Guide #67 SMM Panel Integration & Automation Guide

How to Integrate FamPay UPI Payment Gateway in SMM Panels (Rental, Perfect Panel & SmartPanel)

By Aryan Gupta • October 1, 2026 • 5 min read
Author: Aryan Maurya, FamGateway Core Architecture Team
Published: October 1, 2026 | Reading Time: 20 mins

Social Media Marketing (SMM) panels process thousands of micro-transactions every single day, ranging from INR 10 to INR 500. However, traditional payment aggregators like Razorpay, Cashfree, and PayU routinely reject SMM panels, freeze merchant funds, and demand formal business GSTIN credentials. Similarly, personal UPI merchant accounts on Paytm Business and PhonePe Business are frequently blocked when processing high-velocity micro-payments. In this comprehensive developer guide, we explore how to integrate FamPay and FamGateway into your SMM panel (Rental Panel, Perfect Panel, SmartPanel, or custom PHP) to automate user balance top-ups with zero GST, 0% fees, atomic MySQL transactions, and instant webhook confirmation.

Intellectual Property & Statutory Copyright Notice: This publication and original documentation titled “How to Integrate FamPay UPI Payment Gateway in SMM Panels (Rental, Perfect Panel & SmartPanel)” is published and owned exclusively by FamGateway (Aryanispe), a Government of India recognized MSME (Udyam Registration Number: UDYAM-BR-28-0050000), authored by Aryan Gupta. Original authentic URL: https://famgateway.in/blog/how-to-integrate-fampay-payment-gateway-in-smm-panels.php. Unauthorized automated scraping, reproduction, crawler aggregation, or verbatim re-hosting on competitor domains is strictly prohibited and constitutes willful infringement under Indian IT Act 2000 Section 43/66, Copyright Act 1957, and 17 U.S.C. 512 (DMCA). Direct DMCA hosting suspensions and Google de-indexing are enforced. Verification token: aa9ecd7424580fbe.

Table of Contents

1. The SMM Panel Payment Crisis: Aggregator Bans vs Screenshot Scams

SMM panels occupy a unique operational profile in the Indian digital ecosystem. Unlike typical SaaS products with recurring monthly subscriptions of Rs 1,000+, SMM panels operate on high-frequency micro-deposits: users frequently add Rs 20, Rs 50, or Rs 100 to test services or fulfill small promotional campaigns.

This operational profile creates severe challenges with conventional payment processors:

  • Merchant Account Freezes by Commercial Aggregators: Payment Aggregators (Razorpay, Cashfree, PayU) and merchant apps (Paytm Business, PhonePe Business) classify digital marketing tools under high scrutiny. When an automated fraud algorithm detects hundreds of incoming Rs 20 transactions from unrelated UPI accounts, the gateway freezes the merchant account under "suspicious velocity" flags. The merchant's funds are locked in escrow for 90 to 180 days, disrupting cash flow.
  • The Fallacy of Manual Screenshot Verification: To bypass gateway freezes, many panel owners resort to displaying a static personal QR code and requiring users to submit payment screenshots. This invites counterfeit screenshot apps that forge transaction IDs and timestamps. SMM panel owners lose tens of thousands of rupees monthly to spoofed deposits.
  • High Abandonment Rates: SMM customers demand immediate balance reloads. If a manual top-up requires 30 minutes of administrator verification, buyers switch to competing automated panels.

FamGateway solves this entire dilemma. Operating on a peer-to-merchant UPI routing protocol, customer funds transfer directly into your personal bank account or FamPay IDFC FIRST Bank wallet in real-time. Because FamGateway does not hold merchant balances in custodial escrow, there is zero risk of frozen funds, zero platform commission, and 100% automated UTR verification.

