Security

Handling payments means handling trust, so it helps to know exactly how PhonePe for WHMCS keeps a transaction honest from start to finish. Nothing here is something you have to configure by hand beyond the credentials and SSL — but understanding the layers tells you why the setup steps matter and what protects you if something looks wrong.

The module never stores card or bank details. Payment happens on PhonePe's side; your WHMCS only ever sees the result, and that result is verified twice before it's trusted.

OAuth2 (O-Bearer) API authentication

Every call the module makes to PhonePe is authenticated with OAuth2 using PhonePe's "O-Bearer" token scheme. Your Client ID and Client Secret (from the PhonePe merchant dashboard) are exchanged for a short-lived access token, and that token authorizes each request. Because the token is scoped and time-limited, your raw secret isn't sent on every call.

Keep your Client Secret secret

The Client ID and Client Secret are the keys to your PhonePe account. Enter them only in Setup → Payment Gateways → PhonePe, and rotate them from the PhonePe dashboard if you ever suspect they've leaked.

Webhook authentication plus an API double-check

Payment results arrive by webhook, and each one goes through two independent gates before it can change an invoice:

• SHA256 authentication. PhonePe hashes the Webhook Username and Webhook Password you configured; the handler recomputes the hash and rejects anything that doesn't match.
• Secondary API status check. Even after auth passes, the gateway asks PhonePe's API for the order's real status and only then records the payment.

This dual verification means a spoofed or replayed notification can't fake a payment. See Webhooks for the full flow.

SSL/TLS enforced

The webhook endpoint and all API traffic run over HTTPS. A valid SSL certificate on your WHMCS domain is required — PhonePe won't deliver notifications to a non-secure endpoint, and enforced TLS keeps payment status confidential in transit.

The license gates payment processing

Payment processing is the license-gated feature. The gateway checks your License Key (from your relyweb.co client area, entered in the gateway config) with a lightweight local check backed by a background check. While the license is active, payments flow normally; if it's inactive, payments are disabled until you re-activate. Brief outages are tolerated, and re-entering or renewing the key restores processing.

Where the key lives

Enter your key in the License Key field under Setup → Payment Gateways → PhonePe. See Licensing for the Leased vs Lifetime models.

Automatic fee tracking

When PhonePe confirms a payment, the gateway reads the transaction fee from PhonePe's response and records it against the invoice. You get an accurate picture of what each payment actually cost without any manual reconciliation.

Related pages

• Webhooks — SHA256 auth and the API double-check
• Payment modes — redirect vs iframe
• Licensing — how the license gates payments
• Configuration — credentials and SSL