diff --git a/biome.json b/biome.json
index a0f9afd..f87a2ec 100644
--- a/biome.json
+++ b/biome.json
@@ -29,8 +29,7 @@
         "noDelete": "warn"
       },
       "complexity": {
-        "noForEach": "warn",
-        "noImportantStyles": "off"
+        "noForEach": "warn"
       },
       "suspicious": {
         "noConsole": { "level": "error", "options": { "allow": ["error"] } }
diff --git a/client/components/razorpayCheckout/index.js b/client/components/razorpayCheckout/index.js
new file mode 100644
index 0000000..81cde1c
--- /dev/null
+++ b/client/components/razorpayCheckout/index.js
@@ -0,0 +1,205 @@
+/**
+ * Razorpay Checkout Component
+ * Handles web-based plugin purchases via Razorpay payment gateway
+ */
+
+import alert from 'components/dialogs/alert';
+import Ref from 'html-tag-js/ref';
+
+// Load Razorpay script dynamically
+let razorpayLoaded = false;
+function loadRazorpayScript() {
+  return new Promise((resolve, reject) => {
+    if (razorpayLoaded) {
+      resolve();
+      return;
+    }
+
+    const script = document.createElement('script');
+    script.src = 'https://checkout.razorpay.com/v1/checkout.js';
+    script.async = true;
+    script.onload = () => {
+      razorpayLoaded = true;
+      resolve();
+    };
+    script.onerror = () => reject(new Error('Failed to load Razorpay script'));
+    document.head.appendChild(script);
+  });
+}
+
+/**
+ * Check if user owns a plugin
+ * @param {string} pluginId
+ * @returns {Promise<boolean>}
+ */
+export async function checkPluginOwnership(pluginId) {
+  try {
+    const res = await fetch(`/api/razorpay/check-ownership/${pluginId}`);
+    const data = await res.json();
+    return data.owned === true;
+  } catch (error) {
+    console.error('Failed to check plugin ownership:', error);
+    return false;
+  }
+}
+
+/**
+ * Razorpay checkout configuration
+ */
+const RAZORPAY_CONFIG = {
+  theme: {
+    color: '#2563eb',
+    backdrop_color: 'rgba(15, 23, 42, 0.8)',
+  },
+  branding: {
+    name: 'Acode Plugin Store',
+    image: '/logo-512.png',
+  },
+};
+
+/**
+ * Initiate Razorpay checkout for a plugin
+ * @param {string} pluginId
+ * @param {Object} userInfo - User information for prefill
+ * @param {string} [userInfo.email] - User's email address
+ * @param {string} [userInfo.name] - User's name
+ * @param {Function} onSuccess - Callback on successful payment
+ * @param {Function} [onCancel] - Callback when checkout is cancelled
+ * @returns {Promise<void>}
+ */
+export async function initiateCheckout(pluginId, userInfo = {}, onSuccess, onCancel) {
+  try {
+    // Load Razorpay script if not already loaded
+    await loadRazorpayScript();
+
+    // Create order on server
+    const orderRes = await fetch('/api/razorpay/create-order', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ pluginId }),
+    });
+
+    const orderData = await orderRes.json();
+
+    if (orderData.error) {
+      alert('ERROR', orderData.error);
+      return;
+    }
+
+    const { orderId, amount, currency, keyId, pluginName, userEmail } = orderData;
+
+    // Open Razorpay checkout with customization
+    const options = {
+      key: keyId,
+      amount,
+      currency,
+      name: RAZORPAY_CONFIG.branding.name,
+      description: `Purchase: ${pluginName}`,
+      image: RAZORPAY_CONFIG.branding.image,
+      order_id: orderId,
+      handler: async (response) => {
+        try {
+          const verifyRes = await fetch('/api/razorpay/verify', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              razorpay_order_id: response.razorpay_order_id,
+              razorpay_payment_id: response.razorpay_payment_id,
+              razorpay_signature: response.razorpay_signature,
+              pluginId,
+            }),
+          });
+
+          if (!verifyRes.ok) throw new Error('Verification request failed');
+
+          const verifyData = await verifyRes.json();
+
+          if (verifyData.success) {
+            alert('SUCCESS', 'Payment successful! You can now download this plugin.');
+            if (onSuccess) onSuccess();
+          } else {
+            alert('ERROR', verifyData.error || 'Payment verification failed');
+          }
+        } catch (error) {
+          console.error('Verification error:', error);
+          alert('ERROR', 'Payment may have succeeded but verification failed. Please contact support if charged.');
+        }
+      },
+      // Prefill user information (email preferred over contact for web)
+      prefill: {
+        email: userInfo.email || userEmail || '',
+        name: userInfo.name || '',
+        // Note: contact (phone) is required by Razorpay for Indian regulations
+        // but email will be shown as primary identifier
+      },
+      // Theme customization
+      theme: {
+        color: RAZORPAY_CONFIG.theme.color,
+        backdrop_color: RAZORPAY_CONFIG.theme.backdrop_color,
+      },
+      // Modal behavior
+      modal: {
+        confirm_close: true, // Ask before closing
+        escape: true, // Allow ESC to close
+        animation: true, // Enable animations
+        ondismiss: () => {
+          if (onCancel) onCancel();
+        },
+      },
+      // Additional checkout preferences
+      notes: {
+        pluginId,
+        source: 'acode_web',
+      },
+    };
+
+    const rzp = new window.Razorpay(options);
+    rzp.on('payment.failed', (response) => {
+      alert('ERROR', `Payment failed: ${response.error.description}`);
+    });
+    rzp.open();
+  } catch (error) {
+    console.error('Checkout error:', error);
+    alert('ERROR', error.message || 'Failed to initiate checkout');
+  }
+}
+
+/**
+ * Buy Button Component for paid plugins
+ * @param {Object} props
+ * @param {string} props.pluginId - Plugin ID
