---
url: /zoho-payments-whmcs/features/webhooks-and-payment-links.md
description: >-
  How the signed Zoho Payments webhook confirms Payment Link payments
  asynchronously, verified with HMAC-SHA256 and re-checked against the Zoho API.
---

# Webhooks and Payment Links

Most transactions confirm instantly through the [widget checkout](/zoho-payments-whmcs/features/widget-checkout). For payments completed outside the live checkout session — such as **Payment Links** — Zoho notifies WHMCS through a **signed webhook**.

::: info What is a webhook?
A message Zoho sends to your server when a payment completes, so WHMCS learns of it even when the customer isn't on the invoice page.
:::

## Why you need it

* **Asynchronous payments:** Payment Links collect funds outside WHMCS; webhooks notify your server to update invoice statuses automatically.
* **Transaction fail-safe:** Acts as a safety net if a customer closes their browser before on-page checkout callbacks finish.

## Set up the webhook

Register the webhook in your Zoho Payments dashboard:

* **Webhook URL:** `https://yourdomain.com/modules/gateways/zohopayments/webhooks/paylink_webhook.php`
* **Subscribed events:** **Payment completed** and **Payment Link paid**
* **Secret configuration:** Copy Zoho's webhook secret into **Setup → Payment Gateways → Zoho Payments**.

::: tip Find your URL in the config
The **Webhook Secret** field also displays your exact **Webhook URL** — copy it straight from there to avoid typos.
:::

![The Webhook Secret and Webhook URL in the gateway config](/zoho-payments-whmcs/img/zoho-payments-webhooks-and-payment-links-config.png)
*Setup → Payment Gateways → Zoho Payments (Webhook Secret / Webhook URL)*

## How a Payment Link gets recorded

| Step | What happens |
| --- | --- |
| **Customer pays** | The customer completes the payment via the Zoho Payment Link |
| **Zoho notifies** | Zoho sends a signed webhook to your Webhook URL |
| **Signature checked** | WHMCS verifies the message with **HMAC-SHA256** using your Webhook Secret |
| **API re-verified** | WHMCS also confirms the payment against the Zoho API |
| **Invoice updated** | The matching invoice is marked Paid, with details and fees recorded |

The double check — signature **and** API verification — means a forged or replayed webhook can't mark an invoice paid. See [Security](/zoho-payments-whmcs/features/security).

::: warning SSL required for webhooks
Zoho delivers webhooks exclusively to valid HTTPS endpoints. Ensure your **Webhook URL** has an active SSL certificate and the **Webhook Secret** matches exactly.
:::

## When something's wrong

Check the **Gateway Log** first (**Utilities → Logs → Gateway Log**). Verify that the Webhook URL is accessible, the Webhook Secret matches, and SSL is valid. See [Troubleshooting](/zoho-payments-whmcs/troubleshooting).

## Related pages

* [Widget checkout](/zoho-payments-whmcs/features/widget-checkout)
* [Security](/zoho-payments-whmcs/features/security)
* [Configuration](/zoho-payments-whmcs/configuration)
* [Troubleshooting](/zoho-payments-whmcs/troubleshooting)