Security
Built so a payment marked paid is a payment you can trust.
We publish our security principles here. To protect merchants and customers, we do not publish the internal details of our verification method.
Multi-layer verification
Payments are confirmed through automatic bank verification with multiple independent checks before an order is marked successful. Our proprietary verification technology is verified directly with the bank.
Signed webhooks
Every webhook is signed (timestamp + HMAC-SHA256). Your server can verify that an event genuinely came from Vexoli before acting on it.
Encrypted secrets
API keys and webhook secrets are stored encrypted, shown carefully, and rotatable from the dashboard.
Host-only sessions
Dashboard sessions use host-only, secure cookies — your session is not shared across unrelated sites.
Audit logs
Key account and order actions are recorded in audit logs for review.
Exact-amount discipline
Smart amount fingerprinting means a payment for the wrong amount is never silently applied to the wrong order.
Your responsibilities
Always verify webhook signatures server-side, keep your API keys secret, use idempotency keys when creating orders, and never treat a browser callback alone as proof of payment. The signed webhook is the source of truth.
Start accepting UPI payments today
Create your account, create your first order, and get verified automatically — no paperwork maze.
No setup fee · Test mode included · Cancel anytime