+ * @param {number} props.price - Plugin price in INR
+ * @param {Object} [props.user] - Logged in user object
+ * @param {Function} [props.onPurchaseComplete] - Callback after successful purchase
+ * @returns {HTMLElement}
+ */
+export default function BuyButton({ pluginId, price, user, onPurchaseComplete }) {
+  const buttonRef = Ref();
+  const buttonTextRef = Ref();
+
+  const handleClick = async () => {
+    buttonRef.el.disabled = true;
+    buttonTextRef.el.textContent = 'Processing...';
+
+    const handleSuccess = () => {
+      buttonTextRef.el.textContent = 'Purchased ✓';
+      buttonRef.el.disabled = true;
+      if (onPurchaseComplete) onPurchaseComplete();
+    };
+
+    const handleCancel = () => {
+      buttonTextRef.el.textContent = `Buy ₹${price}`;
+      buttonRef.el.disabled = false;
+    };
+
+    const userInfo = user ? { email: user.email, name: user.name } : {};
+    await initiateCheckout(pluginId, userInfo, handleSuccess, handleCancel);
+  };
+
+  return (
+    <button ref={buttonRef} type='button' className='buy-button' onclick={handleClick}>
+      <span className='icon shopping_cart' />
+      <span ref={buttonTextRef}>Buy ₹{price}</span>
+    </button>
+  );
+}
diff --git a/client/pages/FAQs/index.js b/client/pages/FAQs/index.js
index a60d99e..a67a7bb 100644
--- a/client/pages/FAQs/index.js
+++ b/client/pages/FAQs/index.js
@@ -69,13 +69,11 @@ export default async function FAQs({ mode, oldQ, a, qHash }) {
           <div className='preview' ref={mdPreview} />
           <div className='buttons'>
             <button type='submit'>Submit</button>
-            {isUpdate ? (
-              <button className='danger' type='button' onclick={() => Router.reload()}>
-                Cancel
-              </button>
-            ) : (
-              ''
-            )}
+            {isUpdate
+              ? <button className='danger' type='button' onclick={() => Router.reload()}>
+                  Cancel
+                </button>
+              : ''}
           </div>
         </AjaxForm>
       </details>
@@ -123,14 +121,12 @@ export default async function FAQs({ mode, oldQ, a, qHash }) {
           </h2>
         </a>
         <p innerHTML={marked.parse(ans)} />
-        {isAdmin ? (
-          <div className='icon-buttons'>
-            <span onclick={() => editFaq(q, ans)} title='Edit this FAQ' className='link icon create' />
-            <span onclick={() => deleteFaq(q)} title='Delete this FAQ' className='link icon delete danger' />
-          </div>
-        ) : (
-          ''
-        )}
+        {isAdmin
+          ? <div className='icon-buttons'>
+              <span onclick={() => editFaq(q, ans)} title='Edit this FAQ' className='link icon create' />
+              <span onclick={() => deleteFaq(q)} title='Delete this FAQ' className='link icon delete danger' />
+            </div>
+          : ''}
       </div>
     );
   }
diff --git a/client/pages/changePassword/index.js b/client/pages/changePassword/index.js
index b03e5e7..046a6b9 100644
--- a/client/pages/changePassword/index.js
+++ b/client/pages/changePassword/index.js
@@ -32,25 +32,23 @@ export default async function changePassword({ mode, redirect }) {
         loading={(form) => loadingStart(form, errorText, successText)}
         loadingEnd={(form) => loadingEnd(form, 'Change password')}
       >
-        {mode === 'reset' ? (
-          <div>
-            <fieldset>
-              <Input
-                onchange={(e) => {
-                  email = e.target.value;
-                }}
-                type='email'
-                name='email'
-                label='Email'
-                placeholder='e.g. john@gmail.com'
-              />
-              <Input style={{ width: '140px' }} type='number' name='otp' label='OTP' placeholder='e.g. 1234' />
-            </fieldset>
-            <SendOtp type='reset' errorText={errorText} getEmail={() => email} />
-          </div>
-        ) : (
-          <Input type='password' name='oldPassword' label='Old password' placeholder='old password' />
-        )}
+        {mode === 'reset'
+          ? <div>
+              <fieldset>
+                <Input
+                  onchange={(e) => {
+                    email = e.target.value;
+                  }}
+                  type='email'
+                  name='email'
+                  label='Email'
+                  placeholder='e.g. john@gmail.com'
+                />
+                <Input style={{ width: '140px' }} type='number' name='otp' label='OTP' placeholder='e.g. 1234' />
+              </fieldset>
+              <SendOtp type='reset' errorText={errorText} getEmail={() => email} />
+            </div>
+          : <Input type='password' name='oldPassword' label='Old password' placeholder='old password' />}
         <Input type='password' name='password' label='Password' placeholder='password' />
         <span className='error'>{errorText}</span>
         <span className='success'>{successText}</span>
diff --git a/client/pages/plugin/index.js b/client/pages/plugin/index.js
index 0b87854..e255583 100644
--- a/client/pages/plugin/index.js
+++ b/client/pages/plugin/index.js
@@ -7,6 +7,7 @@ import confirm from 'components/dialogs/confirm';
 import prompt from 'components/dialogs/prompt';
 import Input from 'components/input';
 import MonthSelect from 'components/MonthSelect';
+import BuyButton, { checkPluginOwnership } from 'components/razorpayCheckout';
 import YearSelect from 'components/YearSelect';
 import hilightjs from 'highlight.js';
 import Ref from 'html-tag-js/ref';
@@ -64,6 +65,12 @@ export default async function Plugin({ id: pluginId, section = 'description' })
   const shouldShowOrders = user && (user.id === userId || user.isAdmin) && !!plugin.price;
 
