Skip to content

Configure webhooks

Cashfree confirms every payment and subscription charge by calling your site back — a webhook. This is how the plugin knows a payment truly succeeded, because the customer's browser is never trusted. You register one endpoint in the Cashfree Dashboard, on both the Payment Gateway and Subscriptions tabs, and whitelist Cashfree's servers so their calls get through.

Your endpoint URL

The plugin listens at:

https://YOUR_DOMAIN/cashier/cashfree/webhooks

Replace YOUR_DOMAIN with your live AcelleMail domain. The exact URL and the IP list below are also shown on Admin → Plugins → Cashfree → Settings under Webhook Configuration, so you can copy them straight from there.

The webhook details on the settings pageAdmin → Plugins → Cashfree → Settings → Webhook Configuration

Step 1 — Add the endpoint on both tabs

In the Cashfree Dashboard go to Developers → Webhooks. Add the same endpoint URL on both:

  • the Payment Gateway tab, and
  • the Subscriptions tab.

For each, set the webhook version to 2025-01-01 — this version adds an x-idempotency-key header so Cashfree's retries are handled safely without double-processing.

Step 2 — Subscribe to the events

Enable these events on the matching tab:

Payment Gateway tab

  • PAYMENT_SUCCESS_WEBHOOK
  • PAYMENT_FAILED_WEBHOOK
  • PAYMENT_USER_DROPPED_WEBHOOK

Subscriptions tab

  • SUBSCRIPTION_STATUS_CHANGED
  • SUBSCRIPTION_PAYMENT_SUCCESS
  • SUBSCRIPTION_PAYMENT_FAILED
  • SUBSCRIPTION_REFUND_STATUS

Step 3 — Whitelist Cashfree's IPs

If your firewall filters inbound traffic, allow Cashfree's servers on port 443:

  • Sandbox: 52.66.25.127, 15.206.45.168
  • Production: 52.66.101.190, 3.109.102.144, 18.60.134.245, 18.60.183.142

Step 4 — Whitelist your production domain

Before you go live, add your production domain in Cashfree Dashboard → Developers → Domain settings. Otherwise Cashfree's checkout JS SDK rejects the checkout on your live site.

How verification works

Every incoming webhook is signature-verified — the plugin checks the endpoint-specific Webhook Secret first, then falls back to your Secret Key. Duplicate deliveries are de-duplicated, so retries never double-charge or double-mark an invoice.

Documentation for the Relyweb app catalogue.