Webhooks

A webhook is a message PhonePe sends to your site the moment a payment finishes. Instead of waiting for the customer's browser to come back, PhonePe calls a URL on your server directly and says "this order was paid" (or failed). This is what lets an invoice be marked Paid reliably, even if the customer closes their browser right after paying.

PhonePe for WHMCS doesn't take a webhook at face value. Every incoming webhook is authenticated, and then the gateway makes a second, independent call to PhonePe's API to confirm the real status before touching the invoice. That double-check is what protects you from a spoofed or replayed notification.

The module webhook URL

The webhook endpoint that ships with the module is:

https://yourdomain.com/modules/gateways/phonepe/webhook.php

Replace yourdomain.com with your WHMCS domain. This URL must be reachable over HTTPS — PhonePe will only deliver to a valid SSL endpoint, and the address is what you register in the PhonePe dashboard (below).

Why HTTPS matters

The webhook carries payment status. A valid SSL certificate on the domain is required both so PhonePe will deliver to it and so the notification can't be read or tampered with in transit.

How verification works (dual verification)

There are two independent checks on every notification:

1. SHA256 username/password authentication. In the PhonePe dashboard you set a username and password for the webhook. PhonePe sends a SHA256 hash of those credentials with each call. The handler recomputes the hash from the Webhook Username and Webhook Password you saved in the WHMCS gateway config and rejects the request if they don't match. This proves the message really came from your PhonePe account.
2. Secondary API status check. Even after the auth passes, the gateway calls PhonePe's API to fetch the authoritative status of that order. Only if the API confirms the payment does the invoice get marked paid and the transaction fee recorded.

Because both checks must pass, a forged or replayed webhook can't mark an invoice as paid on its own.

Setting the webhook in the PhonePe dashboard

In the PhonePe Merchant (Business) dashboard, open the webhook settings and:

1. Enter the webhook URL

Paste your module webhook URL:

https://yourdomain.com/modules/gateways/phonepe/webhook.php

2. Choose a username and password

Set a username and password for the webhook. Pick values you control — they act as the shared secret PhonePe hashes on every call.

PhonePe Business dashboard → Webhooks

3. Match them in WHMCS

Enter the exact same username and password in Webhook Username and Webhook Password under Setup → Payment Gateways → PhonePe, then Save Changes.

They must match exactly

If the username or password differs between the PhonePe dashboard and the WHMCS gateway config, the SHA256 check fails and PhonePe's notifications are rejected — a rejected webhook usually shows as a 401 in the flow. Payments may still complete at PhonePe but won't be recorded until the values match.

Related pages

• Payment modes — redirect vs iframe
• Security — auth, SSL, and license gating
• PhonePe setup — credentials and webhook
• Configuration — the gateway settings