   let canInstall = /android/i.test(navigator.userAgent);
+  let userOwnsPlugin = false;
+
+  // Check if logged-in user owns this paid plugin (for web purchases)
+  if (user && price > 0) {
+    userOwnsPlugin = await checkPluginOwnership(id);
+  }
 
   if (user?.isAdmin && plugin.status !== 'approved') {
     canInstall = false;
@@ -87,6 +94,35 @@ export default async function Plugin({ id: pluginId, section = 'description' })
     table.replaceWith(<div className='table-wrapper'>{table.cloneNode(true)}</div>);
   }
 
+  function renderPurchaseButton() {
+    if (userOwnsPlugin) {
+      return (
+        <div className='owned-badge'>
+          <span className='icon check_circle' />
+          <span>Purchased</span>
+        </div>
+      );
+    }
+    if (user) {
+      return (
+        <BuyButton
+          pluginId={id}
+          price={price}
+          user={user}
+          onPurchaseComplete={() => {
+            window.location.reload();
+          }}
+        />
+      );
+    }
+    return (
+      <a href={`/login?redirect=/plugin/${pluginId}`} className='login-to-buy'>
+        <span className='icon account_circle' />
+        <span>Login to Purchase</span>
+      </a>
+    );
+  }
+
   return (
     <section id='plugin'>
       <div className='row plugin-head'>
@@ -105,25 +141,21 @@ export default async function Plugin({ id: pluginId, section = 'description' })
           </div>
           <div className='info'>
             <span className='chip'>v {version}</span>
-            {+downloads ? (
-              <div className='chip'>
-                <span className='icon download' />
-                <span>{downloads.toLocaleString()}</span>
-              </div>
-            ) : (
-              <div className='chip'>
-                <span style={{ color: 'gold' }}>New</span>
-              </div>
-            )}
+            {+downloads
+              ? <div className='chip'>
+                  <span className='icon download' />
+                  <span>{downloads.toLocaleString()}</span>
+                </div>
+              : <div className='chip'>
+                  <span style={{ color: 'gold' }}>New</span>
+                </div>}
             <div className='chip'>
-              {price ? (
-                <>
-                  <span style={{ marginRight: '10px' }}>&#8377;</span>
-                  <span>{price}</span>
-                </>
-              ) : (
-                <span style={{ color: 'lightgreen' }}>Free</span>
-              )}
+              {price
+                ? <>
+                    <span style={{ marginRight: '10px' }}>&#8377;</span>
+                    <span>{price}</span>
+                  </>
+                : <span style={{ color: 'lightgreen' }}>Free</span>}
             </div>
             {commentCount > 0 && (
               <div className='chip' onclick={() => changeSection('comments')}>
@@ -160,6 +192,8 @@ export default async function Plugin({ id: pluginId, section = 'description' })
               </a>
             )}
           </div>
+          {/* Payment Section for paid plugins - placed after plugin info */}
+          {price > 0 && !canInstall && <div className='purchase-section'>{renderPurchaseButton()}</div>}
         </div>
       </div>
       <div className='detailed'>
@@ -406,13 +440,11 @@ function CommentsContainerAndForm({ plugin, listRef, user, id, userComment }) {
         <Input maxlength={250} type='textarea' name='comment' placeholder='Comment' value={comment} />
         <div className='buttons-container'>
           <button type='submit'>Submit</button>
-          {commentId ? (
-            <button onclick={deleteUserComment} type='button' className='danger' title='Delete your review'>
-              <span className='icon delete' />
-            </button>
-          ) : (
-            ''
-          )}
+          {commentId
+            ? <button onclick={deleteUserComment} type='button' className='danger' title='Delete your review'>
+                <span className='icon delete' />
+              </button>
+            : ''}
         </div>
       </AjaxForm>
 
diff --git a/client/pages/plugin/style.scss b/client/pages/plugin/style.scss
index 748be66..a88795f 100644
--- a/client/pages/plugin/style.scss
+++ b/client/pages/plugin/style.scss
@@ -40,6 +40,77 @@
           margin: 0 10px;
         }
       }
+
+      .purchase-section {
+        margin-top: 16px;
+        padding-top: 16px;
+        border-top: 1px solid rgba(255, 255, 255, 0.1);
+      }
+    }
+
+    .owned-badge {
+      display: inline-flex;
+      align-items: center;
+      gap: 6px;
+      padding: 10px 20px;
+      background: linear-gradient(135deg, #10b981 0%, #059669 100%);
+      color: white;
+      border-radius: 8px;
+      font-weight: 600;
+      box-shadow: 0 2px 8px rgba(16, 185, 129, 0.3);
+
+      .icon {
+        font-size: 1.2em;
+      }
+    }
+
+    .login-to-buy {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      padding: 10px 20px;
+      background: linear-gradient(135deg, #6366f1 0%, #4f46e5 100%);
+      color: white;
+      border-radius: 8px;
+      font-weight: 600;
+      text-decoration: none;
+      transition: all 0.2s ease;
+      box-shadow: 0 2px 8px rgba(99, 102, 241, 0.3);
+
+      &:hover {
+        transform: translateY(-2px);
+        box-shadow: 0 4px 12px rgba(99, 102, 241, 0.4);
+      }
+    }
+
+    .buy-button {
+      background: linear-gradient(135deg, #2563eb 0%, #1d4ed8 100%);
+      color: white;
+      border: none;
+      padding: 10px 20px;
+      border-radius: 8px;
+      cursor: pointer;
+      font-weight: 600;
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      transition: all 0.2s ease;
+      box-shadow: 0 2px 8px rgba(37, 99, 235, 0.3);
+
+      &:hover {
+        transform: translateY(-2px);
+        box-shadow: 0 4px 12px rgba(37, 99, 235, 0.4);
+      }
+
+      &:active {
+        transform: translateY(0);
+      }
+
+      &:disabled {
+        opacity: 0.7;
+        cursor: not-allowed;
+        transform: none;
+      }
     }
   }
 
