Appearance
Security
Zoho Payments for WHMCS incorporates multi-layered verification, token-based authentication, and cryptographic webhook validation to ensure reliable and secure transaction processing.
OAuth2 with automatic token refresh
The gateway uses OAuth2 for API authentication rather than static credentials:
- One-time authorization: Authorise the application once and save the Refresh Token.
- Automatic rotation: The gateway automatically generates short-lived access tokens as needed.
- Zero password storage: WHMCS never stores raw Zoho account passwords.
OAuth2 security benefits
Short-lived access tokens expire quickly if intercepted, and permissions can be revoked directly in Zoho without altering other server configurations.
If credentials change or access is revoked, regenerate the token using the Zoho OAuth setup guide.
Payments are verified, not trusted
Client-side transaction states are never trusted at face value. All transactions require server-side confirmation:
- Direct API verification: Following widget checkout, WHMCS queries the Zoho API directly to verify settlement before marking invoices paid.
- Cryptographic HMAC validation: Inbound webhooks are verified against your Webhook Secret using HMAC-SHA256 signatures, then validated via API.
- Replay prevention: Dual validation prevents fraudulent payment confirmation from modified browser responses or replayed webhook payloads.
HMAC-SHA256 signature verification
A cryptographic signature is generated using a shared secret. Only payloads signed with your exact Webhook Secret are accepted, rejecting forged or altered notifications.
SSL/TLS is enforced
All gateway communication runs exclusively over SSL/TLS:
- Outbound API calls: Encrypted HTTPS connections to Zoho endpoints.
- Inbound webhooks: Zoho delivers notifications only to validated HTTPS URLs.
- Client security: Customer invoice interactions remain encrypted end-to-end.
The license protects in-progress payments
License validation gates new payment initialization without dropping active transactions:
- New checkout blocking: If a license is inactive, new checkouts are blocked with "Online payment is temporarily unavailable. Please contact us to complete your order."
- In-flight protection: If a customer completes payment at Zoho while the license is inactive, the transaction is verified and credited to the invoice normally.
- Restoration: Renewing or saving an active key restores new checkout functionality immediately. See Licensing.
Automatic fee tracking
Upon successful payment verification, the gateway automatically logs the gateway processing fee reported by Zoho. WHMCS accounting balances reflect net revenue without manual adjustments.