---
url: /razorpay-acellemail/features/security.md
description: >-
  How the Razorpay plugin protects payments in AcelleMail — HMAC-SHA256
  verification, server-side confirmation, admin-gated settings, and license plus
  plugin-state gating.
---

# Security

The Razorpay integration enforces a multi-layer security model to protect payment integrity, API credentials, and gateway availability.

## Every event is signature-verified

Razorpay signs the messages it sends back; the plugin verifies each with **HMAC-SHA256** before acting:

| Message | What it is |
| --- | --- |
| **Payment callbacks** | The one-time result after checkout. |
| **Subscription callbacks** | Recurring-charge results. |
| **Webhooks** | The events Razorpay posts to your site. |

Unsigned or altered messages fail verification immediately. Forged webhooks and replayed callback URLs are rejected before invoice state can change.

::: info HMAC signature verification
HMAC signatures create cryptographic digests combining payload contents and your shared secret. A verified signature guarantees origin authenticity and payload integrity.
:::

## Outcomes are confirmed server-side

The plugin queries Razorpay's API server-to-server to confirm payment status before marking invoices paid. Client-side browser payloads are never trusted in isolation.

## The settings page is admin-gated

Plugin settings are restricted to authenticated administrators. The API Key Secret is masked as a password field and is never transmitted to customer-facing client code.

## License and plugin-state gating

| Gate | Effect |
| --- | --- |
| **License gating** | Processing is disabled while the license is inactive. Until the key is **Active**, neither gateway appears in **Admin → Payment Gateways**. The check is a local background check against relyweb.co — brief outages tolerated, re-saving Settings restores it. |
| **Plugin-state gating** | Deactivating the plugin **removes both gateways**; reactivating **restores them**. When off, there is no live payment path. |

Lapsed licenses or deactivated plugins immediately halt payment processing.

## Related pages

* [Direct Payment](/razorpay-acellemail/features/direct-payment) — one-time payment verification
* [Subscriptions](/razorpay-acellemail/features/subscriptions) — mandate and renewal verification
* [Configure webhooks](/razorpay-acellemail/guides/configure-webhooks) — set the Webhook Secret to verify events
* [Licensing](/razorpay-acellemail/licensing) — how license gating works
* [Settings](/razorpay-acellemail/settings) — where the Key Secret and Webhook Secret live