diff --git a/client/pages/registerUser/index.js b/client/pages/registerUser/index.js
index a58ab23..5e5cc9b 100644
--- a/client/pages/registerUser/index.js
+++ b/client/pages/registerUser/index.js
@@ -53,11 +53,9 @@ export default async function registerUser({ mode, redirect }) {
 
         <Input value={user.github} type='text' name='github' label='Github' placeholder='e.g. johndoe' />
         <Input value={user.website} type='url' name='website' label='Website' placeholder='e.g. https://john.dev' />
-        {mode === 'edit' ? (
-          <a href='/change-password'>Change password</a>
-        ) : (
-          <Input type='password' name='password' label='Password' placeholder='password' />
-        )}
+        {mode === 'edit'
+          ? <a href='/change-password'>Change password</a>
+          : <Input type='password' name='password' label='Password' placeholder='password' />}
 
         <div className='error'>{errorText}</div>
         <div className='success'>{successText}</div>
diff --git a/client/pages/user/index.js b/client/pages/user/index.js
index 07448ab..8c9577a 100644
--- a/client/pages/user/index.js
+++ b/client/pages/user/index.js
@@ -69,22 +69,18 @@ export default async function User({ userId }) {
               </div>
             </div>
           </h1>
-          {shouldShowSensitiveInfo ? (
-            <small className='link earnings' title='Your earnings for this month'>
-              <strong className='loading' ref={amount} />|<span>{moment().format('YYYY MMMM')}</span>
-            </small>
-          ) : (
-            ''
-          )}
+          {shouldShowSensitiveInfo
+            ? <small className='link earnings' title='Your earnings for this month'>
+                <strong className='loading' ref={amount} />|<span>{moment().format('YYYY MMMM')}</span>
+              </small>
+            : ''}
           <div onwheel={onwheel} ref={paymentMethods} className='payment-methods'>
-            {isSelf ? (
-              <div onclick={addPaymentMethod} className='add-payment-method' title='Add payment method to get paid.'>
-                <span className='icon add' />
-                <span>Payment method</span>
-              </div>
-            ) : (
-              ''
-            )}
+            {isSelf
+              ? <div onclick={addPaymentMethod} className='add-payment-method' title='Add payment method to get paid.'>
+                  <span className='icon add' />
+                  <span>Payment method</span>
+                </div>
+              : ''}
           </div>
           <div className='socials' onclick={(e) => e.target.dataset.href && Router.loadUrl(e.target.dataset.href)}>
             <button type='button' title='email' className='icon mail' data-href={`mailto:${user.email}`} />
diff --git a/package.json b/package.json
index 18c09c8..d52cce2 100644
--- a/package.json
+++ b/package.json
@@ -56,6 +56,7 @@
     "marked": "^16.1.2",
     "moment": "^2.30.1",
     "nodemailer": "^7.0.7",
+    "razorpay": "^2.9.6",
     "sqlite3": "^5.1.7"
   },
   "scripts": {
@@ -66,7 +67,8 @@
     "update-schema": "node ./updateSchema",
     "start": "node ./server/main",
     "sitemap": "node dev/generateSitemap.js",
-    "reports": "node ./server/reportsCli"
+    "reports": "node ./server/reportsCli",
+    "migrate": "node ./server/migrations/add_purchase_order_columns.js"
   },
   "browserslist": [
     "> 0.25%, not dead"
diff --git a/server/apis/plugin.js b/server/apis/plugin.js
index e407b80..c2e756e 100644
--- a/server/apis/plugin.js
+++ b/server/apis/plugin.js
@@ -60,7 +60,57 @@ router.get('/download/:id', async (req, res) => {
 
     const clientIp = req.headers['x-forwarded-for'] || req.ip;
 
+    /**
+     * Helper function to record plugin download
+     * @param {string} pkgName - Package name (or 'web' for web downloads)
+     */
+    async function recordDownload(pkgName) {
+      try {
+        if (!device || !clientIp || !pkgName) return;
+        const columns = [
+          [Download.PLUGIN_ID, id],
+          [Download.DEVICE_ID, device],
+          [Download.CLIENT_IP, clientIp],
+          [Download.PACKAGE_NAME, pkgName],
+        ];
+        const deviceCountOnIp = await Download.count([
+          [Download.CLIENT_IP, clientIp],
+          [Download.PLUGIN_ID, id],
+        ]);
+        if (deviceCountOnIp < 5) {
+          const [download] = await Download.get([
+            [Download.PLUGIN_ID, id],
+            [Download.DEVICE_ID, device],
+          ]);
+          if (!download) {
+            await Download.insert(...columns);
+            await Plugin.increment(Plugin.DOWNLOADS, 1, [Plugin.ID, id]);
+          }
+        }
+      } catch (error) {
+        console.error('Failed to record download:', error);
+      }
+    }
+
     if (row.price) {
+      const loggedInUser = await getLoggedInUser(req);
+
+      // Check for user-linked purchase (Razorpay or any provider)
+      if (loggedInUser) {
+        const [userOrder] = await Order.get([
+          [Order.USER_ID, loggedInUser.id],
+          [Order.PLUGIN_ID, row.id],
+          [Order.STATE, Order.STATE_PURCHASED],
+        ]);
+        if (userOrder) {
+          // User has valid purchase, allow download
+          res.sendFile(path.resolve(__dirname, '../../data/plugins', `${id}.zip`));
+          await recordDownload(packageName || 'web');
+          return;
+        }
+      }
+
+      // Fall back to token-based validation (Google Play)
       if (!token || !packageName) {
         res.status(403).send({ error: 'Forbidden' });
         return;
@@ -102,33 +152,7 @@ router.get('/download/:id', async (req, res) => {
     }
 