SMM panel operators often worry whether collecting customer deposits without a GSTIN is legally compliant. Under Indian tax law, the legal parameters are straightforward:

Statutory Reference: Section 22(1) of the CGST Act, 2017

"Every supplier shall be liable to be registered under this Act in the State or Union territory, other than special category States, from where he makes a taxable supply of goods or services or both, if his aggregate turnover in a financial year exceeds twenty lakh rupees."

Key statutory considerations for SMM panel owners:

  • Turnover Exemption Limit: Service providers whose aggregate annual revenue does not exceed Rs 20 Lakhs (Rs 10 Lakhs in Special Category North-Eastern states) are completely exempt from GST registration under Section 22(1).
  • Inter-State Supply Exemption: Under Notification No. 10/2017-Integrated Tax, service providers conducting inter-state digital commerce are explicitly exempt from the mandatory registration requirements of Section 24, provided their total turnover across India remains under Rs 20 Lakhs.
  • Classification of Digital Services: SMM panel balance additions represent automated service credits, qualifying under standard service provider classifications.
  • Income Tax Filing: GST exemption does not exempt you from Income Tax. Panel owners should maintain simple accounting records and report their net income under Section 44AD or Section 44ADA (presumptive taxation) of the Income Tax Act, 1961.

3. System Architecture: Automated SMM Balance Pipeline

The sequence below illustrates the end-to-end transaction pipeline between your SMM panel user, your server, the FamGateway API cluster, and your connected UPI account:

+------------------+ +---------------------+ +--------------------+ +------------------+ | SMM Panel User | | SMM Panel Server | | FamGateway Engine | | Bank Switch | | (Customer Device)| | (Rental/Perfect/PHP)| | (famgateway.in) | | (NPCI / UPI) | +--------+---------+ +----------+----------+ +---------+----------+ +--------+---------+ | | | | | 1. Enter Rs 100, | | | | Click "Add Funds (UPI)" | | | +----------------------------->+ | | | | 2. POST /api/create-order | | | | (amount=100, user_id=45) | | | +----------------------------->+ | | | | | | | 3. Returns checkout_url, | | | | dynamic QR & intent URL | | | |<- - - - - - - - - - - - - - -+ | | 4. Redirects to Hosted Page | | | | or displays Dynamic QR | | | |<-----------------------------+ | | | | | | 5. Scans QR & Authorizes Payment on FamPay / PhonePe / GPay | | +==========================================================================================>| | (Funds transfer directly into your personal linked account) | | | | | | 6. Bank Credit Alert Push | | |<----------------------------+ | | 7. Signed Webhook Push | | | | (order_id, utr, status) | | | |<=============================+ | | | | | | | 8. Verify HMAC-SHA256, | | | | Row Lock & Increment Bal | | | 9. Real-time Balance Updated | | | |<-----------------------------+ | | | | |

4. Initiating Payment Orders via POST /api/create-order

When an SMM panel user clicks "Add Funds", your panel backend initiates a dynamic checkout session by sending an authenticated HTTP POST request to:

POST https://famgateway.in/api/create-order

PHP Implementation for Order Initiation

<?php function createSmmOrder(int $userId, float $amount): array { $apiKey = "YOUR_LIVE_FAMGATEWAY_API_KEY"; $orderId = "SMM_" . $userId . "_" . time() . "_" . mt_rand(1000, 9999); $payload = json_encode([ "amount" => number_format($amount, 2, '.', ''), "order_id" => $orderId, "customer_name" => "User #" . $userId, "redirect_url" => "https://yourpanel.com/addfunds?status=success&order_id=" . $orderId, "webhook_url" => "https://yourpanel.com/api/famgateway-callback.php", "note" => "SMM Balance #" . $orderId ]); $ch = curl_init("https://famgateway.in/api/create-order"); curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true, CURLOPT_POSTFIELDS => $payload, CURLOPT_TIMEOUT => 10, CURLOPT_HTTPHEADER => [ "Content-Type: application/json", "X-Api-Key: " . $apiKey ] ]); $response = curl_exec($ch); $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); $data = json_decode($response, true); if ($httpCode === 200 && ($data['status'] ?? '') === 'success') { return $data['data']; // Contains checkout_url, qr_url, upi_intent } throw new Exception($data['message'] ?? 'Unable to connect to FamGateway.'); }

