or whitespace. Always compute HMAC-SHA256 over the raw request body concatenated with the x-webhook-timestamp header, using your x-client-secret.

Verify payment status from your backend by calling GET /orders/{order_id} and fulfill only when order_status is PAID. Frontend callbacks, return URLs, and SDK onSuccess handlers are hints that can be spoofed or arrive out of order, never proof of payment.

A 401 error typically means sandbox credentials are being used against the production base URL or vice versa. Sandbox uses https://sandbox.cashfree.com/pg and production uses https://api.cashfree.com/pg, each with its own x-client-id and x-client-secret pair.

The callback never fires if it is registered after calling doPayment(). Register the callback before initiating payment — in onCreate() for Android, viewDidLoad() for iOS, initState() for Flutter, or componentDidMount() for React Native.

No, the Cashfree React Native SDK uses native modules that Expo Go does not support. Run npx expo prebuild and build with expo-dev-client using npx expo run:android or npx expo run:ios instead.

Do not use it for step-by-step integration instructions — use the Backend SDK, Mobile SDK, S2S API, or Web Checkout skills instead. It also does not cover Payouts, Subscriptions, Verification Suite, or Secure ID products, which have their own error patterns.