     res.sendFile(path.resolve(__dirname, '../../data/plugins', `${id}.zip`));
-    try {
-      if (device && clientIp && packageName) {
-        const columns = [
-          [Download.PLUGIN_ID, id],
-          [Download.DEVICE_ID, device],
-          [Download.CLIENT_IP, clientIp],
-          [Download.PACKAGE_NAME, packageName],
-        ];
-        const deviceCountOnIp = await Download.count([
-          [Download.CLIENT_IP, clientIp],
-          [Download.PLUGIN_ID, id],
-        ]);
-        if (deviceCountOnIp < 5) {
-          const [download] = await Download.get([
-            [Download.PLUGIN_ID, id],
-            [Download.DEVICE_ID, device],
-          ]);
-          if (!download) {
-            await Download.insert(...columns);
-            await Plugin.increment(Plugin.DOWNLOADS, 1, [Plugin.ID, id]);
-          }
-        }
-      }
-    } catch (error) {
-      // eslint-disable-next-line no-console
-      console.error(error);
-    }
+    await recordDownload(packageName);
   } catch (error) {
     res.status(500).send({ error: error.message });
   }
@@ -306,6 +330,7 @@ router.post('/refund', async (_req, res) => {
 
 router.post('/order', async (req, res) => {
   try {
+    const loggedInUser = await getLoggedInUser(req);
     const { id, token, package: packageName } = req.body;
     const [plugin] = await Plugin.get([Plugin.ID, id]);
     if (!plugin) {
@@ -333,13 +358,19 @@ router.post('/order', async (req, res) => {
 
       const [{ price }] = await Plugin.get([Plugin.PRICE], [Plugin.ID, id]);
 
