---
url: /phonepe-whmcs/features/webhooks.md
description: >-
  How PhonePe notifies WHMCS of a payment — the module webhook URL, SHA256
  username/password authentication, and a secondary API status check for dual
  verification.
---

# Webhooks

PhonePe delivers real-time transaction results directly to WHMCS via **webhooks**. Invoices update automatically even if customers close their browser before redirecting back. Every incoming webhook undergoes SHA256 authentication and a secondary API status confirmation before updating invoice records.

## The module webhook URL

Register this endpoint in the PhonePe dashboard:

```
https://yourdomain.com/modules/gateways/phonepe/webhook.php
```

Replace `yourdomain.com` with your WHMCS domain. It **must be reachable over HTTPS** — PhonePe only delivers to a valid SSL endpoint.

## How verification works

Two independent checks run on every notification:

1. **SHA256 signature authentication:** PhonePe transmits a SHA256 hash generated from your webhook credentials. The gateway recomputes the hash using the stored **Webhook Username** and **Webhook Password** via `hash_equals`. On mismatch, it halts with **401** *"Unauthorized Access"*.
2. **Secondary API status check:** Following successful signature verification, the gateway calls PhonePe's API to confirm authoritative order status. Once confirmed, WHMCS marks the invoice Paid and logs the transaction fee. On API failure, it returns **500** *"API Error"*.

A processed notification returns **HTTP 200**. Because both checks must pass, a forged or replayed webhook can't mark an invoice paid on its own.

| HTTP status | Body | Condition |
| --- | --- | --- |
| **401** | *"Unauthorized Access"* | SHA256 auth (`hash_equals`) mismatch |
| **500** | *"API Error"* | Secondary PhonePe status check failed |
| **200** | — | Authenticated and confirmed; invoice marked Paid |

## Set the webhook in the PhonePe dashboard

1. **Enter the webhook URL** — paste the module URL above into the dashboard's webhook settings.

2. **Choose a username and password** — pick values you control; they act as the shared secret PhonePe hashes on every call.

   ![PhonePe dashboard webhook configuration](/phonepe-whmcs/img/phonepe-whmcs-webhooks-dashboard.png)
   *PhonePe Business dashboard → Webhooks*

3. **Match them in WHMCS** — enter the exact same username and password in **Webhook Username** and **Webhook Password** under **Setup → Payment Gateways → PhonePe**, then **Save Changes**.

::: warning Credentials must match exactly
Mismatched credentials cause payment recording failures:

* **Auth rejection:** Differences between dashboard and gateway credentials fail SHA256 validation (returning `401`).
* **Invoice status:** Payments succeed on PhonePe but WHMCS invoices remain unpaid until credentials match.
  :::

## Related pages

* [Payment modes](/phonepe-whmcs/features/payment-modes) — redirect vs iframe
* [Security](/phonepe-whmcs/features/security) — auth, SSL, and license gating
* [PhonePe setup](/phonepe-whmcs/guides/phonepe-setup) — credentials and webhook
* [Configuration](/phonepe-whmcs/configuration) — the gateway settings