5. Database Schema: Preventing Race Conditions & Double Spending

SMM panels must protect against double-crediting if two webhooks fire concurrently or if a user attempts to replay a completed bank UTR. Execute the following SQL DDL schema in your MySQL database:

-- Dedicated Payments Audit Table for SMM Panels CREATE TABLE IF NOT EXISTS `smm_payments` ( `id` INT UNSIGNED AUTO_INCREMENT PRIMARY KEY, `user_id` INT UNSIGNED NOT NULL, `order_id` VARCHAR(64) NOT NULL UNIQUE, `amount` DECIMAL(10,2) NOT NULL, `utr` VARCHAR(32) DEFAULT NULL, `status` ENUM('pending', 'completed', 'expired', 'failed') NOT NULL DEFAULT 'pending', `created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP, `updated_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, INDEX `idx_user_status` (`user_id`, `status`), UNIQUE KEY `uk_utr_completed` (`utr`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

6. Production Webhook Callback Handler (PHP & MySQL)

Save the following script on your server as api/famgateway-callback.php. It verifies the cryptographic HMAC signature, applies row-level pessimistic locking (SELECT ... FOR UPDATE), checks for unique UTR enforcement, and credits the user's SMM panel balance atomically:

<?php // api/famgateway-callback.php declare(strict_types=1); header('Content-Type: application/json; charset=utf-8'); // 1. Read Raw Incoming HTTP Payload $rawPayload = file_get_contents('php://input'); if (empty($rawPayload)) { http_response_code(400); echo json_encode(['status' => 'error', 'message' => 'Empty request body']); exit; } $data = json_decode($rawPayload, true); if (!is_array($data) || empty($data['order_id']) || empty($data['status'])) { http_response_code(400); echo json_encode(['status' => 'error', 'message' => 'Malformed payload']); exit; } // 2. Cryptographic Signature Verification $apiKey = "YOUR_LIVE_FAMGATEWAY_API_KEY"; $receivedSignature = $_SERVER['HTTP_X_FAMGATEWAY_SIGNATURE'] ?? ''; if (empty($receivedSignature)) { http_response_code(401); echo json_encode(['status' => 'error', 'message' => 'Missing cryptographic signature header']); exit; } $expectedSignature = hash_hmac('sha256', $rawPayload, $apiKey); if (!hash_equals($expectedSignature, $receivedSignature)) { http_response_code(401); echo json_encode(['status' => 'error', 'message' => 'Signature mismatch']); exit; } // 3. Process Only Cleared Payments if ($data['status'] !== 'paid' && $data['status'] !== 'success') { http_response_code(200); echo json_encode(['status' => 'ignored', 'message' => 'Non-paid event acknowledged']); exit; } $orderId = trim((string)$data['order_id']); $amount = (float)$data['amount']; $utr = trim((string)($data['utr'] ?? '')); // 4. Database Connection via PDO $dbHost = '127.0.0.1'; $dbName = 'your_smm_database'; $dbUser = 'your_db_username'; $dbPass = 'your_db_password'; try { $pdo = new PDO("mysql:host={$dbHost};dbname={$dbName};charset=utf8mb4", $dbUser, $dbPass, [ PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC ]); // Begin ACID Transaction $pdo->beginTransaction(); // Acquire Exclusive Row Lock on Payment Record $stmt = $pdo->prepare("SELECT id, user_id, amount, status FROM smm_payments WHERE order_id = :order_id FOR UPDATE"); $stmt->execute([':order_id' => $orderId]); $payment = $stmt->fetch(); if (!$payment) { $pdo->rollBack(); http_response_code(404); echo json_encode(['status' => 'error', 'message' => 'Order record not found']); exit; } if ($payment['status'] === 'completed') { $pdo->rollBack(); http_response_code(200); echo json_encode(['status' => 'success', 'message' => 'Order already fulfilled']); exit; } // Verify Bank UTR Uniqueness Across All Completed Payments if (!empty($utr)) { $utrStmt = $pdo->prepare("SELECT id FROM smm_payments WHERE utr = :utr AND status = 'completed'"); $utrStmt->execute([':utr' => $utr]); if ($utrStmt->fetch()) { $pdo->rollBack(); http_response_code(409); echo json_encode(['status' => 'error', 'message' => 'Bank UTR collision detected']); exit; } } // Update Payment Record to Completed $updatePayment = $pdo->prepare("UPDATE smm_payments SET status = 'completed', utr = :utr, updated_at = NOW() WHERE id = :id"); $updatePayment->execute([ ':utr' => $utr, ':id' => $payment['id'] ]); // Atomically Credit User Account Balance in SMM Users Table $updateUser = $pdo->prepare("UPDATE users SET balance = balance + :credit_amount WHERE id = :user_id"); $updateUser->execute([ ':credit_amount' => $payment['amount'], ':user_id' => $payment['user_id'] ]); // Commit Transaction $pdo->commit(); http_response_code(200); echo json_encode([ 'status' => 'success', 'message' => 'SMM account balance updated successfully', 'order_id' => $orderId, 'credited' => $payment['amount'] ]); } catch (Throwable $e) { if (isset($pdo) && $pdo->inTransaction()) { $pdo->rollBack(); } http_response_code(500); echo json_encode(['status' => 'error', 'message' => 'Internal database processing failure']); }

