Skip to content

Razorpay API Key

Service Name: Razorpay

Service Description: Razorpay is a payment gateway service provider based in India that allows businesses to accept, process, and disburse payments with its product suite. It provides a robust payment solution for Indian businesses with various features like payment links, subscriptions, and payment pages.

Service Address: https://razorpay.com/

Validation Type: API Auth

IP Allow list: IP whitelisting is available at the account level for API requests

Secret Access Scope: Grants access to Razorpay's payment processing API, allowing creation of payment links, processing transactions, managing refunds, and accessing customer payment information.

Secret Revokement URL: https://dashboard.razorpay.com/#/app/keys

Secret Example: rzp_test_1DP5mmOlF5G5ag

Suspicious Activity Investigation Instructions:

  • Review the Razorpay dashboard for unauthorized transactions or payment links
  • Check API logs for unusual API calls or access patterns
  • Monitor for unexpected refunds or payment processing activities
  • Review webhook configurations for unauthorized changes
  • Check for unusual payment settlement patterns or destinations

Mitigation Instructions:

  • Log in to your Razorpay Dashboard at https://dashboard.razorpay.com/
  • Navigate to Settings > API Keys

  • Identify the compromised key and click "Revoke"

  • Generate a new API key pair if needed

  • Update the API key in all legitimate applications and services
  • Review and update IP whitelisting settings for additional security
  • Enable additional security features like webhook signatures
  • Review and update user access permissions to the Razorpay dashboard