Configure webhooks

Cashfree confirms payments and subscription renewals via signed webhook callbacks:

• Single endpoint: Register the identical webhook URL under both Payment Gateway and Subscriptions tabs.
• Verification: Incoming events are signature-verified to ensure only authentic Cashfree notifications advance orders.
• Firewall rules: Whitelist Cashfree IP addresses on port 443.

Prerequisites: your live AcelleMail domain and admin access to the Cashfree Dashboard.

Your endpoint URL

The plugin listens at:

https://YOUR_DOMAIN/cashier/cashfree/webhooks

Replace YOUR_DOMAIN with your live AcelleMail domain. The URL and IP list are also shown on Admin → Plugins → Cashfree → Settings under Webhook Configuration — copy them straight from there.

Admin → Plugins → Cashfree → Settings → Webhook Configuration

1. Add the endpoint on both tabs

In Cashfree Dashboard → Developers → Webhooks, set up the endpoint:

1. Add the endpoint URL under both Payment Gateway and Subscriptions tabs.
2. Set the webhook version to 2025-01-01 on each tab.
3. The 2025-01-01 format sends the x-idempotency-key header to ensure idempotent retry handling.

2. Subscribe to the events

Enable these on the matching tab. These are all the events the plugin recognises; the plugin safely ignores any it doesn't need.

Payment Gateway tab	Subscriptions tab
PAYMENT_SUCCESS_WEBHOOK	SUBSCRIPTION_STATUS_CHANGED
PAYMENT_FAILED_WEBHOOK	SUBSCRIPTION_AUTH_STATUS
PAYMENT_USER_DROPPED_WEBHOOK	SUBSCRIPTION_PAYMENT_NOTIFICATION_INITIATED
REFUND_STATUS_WEBHOOK	SUBSCRIPTION_PAYMENT_SUCCESS
	SUBSCRIPTION_PAYMENT_FAILED
	SUBSCRIPTION_PAYMENT_CANCELLED
	SUBSCRIPTION_REFUND_STATUS
	SUBSCRIPTION_CARD_EXPIRY_REMINDER

3. Whitelist Cashfree's IPs

If your firewall filters inbound traffic, allow Cashfree's servers on port 443:

Environment	IPs
Sandbox	52.66.25.127, 15.206.45.168
Production	52.66.101.190, 3.109.102.144, 18.60.134.245, 18.60.183.142

4. Whitelist your production domain

Register your production domain in Cashfree Dashboard → Developers → Domain settings to prevent Cashfree's JS SDK from blocking live checkouts.

Signature verification & idempotency

• Signature check: Verifies the endpoint-specific Webhook Secret first, falling back to your Secret Key.
• Idempotency: De-duplicates event IDs so retried payloads never double-process transactions.

Related pages

• Get your API keys
• Set up subscriptions
• Going live
• Security
• Settings reference