Security

PhonePe for WHMCS secures transactions through multi-layered API and webhook verification:

• Zero card storage: Card and banking details are processed entirely on PhonePe's infrastructure; WHMCS never handles or stores sensitive payment data.
• Dual-layer validation: Payment outcomes are verified through SHA256 webhook authentication and direct API status checks.

OAuth2 (O-Bearer) API authentication

The module authenticates API requests via PhonePe's OAuth2 "O-Bearer" token architecture:

• Token exchange: Your Client ID and Client Secret generate short-lived, scoped access tokens.
• Credential isolation: Requests use the access token rather than exposing raw API secrets on every call.

Keep your Client Secret secret

The Client ID and Client Secret are the keys to your PhonePe account. Enter them only in Setup → Payment Gateways → PhonePe, and rotate them from the PhonePe dashboard if you ever suspect they've leaked.

Webhook authentication plus an API double-check

Payment results arrive by webhook, and each one goes through two independent gates before it can change an invoice:

• SHA256 signature verification: PhonePe sends a hash of the configured Webhook Username and Webhook Password; the gateway recomputes the hash and rejects mismatches.
• Secondary API confirmation: After signature validation, the gateway queries PhonePe's API to confirm actual order completion before updating WHMCS invoice status.

This dual verification means a spoofed or replayed notification can't fake a payment. See Webhooks for the full flow.

SSL/TLS enforced

The webhook endpoint and all API traffic run over HTTPS. A valid SSL certificate on your WHMCS domain is required — PhonePe won't deliver notifications to a non-secure endpoint, and enforced TLS keeps payment status confidential in transit.

The license gates payment processing

Payment processing is gated by your relyweb.co license status:

• Active license: Payments process normally through PhonePe checkout.
• Inactive license: Payment processing is suspended until a valid License Key is saved.
• Outage tolerance: Built-in background caching ensures brief licensing-server connection interruptions do not block in-flight checkouts.

Where the key lives

Enter your key in the License Key field under Setup → Payment Gateways → PhonePe. See Licensing for the Leased vs Lifetime models.

Automatic fee tracking

When PhonePe confirms a payment, the gateway reads the transaction fee from PhonePe's response and records it against the invoice. You get an accurate picture of what each payment actually cost without any manual reconciliation.

Related pages

• Webhooks — SHA256 auth and the API double-check
• Payment modes — redirect vs iframe
• Licensing — how the license gates payments
• Configuration — credentials and SSL