---
url: /zoho-payments-whmcs/features/security.md
description: >-
  How Zoho Payments for WHMCS protects payments — OAuth2 with automatic token
  refresh, HMAC-verified webhooks, API-based verification, enforced SSL, and
  license-safe handling of in-progress payments.
---

# Security

Zoho Payments for WHMCS incorporates multi-layered verification, token-based authentication, and cryptographic webhook validation to ensure reliable and secure transaction processing.

## OAuth2 with automatic token refresh

The gateway uses **OAuth2** for API authentication rather than static credentials:

* **One-time authorization:** Authorise the application once and save the **Refresh Token**.
* **Automatic rotation:** The gateway automatically generates short-lived access tokens as needed.
* **Zero password storage:** WHMCS never stores raw Zoho account passwords.

::: info OAuth2 security benefits
Short-lived access tokens expire quickly if intercepted, and permissions can be revoked directly in Zoho without altering other server configurations.
:::

If credentials change or access is revoked, regenerate the token using the [Zoho OAuth setup guide](/zoho-payments-whmcs/guides/zoho-oauth).

## Payments are verified, not trusted

Client-side transaction states are never trusted at face value. All transactions require server-side confirmation:

* **Direct API verification:** Following [widget checkout](/zoho-payments-whmcs/features/widget-checkout), WHMCS queries the Zoho API directly to verify settlement before marking invoices paid.
* **Cryptographic HMAC validation:** Inbound [webhooks](/zoho-payments-whmcs/features/webhooks-and-payment-links) are verified against your **Webhook Secret** using **HMAC-SHA256** signatures, then validated via API.
* **Replay prevention:** Dual validation prevents fraudulent payment confirmation from modified browser responses or replayed webhook payloads.

::: info HMAC-SHA256 signature verification
A cryptographic signature is generated using a shared secret. Only payloads signed with your exact Webhook Secret are accepted, rejecting forged or altered notifications.
:::

## SSL/TLS is enforced

All gateway communication runs exclusively over **SSL/TLS**:

* **Outbound API calls:** Encrypted HTTPS connections to Zoho endpoints.
* **Inbound webhooks:** Zoho delivers notifications only to validated HTTPS URLs.
* **Client security:** Customer invoice interactions remain encrypted end-to-end.

## The license protects in-progress payments

License validation gates new payment initialization without dropping active transactions:

* **New checkout blocking:** If a license is inactive, new checkouts are blocked with *"Online payment is temporarily unavailable. Please contact us to complete your order."*
* **In-flight protection:** If a customer completes payment at Zoho while the license is inactive, the transaction is verified and credited to the invoice normally.
* **Restoration:** Renewing or saving an active key restores new checkout functionality immediately. See [Licensing](/zoho-payments-whmcs/licensing).

## Automatic fee tracking

Upon successful payment verification, the gateway automatically logs the **gateway processing fee** reported by Zoho. WHMCS accounting balances reflect net revenue without manual adjustments.

## Related pages

* [Widget checkout](/zoho-payments-whmcs/features/widget-checkout)
* [Webhooks and Payment Links](/zoho-payments-whmcs/features/webhooks-and-payment-links)
* [Zoho OAuth setup](/zoho-payments-whmcs/guides/zoho-oauth)
* [Licensing](/zoho-payments-whmcs/licensing)