Relyweb Docs

Appearance

Security ​

Payments have to be trustworthy, so the Cashfree plugin never takes a customer's — or a browser's — word for whether money moved. Every outcome is confirmed on your server against Cashfree, every incoming webhook is verified, and the gateways switch off cleanly when they shouldn't be running. This page explains the protections so you know what you're relying on.

Signature-verified webhooks ​

Cashfree notifies AcelleMail of payment and subscription events by calling your endpoint at https://YOUR_DOMAIN/cashier/cashfree/webhooks. Every webhook is signature-verified before it is acted on:

  • The plugin verifies with the endpoint-specific Webhook Secret if you set one, and otherwise falls back to your Secret Key.
  • Verified events are de-duplicated — Cashfree may retry a delivery, and the plugin's idempotent, already-settled guard ensures a retry never double-processes an order or subscription.

A webhook whose signature doesn't check out is rejected. Set up your endpoint using Configure webhooks.

Server-side outcome only ​

The plugin never trusts the browser to report a payment result. When a customer returns from Cashfree, success is confirmed by re-fetching the order from Cashfree and waiting for the signed webhook — see Direct Payment. A manipulated return URL cannot mark an unpaid invoice as paid.

Admin-gated settings ​

The Plugin Settings page (which renders your Secret Key) requires an admin login. Your credentials are not exposed to non-admins or to customers at checkout.

Open-redirect guard ​

The customer return URL is constrained to your same host / relative paths only, so a crafted return link cannot bounce a customer to an attacker-controlled site after payment.

No error leakage ​

Internal errors are logged for you, never shown to the customer. Shoppers see a short, safe message; the diagnostic detail stays in the AcelleMail log where you can read it. See Errors for the customer-facing strings.

License and plugin-state gating ​

Two switches keep the gateways from running when they shouldn't:

  • License gating — while the license is not Active, payment processing is disabled and the gateways don't appear. See Licensing.
  • Plugin-state gating — deactivating the plugin removes both Cashfree gateways from Admin → Payment Gateways; reactivating restores them. See Uninstalling.

Documentation for the Relyweb app catalogue.

© 2026 Relyweb Technologies Pvt. Ltd.