-      await Order.insert(
+      const orderInsert = [
         [Order.PLUGIN_ID, id],
         [Order.TOKEN, token],
         [Order.PACKAGE, packageName],
         [Order.AMOUNT, price],
         [Order.STATE, purchase.data.purchaseState],
-      );
+        [Order.PROVIDER, Order.PROVIDER_GOOGLE_PLAY],
+      ];
+      // Link to user account if logged in (enables cross-platform sync)
+      if (loggedInUser) {
+        orderInsert.push([Order.USER_ID, loggedInUser.id]);
+      }
+      await Order.insert(...orderInsert);
       res.send({ success: 'Order saved.' });
     } catch (error) {
       const message = `Error while validating purchase: ${error.errors?.map((e) => e.message).join(', ') || error.message}`;
@@ -853,8 +884,9 @@ async function registerSKU(name, id, price) {
         autoConvertMissingPrices: true,
       });
     } catch (error) {
-      const message = error.errors?.map(({ message: msg }) => msg).join('\n');
-      throw new Error(`Failed to register SKU, ${message}`);
+      const message = error.errors?.map(({ message: msg }) => msg).join('\n') || error.message;
+      console.warn(`Failed to register SKU for ${packageName}, ${message}`);
+      // Proceed without throwing, to allow Razorpay-only or local testing
     }
   }
 }
diff --git a/server/apis/razorpay.js b/server/apis/razorpay.js
new file mode 100644
index 0000000..5aa8505
--- /dev/null
+++ b/server/apis/razorpay.js
@@ -0,0 +1,399 @@
+const crypto = require('node:crypto');
+const { Router } = require('express');
+const Razorpay = require('razorpay');
+const Plugin = require('../entities/plugin');
+const Order = require('../entities/purchaseOrder');
+const { getLoggedInUser } = require('../lib/helpers');
+
+const router = Router();
+
+// Lazy initialization of Razorpay instance
+let razorpayInstance = null;
+function getRazorpay() {
+  if (!razorpayInstance) {
+    const keyId = process.env.PG_KEY_ID;
+    const keySecret = process.env.PG_KEY_SECRET;
+
+    if (!keyId || !keySecret) {
+      throw new Error('Razorpay API keys not configured');
+    }
+
+    razorpayInstance = new Razorpay({
+      key_id: keyId,
+      key_secret: keySecret,
+    });
+  }
+  return razorpayInstance;
+}
+
+/**
+ * Create a Razorpay order for a plugin purchase
+ * POST /api/razorpay/create-order
+ * Body: { pluginId: string }
+ */
+router.post('/create-order', async (req, res) => {
+  try {
+    const user = await getLoggedInUser(req);
+    if (!user) {
+      res.status(401).send({ error: 'Please log in to purchase plugins' });
+      return;
+    }
+
+    const { pluginId } = req.body;
+    if (!pluginId) {
+      res.status(400).send({ error: 'Plugin ID is required' });
+      return;
+    }
+
+    const [plugin] = await Plugin.get([Plugin.ID, pluginId]);
+    if (!plugin) {
+      res.status(404).send({ error: 'Plugin not found' });
+      return;
+    }
+
+    if (!plugin.price || plugin.price <= 0) {
+      res.status(400).send({ error: 'This plugin is free' });
+      return;
+    }
+
+    // Check if user already owns this plugin
+    const [existingOrder] = await Order.get([
+      [Order.USER_ID, user.id],
+      [Order.PLUGIN_ID, plugin.id],
+      [Order.STATE, Order.STATE_PURCHASED],
+    ]);
+
+    if (existingOrder) {
+      res.status(400).send({ error: 'You already own this plugin' });
+      return;
+    }
+
+    // Create Razorpay order (amount in paise)
+    const order = await getRazorpay().orders.create({
+      amount: Math.round(plugin.price * 100),
+      currency: 'INR',
+      receipt: `plugin_${plugin.id}_${user.id}_${Date.now()}`,
+      notes: {
+        pluginId: plugin.id,
+        pluginName: plugin.name,
+        userId: user.id,
+        userEmail: user.email,
+      },
+    });
+
+    res.send({
+      orderId: order.id,
+      amount: order.amount,
+      currency: order.currency,
+      keyId: process.env.PG_KEY_ID,
+      pluginName: plugin.name,
+      pluginId: plugin.id,
+      userEmail: user.email,
+    });
+  } catch (error) {
+    console.error('Razorpay create order error:', error);
+    res.status(500).send({ error: 'Failed to create order' });
+  }
+});
+
+/**
+ * Verify Razorpay payment and create purchase record
+ * POST /api/razorpay/verify
+ * Body: { razorpay_order_id, razorpay_payment_id, razorpay_signature, pluginId }
+ */
+router.post('/verify', async (req, res) => {
+  try {
+    const user = await getLoggedInUser(req);
+    if (!user) {
+      res.status(401).send({ error: 'Unauthorized' });
+      return;
+    }
+
+    const { razorpay_order_id, razorpay_payment_id, razorpay_signature, pluginId } = req.body;
+
+    if (!razorpay_order_id || !razorpay_payment_id || !razorpay_signature || !pluginId) {
+      res.status(400).send({ error: 'Missing required fields' });
+      return;
+    }
+
+    // Verify signature
+    const generatedSignature = crypto
+      .createHmac('sha256', process.env.PG_KEY_SECRET)
+      .update(`${razorpay_order_id}|${razorpay_payment_id}`)
+      .digest('hex');
+
+    if (generatedSignature !== razorpay_signature) {
+      res.status(400).send({ error: 'Invalid payment signature' });
+      return;
+    }
+
+    const [plugin] = await Plugin.get([Plugin.ID, pluginId]);
+    if (!plugin) {
+      res.status(404).send({ error: 'Plugin not found' });
+      return;
+    }
+
+    // Check if order already exists (avoid duplicates)
+    const [existingOrder] = await Order.get([Order.ORDER_ID, razorpay_order_id]);
+    if (existingOrder) {
+      res.send({ success: true, message: 'Order already recorded' });
+      return;
+    }
+
+    // Create purchase order record
+    await Order.insert(
+      [Order.PLUGIN_ID, plugin.id],
+      [Order.TOKEN, razorpay_payment_id],
+      [Order.ORDER_ID, razorpay_order_id],
+      [Order.PACKAGE, 'web'],
+      [Order.AMOUNT, plugin.price],
+      [Order.STATE, Order.STATE_PURCHASED],
+      [Order.USER_ID, user.id],
+      [Order.PROVIDER, Order.PROVIDER_RAZORPAY],
+    );
+
+    res.send({ success: true, message: 'Payment verified and purchase recorded' });
+  } catch (error) {
+    console.error('Razorpay verify error:', error);
+    res.status(500).send({ error: 'Failed to verify payment' });
+  }
+});
+
+/**
+ * Check if user owns a plugin
+ * GET /api/razorpay/check-ownership/:pluginId
+ */
+router.get('/check-ownership/:pluginId', async (req, res) => {
+  try {
+    const user = await getLoggedInUser(req);
+    if (!user) {
+      res.send({ owned: false });
+      return;
+    }
+
+    const { pluginId } = req.params;
+    const [order] = await Order.get([
+      [Order.USER_ID, user.id],
+      [Order.PLUGIN_ID, pluginId],
+      [Order.STATE, Order.STATE_PURCHASED],
+    ]);
+
+    res.send({ owned: !!order });
+  } catch (error) {
+    console.error('Check ownership error:', error);
+    res.status(500).send({ error: 'Failed to check ownership' });
+  }
+});
+
+/**
+ * Get user's purchased plugins with full details
+ * GET /api/razorpay/my-purchases
+ *
+ * For web: Uses session cookie
+ * For app: Pass ?token=auth_token query param
+ *
+ * Returns array of purchased plugins with full plugin info
+ */
+router.get('/my-purchases', async (req, res) => {
+  try {
+    const user = await getLoggedInUser(req);
+    if (!user) {
+      res.status(401).send({ error: 'Unauthorized' });
+      return;
+    }
+
+    // Get all purchased orders for user