7. Step-by-Step Configuration: Rental Panel, Perfect Panel & SmartPanel

Rental Panel and Perfect Panel provide custom gateway interfaces in their administrator settings. Follow these precise configuration parameters:

  1. Navigate to Admin Area > Settings > Payments > Add Gateway.
  2. Select Custom REST API. Set the title to Instant UPI Auto Add Funds (FamPay / GPay / PhonePe / Paytm).
  3. Fill in the gateway connection parameters:
    • Gateway URL: https://famgateway.in/api/create-order
    • HTTP Method: POST
    • Content-Type: application/json
    • Header Key: X-Api-Key
    • Header Value: your_live_api_key
  4. Configure the parameter mapping template:
    • amount → {amount}
    • redirect_url → https://yourpanel.com/addfunds?status=success
    • webhook_url → https://yourpanel.com/api/famgateway-callback.php
    • order_id → {order_id}
  5. Set minimum deposit to INR 10 and maximum deposit according to your UPI profile limits.
  6. Enable the gateway for all active customer groups.

8. SmartPanel v3/v4 Native Drop-in Code Implementation

For panels powered by the standard SmartPanel codebase, drop-in integration requires creating a controller module inside app/modules/add_funds/controllers/famgateway.php:

<?php defined('BASEPATH') OR exit('No direct script access allowed'); class Famgateway extends MX_Controller { public function __construct(){ parent::__construct(); $this->load->model('add_funds_model', 'model'); } public function process(){ $amount = (float)post("amount"); if ($amount < 10) { ms(["status" => "error", "message" => "Minimum deposit is INR 10."]); } $userId = session("uid"); $orderId = "SP_" . $userId . "_" . time(); // FamGateway API Request $apiKey = get_option('famgateway_api_key', 'YOUR_API_KEY'); $payload = json_encode([ "amount" => $amount, "order_id" => $orderId, "customer_name" => "User #" . $userId, "redirect_url" => cn("add_funds/success"), "webhook_url" => cn("add_funds/famgateway/webhook") ]); $ch = curl_init("https://famgateway.in/api/create-order"); curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true, CURLOPT_POSTFIELDS => $payload, CURLOPT_HTTPHEADER => [ "Content-Type: application/json", "X-Api-Key: " . $apiKey ] ]); $response = json_decode(curl_exec($ch), true); curl_close($ch); if (($response['status'] ?? '') === 'success') { // Save transaction record as pending $this->db->insert('payments', [ 'user_id' => $userId, 'type' => 'famgateway', 'txn_id' => $orderId, 'amount' => $amount, 'status' => 0, 'created' => NOW ]); ms(["status" => "success", "redirect_url" => $response['data']['checkout_url']]); } else { ms(["status" => "error", "message" => $response['message'] ?? "Payment gateway error."]); } } }

