Create the order, charge it (payment link or server-to-server), receive the webhook, and record the status.
1

Keep the secret key on your server

sk_test_ and sk_live_ belong in an environment variable. The browser and mobile app use the checkout URL, not the secret key.
2

Save your order first

Create the order in your database as pending, then ask ParuPay for a payment link. Amounts are in the smallest currency unit, so $10.00 is 1000.
3

Send the customer to checkout

Use checkout_url from the response. That page is ParuPay hosted checkout.
4

Update the order from the webhook

payment_intent.succeeded means paid. payment_intent.payment_failed means failed. charge.refunded means refunded. payment_intent.cancel means canceled.
Sandbox and production both use https://api.parupay.com/v1. Your sk_test_ or sk_live_ key decides the mode.

Or charge from your server

Keep the card on your PCI server. Never send the PAN or sk_ from a browser. One POST — ParuPay decides 2D or 3D from the card. Live server-to-server is enabled per approved account.
This uses the 2D sandbox card. Every test card is on Testing cards.
Continue with Pay by link, server-to-server, or try a payment link in Try the API.