+    const orders = await Order.get(
+      [Order.PLUGIN_ID, Order.AMOUNT, Order.CREATED_AT, Order.PROVIDER],
+      [
+        [Order.USER_ID, user.id],
+        [Order.STATE, Order.STATE_PURCHASED],
+      ],
+    );
+
+    // Get full plugin details for each purchase
+    const purchasedPlugins = await Promise.all(
+      orders.map(async (order) => {
+        const [plugin] = await Plugin.get([Plugin.ID, order.plugin_id]);
+        if (!plugin) return null;
+
+        return {
+          ...plugin,
+          purchasedAt: order.created_at,
+          purchaseAmount: order.amount,
+          purchaseProvider: order.provider || 'google_play',
+        };
+      }),
+    );
+
+    // Filter out nulls (deleted plugins)
+    res.send(purchasedPlugins.filter(Boolean));
+  } catch (error) {
+    console.error('My purchases error:', error);
+    res.status(500).send({ error: 'Failed to fetch purchases' });
+  }
+});
+
+/**
+ * Razorpay Webhook Handler
+ * POST /api/razorpay/webhook
+ *
+ * Handles events:
+ * - payment.captured: Payment successfully captured
+ * - payment.failed: Payment failed
+ * - order.paid: Order fully paid
+ *
+ * Configure this webhook URL in Razorpay Dashboard:
+ * Settings → Webhooks → Add New Webhook
+ * URL: https://yourdomain.com/api/razorpay/webhook
+ * Events: payment.captured, payment.failed, order.paid
+ */
+router.post('/webhook', async (req, res) => {
+  try {
+    const webhookSecret = process.env.PG_WEBHOOK_SECRET;
+    const isProduction = process.env.NODE_ENV === 'production';
+
+    // Require webhook secret in production
+    if (isProduction && !webhookSecret) {
+      console.error('Webhook secret not configured in production');
+      res.status(500).send({ error: 'Webhook not configured' });
+      return;
+    }
+
+    // req.body is a raw Buffer when using express.raw() middleware
+    const rawBody = Buffer.isBuffer(req.body) ? req.body : Buffer.from(JSON.stringify(req.body));
+
+    // Verify webhook signature using raw body
+    if (webhookSecret) {
+      const signature = req.headers['x-razorpay-signature'];
+      const expectedSignature = crypto.createHmac('sha256', webhookSecret).update(rawBody).digest('hex');
+
+      if (!signature || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature))) {
+        console.warn('Webhook signature verification failed');
+        res.status(400).send({ error: 'Invalid signature' });
+        return;
+      }
+    }
+
+    // Parse the raw body to get event data
+    const { event, payload } = JSON.parse(rawBody.toString());
+
+    switch (event) {
+      case 'payment.captured': {
+        // Payment was successfully captured
+        const payment = payload.payment.entity;
+        const orderId = payment.order_id;
+        const paymentId = payment.id;
+        const amount = Math.round(payment.amount) / 100;
+
+        // Check if order already exists
+        const [existingOrder] = await Order.get([Order.ORDER_ID, orderId]);
+
+        if (existingOrder) {
+          // Update existing order state if not already purchased
+          if (Number(existingOrder.state) !== Order.STATE_PURCHASED) {
+            await Order.update(
+              [
+                [Order.STATE, Order.STATE_PURCHASED],
+                [Order.TOKEN, paymentId],
+              ],
+              [Order.ORDER_ID, orderId],
+            );
+            console.log(`Updated order ${orderId} to PURCHASED via webhook`);
+          }
+        } else {
+          // Order doesn't exist - this can happen if callback failed
+          // We need notes from the order to get pluginId and userId
+          const notes = payment.notes || {};
+          const pluginId = notes.pluginId;
+          const userId = notes.userId;
+
+          if (pluginId && userId) {
+            const [plugin] = await Plugin.get([Plugin.ID, pluginId]);
+            if (plugin) {
+              await Order.insert(
+                [Order.PLUGIN_ID, pluginId],
+                [Order.TOKEN, paymentId],
+                [Order.ORDER_ID, orderId],
+                [Order.PACKAGE, 'web'],
+                [Order.AMOUNT, amount],
+                [Order.STATE, Order.STATE_PURCHASED],
+                [Order.USER_ID, userId],
+                [Order.PROVIDER, Order.PROVIDER_RAZORPAY],
+              );
+              console.log(`Created order for ${pluginId} via webhook (callback missed)`);
+            }
+          }
+        }
+        break;
+      }
+
+      case 'payment.failed': {
+        // Payment failed
+        const payment = payload.payment.entity;
+        const orderId = payment.order_id;
+
+        console.log(`Payment failed for order ${orderId}: ${payment.error_description}`);
+
+        // Update order state to cancelled if it exists
+        const [existingOrder] = await Order.get([Order.ORDER_ID, orderId]);
+        if (existingOrder) {
+          await Order.update([[Order.STATE, Order.STATE_CANCELED]], [Order.ORDER_ID, orderId]);
+        }
+        break;
+      }
+
+      case 'order.paid': {
+        // Order is fully paid - similar handling to payment.captured
+        const order = payload.order.entity;
+        const orderId = order.id;
+
+        const [existingOrder] = await Order.get([Order.ORDER_ID, orderId]);
+        if (existingOrder && Number(existingOrder.state) !== Order.STATE_PURCHASED) {
+          await Order.update([[Order.STATE, Order.STATE_PURCHASED]], [Order.ORDER_ID, orderId]);
+          console.log(`Order ${orderId} marked as paid via webhook`);
+        }
+        break;
+      }
+
+      default:
+        console.log(`Unhandled webhook event: ${event}`);
+    }
+
+    // Always respond 200 to acknowledge receipt
+    res.status(200).send({ status: 'ok' });
+  } catch (error) {
+    console.error('Webhook error:', error);
+    // Still respond 200 to prevent Razorpay from retrying
+    res.status(200).send({ status: 'error', message: error.message });
+  }
+});
+
+/**
+ * Fetch payment status from Razorpay API
+ * GET /api/razorpay/payment-status/:paymentId
+ */
+router.get('/payment-status/:paymentId', async (req, res) => {
+  try {
+    const user = await getLoggedInUser(req);
+    if (!user) {
+      res.status(401).send({ error: 'Unauthorized' });
+      return;
+    }
+
+    const { paymentId } = req.params;
+    const payment = await getRazorpay().payments.fetch(paymentId);
+
+    res.send({
+      status: payment.status,
+      captured: payment.status === 'captured',
+      amount: payment.amount / 100,
+      orderId: payment.order_id,
+    });
+  } catch (error) {
+    console.error('Payment status error:', error);
+    res.status(500).send({ error: 'Failed to fetch payment status' });
+  }
+});
+
+module.exports = router;
diff --git a/server/entities/purchaseOrder.js b/server/entities/purchaseOrder.js
index a417310..4d95bd0 100644
--- a/server/entities/purchaseOrder.js
+++ b/server/entities/purchaseOrder.js
@@ -8,9 +8,12 @@ const table = `CREATE TABLE IF NOT EXISTS purchase_order (
   order_id VARCHAR(255),
   token TEXT NOT NULL UNIQUE,
   state TEXT DEFAULT 2,
+  user_id INTEGER,
+  provider TEXT DEFAULT 'google_play',
   created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
   updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-  FOREIGN KEY (plugin_id) REFERENCES plugin(id)
+  FOREIGN KEY (plugin_id) REFERENCES plugin(id),
+  FOREIGN KEY (user_id) REFERENCES user(id)
 );
 
