---
url: /phonepe-whmcs/features/security.md
description: >-
  How PhonePe for WHMCS protects payments — OAuth2 O-Bearer API auth, SHA256
  webhook authentication with a secondary API check, enforced SSL, license-gated
  processing, and automatic fee tracking.
---

# Security

Handling payments means handling trust, so it helps to know exactly how PhonePe for WHMCS keeps a
transaction honest from start to finish. Nothing here is something you have to configure by hand
beyond the credentials and SSL — but understanding the layers tells you *why* the setup steps
matter and what protects you if something looks wrong.

The module never stores card or bank details. Payment happens on PhonePe's side; your WHMCS only
ever sees the *result*, and that result is verified twice before it's trusted.

## OAuth2 (O-Bearer) API authentication

Every call the module makes to PhonePe is authenticated with **OAuth2** using PhonePe's
**"O-Bearer"** token scheme. Your **Client ID** and **Client Secret** (from the PhonePe merchant
dashboard) are exchanged for a short-lived access token, and that token authorizes each request.
Because the token is scoped and time-limited, your raw secret isn't sent on every call.

::: info Keep your Client Secret secret
The Client ID and Client Secret are the keys to your PhonePe account. Enter them only in
**Setup → Payment Gateways → PhonePe**, and rotate them from the PhonePe dashboard if you ever
suspect they've leaked.
:::

## Webhook authentication plus an API double-check

Payment results arrive by webhook, and each one goes through two independent gates before it can
change an invoice:

* **SHA256 authentication.** PhonePe hashes the **Webhook Username** and **Webhook Password** you
  configured; the handler recomputes the hash and rejects anything that doesn't match.
* **Secondary API status check.** Even after auth passes, the gateway asks PhonePe's API for the
  order's real status and only then records the payment.

This *dual verification* means a spoofed or replayed notification can't fake a payment. See
[Webhooks](/phonepe-whmcs/features/webhooks) for the full flow.

## SSL/TLS enforced

The webhook endpoint and all API traffic run over **HTTPS**. A valid SSL certificate on your WHMCS
domain is required — PhonePe won't deliver notifications to a non-secure endpoint, and enforced TLS
keeps payment status confidential in transit.

## The license gates payment processing

Payment processing is the **license-gated feature**. The gateway checks your **License Key** (from
your relyweb.co client area, entered in the gateway config) with a lightweight local check backed
by a background check. While the license is **active**, payments flow normally; if it's inactive,
**payments are disabled** until you re-activate. Brief outages are tolerated, and re-entering or
renewing the key restores processing.

::: tip Where the key lives
Enter your key in the **License Key** field under **Setup → Payment Gateways → PhonePe**. See
[Licensing](/phonepe-whmcs/licensing) for the Leased vs Lifetime models.
:::

## Automatic fee tracking

When PhonePe confirms a payment, the gateway reads the **transaction fee** from PhonePe's response
and records it against the invoice. You get an accurate picture of what each payment actually cost
without any manual reconciliation.

## Related pages

* [Webhooks](/phonepe-whmcs/features/webhooks) — SHA256 auth and the API double-check
* [Payment modes](/phonepe-whmcs/features/payment-modes) — redirect vs iframe
* [Licensing](/phonepe-whmcs/licensing) — how the license gates payments
* [Configuration](/phonepe-whmcs/configuration) — credentials and SSL