---
url: /phonepe-whmcs/features/webhooks.md
description: >-
  How PhonePe notifies WHMCS of a payment — the module webhook URL, SHA256
  username/password authentication, and a secondary API status check for dual
  verification.
---

# Webhooks

A **webhook** is a message PhonePe sends to your site the moment a payment finishes. Instead of
waiting for the customer's browser to come back, PhonePe calls a URL on your server directly and
says "this order was paid" (or failed). This is what lets an invoice be marked **Paid** reliably,
even if the customer closes their browser right after paying.

PhonePe for WHMCS doesn't take a webhook at face value. Every incoming webhook is
**authenticated**, and then the gateway makes a **second, independent call** to PhonePe's API to
confirm the real status before touching the invoice. That double-check is what protects you from a
spoofed or replayed notification.

## The module webhook URL

The webhook endpoint that ships with the module is:

```
https://yourdomain.com/modules/gateways/phonepe/webhook.php
```

Replace `yourdomain.com` with your WHMCS domain. This URL **must be reachable over HTTPS** — PhonePe
will only deliver to a valid SSL endpoint, and the address is what you register in the PhonePe
dashboard (below).

::: info Why HTTPS matters
The webhook carries payment status. A valid SSL certificate on the domain is required both so
PhonePe will deliver to it and so the notification can't be read or tampered with in transit.
:::

## How verification works (dual verification)

There are two independent checks on every notification:

1. **SHA256 username/password authentication.** In the PhonePe dashboard you set a **username** and
   **password** for the webhook. PhonePe sends a SHA256 hash of those credentials with each call.
   The handler recomputes the hash from the **Webhook Username** and **Webhook Password** you saved
   in the WHMCS gateway config and rejects the request if they don't match. This proves the message
   really came from your PhonePe account.
2. **Secondary API status check.** Even after the auth passes, the gateway calls PhonePe's API to
   fetch the *authoritative* status of that order. Only if the API confirms the payment does the
   invoice get marked paid and the transaction fee recorded.

Because both checks must pass, a forged or replayed webhook can't mark an invoice as paid on its
own.

## Setting the webhook in the PhonePe dashboard

In the PhonePe Merchant (Business) dashboard, open the webhook settings and:

### 1. Enter the webhook URL

Paste your module webhook URL:

```
https://yourdomain.com/modules/gateways/phonepe/webhook.php
```

### 2. Choose a username and password

Set a **username** and **password** for the webhook. Pick values you control — they act as the
shared secret PhonePe hashes on every call.

![PhonePe dashboard webhook configuration](/phonepe-whmcs/img/phonepe-whmcs-webhooks-dashboard.png)
*PhonePe Business dashboard → Webhooks*

### 3. Match them in WHMCS

Enter the **exact same** username and password in **Webhook Username** and **Webhook Password**
under **Setup → Payment Gateways → PhonePe**, then **Save Changes**.

::: warning They must match exactly
If the username or password differs between the PhonePe dashboard and the WHMCS gateway config, the
SHA256 check fails and PhonePe's notifications are rejected — a rejected webhook usually shows as a
`401` in the flow. Payments may still complete at PhonePe but won't be recorded until the values
match.
:::

## Related pages

* [Payment modes](/phonepe-whmcs/features/payment-modes) — redirect vs iframe
* [Security](/phonepe-whmcs/features/security) — auth, SSL, and license gating
* [PhonePe setup](/phonepe-whmcs/guides/phonepe-setup) — credentials and webhook
* [Configuration](/phonepe-whmcs/configuration) — the gateway settings