YouPI PG is a self-hosted UPI and cash-on-delivery checkout that sends customer payments straight to your own bank account, with no per-transaction platform fee. It spots payments by reading your bank's SMS and email alerts. This guide covers the repo, a safe local test setup and the checklist to go through before you let it near real money.
What you need
The repo: github.com/youpi-pg/YouPI-PG, originally created by Gaurav (GitHub: gxurav1710) and now maintained by Zenuxs. Several copies of it exist under other accounts with the same description, so make sure you're using the original.
Node.js 20 or newer, on Linux or Windows. No Docker or external database needed; it uses SQLite.
For real payment detection (not needed for a demo):
a spare Android phone with the SIM that gets your bank's SMS alerts
a Google account that receives your bank's credit-alert emails
a Chrome profile the project can control
A UPI ID (VPA) linked to the bank account you want paid into.
How it works
Your website loads a small script and shows a pay button.
The customer gets a UPI QR code or a deep link to GPay, PhonePe, Paytm or CRED, and pays your UPI ID directly.
"Observers" watch for the bank's credit alert: an Android app reading SMS and notifications, a Gmail reader, and an SMS-on-web reader.
The server matches the alert by exact amount and the 12-digit UTR reference, marks the order paid and sends a signed webhook to your site.
UPI alerts can't carry an order ID, so it lets only one customer pay a given UPI ID at a time. That stops two people paying the same amount from being mixed up.
Step by step
Run it locally first.
git clone https://github.com/youpi-pg/YouPI-PG.git
cd YouPI-PG
npm install
cp .env.example .env
npm run devThe README lists these local ports: Control Center 8090, Merchant Admin 6001, Demo Store 5000, Payment API 6100 and Checkout 7000. Open the demo store to see the flow.
Add the script to your site's
<head>. Replace the domain with where you host it, and use your merchant public key:
<script src="https://pay.yourdomain.com/youpi.js"
data-youpi-key="YOUR_MERCHANT_PUBLIC_KEY"
data-currency="INR">
</script>Add a pay button.
<button data-youpi-pay
data-order-id="ORDER-1001"
data-amount="499.00"
data-currency="INR">
Pay with UPI
</button>For React, Vue or Next.js, call `window.Youpi.pay({ order_id, amount, currency, handler, onClose })` instead.
Verify webhooks on your server. The README has examples in Node.js, Python, PHP and Go. Check the
X-Gateway-Signatureheader against the raw request body before you trust any "paid" event.Work through this checklist before any real money:
Reconcile every order against your bank statement, not just the alert.
Test duplicate alerts, wrong amounts, late alerts, expired orders and two customers paying at once.
Plan refunds and disputes. They're manual: you send the money back yourself and record it.
Get a security review of your setup.
Keep volume low while testing. The README suggests no more than 20 payment attempts a day per receiving account for experiments.
Talk to your bank and a compliance adviser about your use case.
Good to know
"Zero fee" means no gateway fee. For comparison, Razorpay's standard plan charges 2% on UPI, cards and netbanking, plus 18% GST on that fee. Some methods cost 3%.
UPI itself may start charging some merchants. NPCI announced a 0.4% merchant discount rate on person-to-merchant UPI payments above Rs 2,000. Small merchants receiving up to Rs 1 lakh a month through UPI QR stay at zero. The rollout, first set for October 15, 2026, was deferred until after Diwali, and NPCI will announce the new date.
It's experimental. The README says it isn't certified, audited, or approved by NPCI or any bank, and isn't production-ready.
Only collect for yourself. Payment aggregators in India need RBI authorisation under its 2025 Payment Aggregator Directions. The README says not to collect for unrelated merchants or route funds, and that the software gives you no permission to run a regulated payment service.
Alerts aren't proof of payment. SMS and email formats change, alerts can be late, duplicated, missing or faked, and banks can restrict accounts. Always check against bank records.
Privacy: the observers read all your bank SMS and alert emails. Use a dedicated phone and account.
License: the README points to a LICENSE file, but we couldn't find one in the repo, so the reuse terms aren't clear. Check before building on it commercially.
Sources
Found this useful? Follow @kevinsingh.me on Instagram for a new AI tool every day, and subscribe so you don't miss the next one.