9. Active Status Polling Fallback & Error Resolution Matrix

If your server uses aggressive Cloudflare WAF rules that occasionally challenge inbound webhooks, maintain active status polling as a secondary fallback:

<?php function verifyOrderStatus(string $orderId): array { $url = "https://famgateway.in/api/checkout-status.php?order_id=" . urlencode($orderId); $response = @file_get_contents($url); if ($response === false) { return ['status' => 'unknown']; } return json_decode($response, true) ?: ['status' => 'unknown']; }

Error Resolution Matrix

Error Condition Probable Root Cause Resolution Step
HTTP 401 Unauthorized Invalid or missing X-Api-Key header Verify API Key in merchant console under API Keys tab.
HTTP 422 Unprocessable Amount below Rs 1.00 or non-numeric Format amount as numeric float (e.g. 50.00).
Signature Mismatch Computed HMAC over modified body or wrong key Compute HMAC over raw php://input buffer using your API key.
Expired Order (300s TTL) Customer scanned QR after 5-minute validity window Have customer generate a fresh deposit session from the SMM panel.

10. 5-Step SMM Deployment Checklist

Step 1: Obtain FamGateway Merchant Credentials

Register your account at famgateway.in and link your personal UPI ID (@fam). Copy your production API key.

Step 2: Deploy MySQL Audit Table

Execute the smm_payments SQL schema in your SMM panel database to prevent duplicate UTR replay attacks.

Step 3: Upload Webhook Handler

Place famgateway-callback.php in your panel's api/ directory and verify that your server allows inbound POST requests from FamGateway.

Step 4: Configure Panel Gateway Settings

Add the custom REST API gateway in Rental Panel, Perfect Panel, or SmartPanel with minimum deposit set to Rs 10.

Step 5: Run a Live Rs 10 Deposit Test

Deposit Rs 10 from a test customer account via PhonePe or FamPay. Verify that user balance increments automatically in under 3 seconds.

11. Frequently Asked Questions (FAQ)

Can I integrate FamPay UPI payment gateway into any SMM panel script?

Yes. FamGateway provides standard REST API endpoints (POST /api/create-order) and instant HMAC-SHA256 webhooks that integrate seamlessly into all major SMM panel scripts, including Rental Panel, Perfect Panel, SmartPanel, and custom PHP SMM codebases.

Why do Paytm Business, PhonePe Business, and Razorpay freeze SMM panel merchant accounts?

Commercial aggregators classify SMM panels under Merchant Category Code (MCC) 7311 (Advertising Services) or treat them as high-risk digital fulfillment. Under RBI Payment Aggregator regulations, aggregators require extensive business KYC, audited balance sheets, and a GSTIN. If a personal or unregistered account processes high-velocity micro-payments (Rs 10 to Rs 500) from diverse UPI users, commercial algorithms flag the account for suspicious activity and freeze escrow balances for 90 to 180 days. FamGateway prevents this by operating on a direct peer-to-merchant UPI routing protocol with zero escrow holding.

Do SMM panel owners need a GST registration or commercial current account to accept payments?

