Appearance
Webhooks and Payment Links
Most transactions confirm instantly through the widget checkout. For payments completed outside the live checkout session — such as Payment Links — Zoho notifies WHMCS through a signed webhook.
What is a webhook?
A message Zoho sends to your server when a payment completes, so WHMCS learns of it even when the customer isn't on the invoice page.
Why you need it
- Asynchronous payments: Payment Links collect funds outside WHMCS; webhooks notify your server to update invoice statuses automatically.
- Transaction fail-safe: Acts as a safety net if a customer closes their browser before on-page checkout callbacks finish.
Set up the webhook
Register the webhook in your Zoho Payments dashboard:
- Webhook URL:
https://yourdomain.com/modules/gateways/zohopayments/webhooks/paylink_webhook.php - Subscribed events: Payment completed and Payment Link paid
- Secret configuration: Copy Zoho's webhook secret into Setup → Payment Gateways → Zoho Payments.
Find your URL in the config
The Webhook Secret field also displays your exact Webhook URL — copy it straight from there to avoid typos.
Setup → Payment Gateways → Zoho Payments (Webhook Secret / Webhook URL)
How a Payment Link gets recorded
| Step | What happens |
|---|---|
| Customer pays | The customer completes the payment via the Zoho Payment Link |
| Zoho notifies | Zoho sends a signed webhook to your Webhook URL |
| Signature checked | WHMCS verifies the message with HMAC-SHA256 using your Webhook Secret |
| API re-verified | WHMCS also confirms the payment against the Zoho API |
| Invoice updated | The matching invoice is marked Paid, with details and fees recorded |
The double check — signature and API verification — means a forged or replayed webhook can't mark an invoice paid. See Security.
SSL required for webhooks
Zoho delivers webhooks exclusively to valid HTTPS endpoints. Ensure your Webhook URL has an active SSL certificate and the Webhook Secret matches exactly.
When something's wrong
Check the Gateway Log first (Utilities → Logs → Gateway Log). Verify that the Webhook URL is accessible, the Webhook Secret matches, and SSL is valid. See Troubleshooting.