 CREATE TRIGGER IF NOT EXISTS orders_updated_at
@@ -30,17 +33,22 @@ class PurchaseOrder extends Entity {
   ORDER_ID = 'order_id';
   AMOUNT = 'amount';
   STATE = 'state';
+  USER_ID = 'user_id';
+  PROVIDER = 'provider';
 
   STATE_PURCHASED = 0;
   STATE_CANCELED = 1;
   STATE_PENDING = 2;
 
+  PROVIDER_GOOGLE_PLAY = 'google_play';
+  PROVIDER_RAZORPAY = 'razorpay';
+
   constructor() {
     super(table);
   }
 
   get minColumns() {
-    return [this.PACKAGE, this.AMOUNT, this.STATE, this.CREATED_AT, this.ORDER_ID];
+    return [this.PACKAGE, this.AMOUNT, this.STATE, this.CREATED_AT, this.ORDER_ID, this.PROVIDER];
   }
 }
 
diff --git a/server/main.js b/server/main.js
index 08eb3dd..a48564a 100644
--- a/server/main.js
+++ b/server/main.js
@@ -32,6 +32,7 @@ async function main() {
     res.header('Access-Control-Allow-Origin', 'https://localhost');
     // allow content-type
     res.header('Access-Control-Allow-Headers', 'Content-Type');
+    res.header('Access-Control-Allow-Credentials', 'true');
     next();
   });
 
@@ -43,6 +44,9 @@ async function main() {
       },
     }),
   );
+
+  // IMPORTANT: Must come before express.json() to preserve raw body for signature verification\n  app.use('/api/razorpay/webhook', express.raw({ type: 'application/json' }));
+
   app.use(
     express.json({
       limit: '50mb',
diff --git a/server/migrations/add_purchase_order_columns.js b/server/migrations/add_purchase_order_columns.js
new file mode 100644
index 0000000..890da3c
--- /dev/null
+++ b/server/migrations/add_purchase_order_columns.js
@@ -0,0 +1,56 @@
+/**
+ * Migration script to add user_id and provider columns to purchase_order table
+ * Run this script once to update existing database schema
+ *
+ * Usage: node server/migrations/add_purchase_order_columns.js
+ */
+
+const path = require('node:path');
+require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });
+const db = require('../lib/db');
+
+async function runMigration() {
+  console.log('Starting migration: Adding user_id and provider columns to purchase_order...');
+
+  const queries = [
+    // Add user_id column if it doesn't exist
+    `ALTER TABLE purchase_order ADD COLUMN user_id INTEGER REFERENCES user(id)`,
+    // Add provider column if it doesn't exist
+    `ALTER TABLE purchase_order ADD COLUMN provider TEXT DEFAULT 'google_play'`,
+  ];
+
+  for (const query of queries) {
+    try {
+      await new Promise((resolve, reject) => {
+        db.run(query, (err) => {
+          if (err) {
+            // Ignore "duplicate column name" errors
+            if (err.message.includes('duplicate column name')) {
+              console.log(`Column already exists, skipping: ${err.message}`);
+              resolve();
+            } else {
+              reject(err);
+            }
+          } else {
+            console.log(`Successfully executed: ${query}`);
+            resolve();
+          }
+        });
+      });
+    } catch (error) {
+      console.error(`Error executing query: ${error.message}`);
+      process.exit(1);
+    }
+  }
+
+  console.log('Migration completed successfully!');
+  db.close((err) => {
+    if (err) {
+      console.error('Error closing database:', err);
+      process.exit(1);
+    }
+    process.exit(0);
+  });
+}
+
+runMigration();
diff --git a/server/routes/apis.js b/server/routes/apis.js
index a5fb8ac..9e48488 100644
--- a/server/routes/apis.js
+++ b/server/routes/apis.js
@@ -13,6 +13,7 @@ apis.use(['/comments', '/comment'], require('../apis/comment'));
 apis.use('/faqs', require('../apis/faqs'));
 apis.use('/admin', require('../apis/admin'));
 apis.use(['/sponsor', '/sponsors'], require('../apis/sponsor'));
+apis.use('/razorpay', require('../apis/razorpay'));
 // apis.use('/completion', require('../apis/completion'));
 
 apis.get('/status', (_req, res) => {