Webhooks

PhonePe delivers real-time transaction results directly to WHMCS via webhooks. Invoices update automatically even if customers close their browser before redirecting back. Every incoming webhook undergoes SHA256 authentication and a secondary API status confirmation before updating invoice records.

The module webhook URL

Register this endpoint in the PhonePe dashboard:

https://yourdomain.com/modules/gateways/phonepe/webhook.php

Replace yourdomain.com with your WHMCS domain. It must be reachable over HTTPS — PhonePe only delivers to a valid SSL endpoint.

How verification works

Two independent checks run on every notification:

1. SHA256 signature authentication: PhonePe transmits a SHA256 hash generated from your webhook credentials. The gateway recomputes the hash using the stored Webhook Username and Webhook Password via hash_equals. On mismatch, it halts with 401 "Unauthorized Access".
2. Secondary API status check: Following successful signature verification, the gateway calls PhonePe's API to confirm authoritative order status. Once confirmed, WHMCS marks the invoice Paid and logs the transaction fee. On API failure, it returns 500 "API Error".

A processed notification returns HTTP 200. Because both checks must pass, a forged or replayed webhook can't mark an invoice paid on its own.

HTTP status	Body	Condition
401	"Unauthorized Access"	SHA256 auth (hash_equals) mismatch
500	"API Error"	Secondary PhonePe status check failed
200	—	Authenticated and confirmed; invoice marked Paid

Set the webhook in the PhonePe dashboard

1. Enter the webhook URL — paste the module URL above into the dashboard's webhook settings.

2. Choose a username and password — pick values you control; they act as the shared secret PhonePe hashes on every call.

   PhonePe Business dashboard → Webhooks

3. Match them in WHMCS — enter the exact same username and password in Webhook Username and Webhook Password under Setup → Payment Gateways → PhonePe, then Save Changes.

Credentials must match exactly

Mismatched credentials cause payment recording failures:

• Auth rejection: Differences between dashboard and gateway credentials fail SHA256 validation (returning 401).
• Invoice status: Payments succeed on PhonePe but WHMCS invoices remain unpaid until credentials match.

Related pages

• Payment modes — redirect vs iframe
• Security — auth, SSL, and license gating
• PhonePe setup — credentials and webhook
• Configuration — the gateway settings