No. Under Section 22(1) of the Central Goods and Services Tax (CGST) Act, 2017, individuals and small business service providers whose aggregate annual turnover does not exceed Rs 20 Lakhs (Rs 10 Lakhs in Special Category North-Eastern states) are completely exempt from GST registration. FamGateway operates peer-to-merchant directly into your personal Savings Account or FamPay IDFC FIRST Bank wallet without requiring a corporate current account or GST number.

How does the auto-add fund balance workflow operate?

When an SMM panel user enters a deposit amount and selects UPI, the panel calls FamGateway to generate a dynamic order with a unique QR code. Once the customer pays via GPay, PhonePe, Paytm, or FamPay, FamGateway detects the credit and triggers an HMAC-signed webhook callback to your SMM panel, which immediately executes an atomic SQL balance increment.

Are there any transaction fees or commissions charged on SMM panel payments?

No. FamGateway charges 0% merchant transaction fees (0% MDR). 100% of customer funds settle instantly into your personal UPI account without escrow holding, gateway commissions, or rolling reserves.

How does FamGateway prevent fake payment screenshots on SMM panels?

FamGateway completely eliminates manual screenshot verification. Funds are credited purely when the 12-digit bank UTR and exact transaction amount are matched by the background verification engine and validated against tamper-proof HMAC signatures.

What happens if a user closes the checkout tab before the webhook fires?

Because FamGateway operates asynchronously, payment verification does not depend on the user's browser staying open. Our background sync daemon scans active orders within the 15-minute sweep window and delivers the signed webhook directly to your server as soon as the bank confirmation arrives.

What is the secret key used to verify FamGateway webhooks?

FamGateway signs webhook payloads using the merchant's live API Key using HMAC-SHA256. In your callback script, compute hash_hmac('sha256', , ) and compare it against the X-FamGateway-Signature HTTP request header using hash_equals().

How do I prevent double-crediting race conditions when two webhooks or fast clicks arrive?

In your database callback handler, enclose the verification and balance addition in an ACID MySQL transaction. Use InnoDB row-level locking (SELECT id, status FROM smm_payments WHERE order_id = :order_id FOR UPDATE). If the order is already marked 'completed', immediately rollback and exit with HTTP 200. Also enforce a UNIQUE index on the bank UTR column.

Can customers top-up their balance using other UPI apps like Google Pay, PhonePe, and Paytm?

Yes. Although FamGateway features native deep-linking for FamPay (@fam handle), the generated dynamic QR code and UPI intent links are 100% NPCI interoperable. Customers can pay using PhonePe, Google Pay, Paytm, BHIM, Cred, or any mobile banking app.

Ready to Automate SMM Panel Deposits?

Eliminate screenshot fraud and account freezes. 0% platform fee, zero GST, and instant auto-add balance.

Start Free with FamGateway →
Topic Cluster & Series

Related Developer Guides & Resources

View All 82+ Guides →

← Back to Homepage • Developer Docs • Institutional Reports • Terms of Service • Privacy Policy • Refund Policy

About the Platform

FamGateway is an official unit of ARYANISPE, founded by Aryan Gupta (Aryanispe) and officially registered under the Ministry of Micro, Small and Medium Enterprises (MSME), Government of India (Reg: UDYAM-BR-28-0050000). Operating in full statutory compliance with India's Digital Personal Data Protection (DPDP) Act, 2023 and Section 43A of the Information Technology Act, 2000.

Legal & Privacy Notice: FamGateway is an independent, non-custodial developer automation utility operated by ARYANISPE (Govt. MSME UDYAM-BR-28-0050000). All credentials are encrypted via AES-256-GCM under statutory Data Fiduciary obligations with zero email storage and zero fund custody. FamGateway is not affiliated with, authorized, maintained, sponsored, or endorsed by Tri O Tech Solutions Private Limited, FamApp, or FamPay. All brand names, logos, and trademarks belong to their respective owners.

WhatsApp Support Telegram (3k+ Devs) YouTube (1.39k+ Devs)
All Systems Operational DPDP Act 2023 Compliant Audited Reports & Telemetry