---
url: /razorpay-acellemail/features/security.md
description: >-
  How the Razorpay plugin protects payments in AcelleMail — HMAC-SHA256
  verification, server-side confirmation, admin-gated settings, and license plus
  plugin-state gating.
---

# Security

Money changing hands deserves more than a trusting browser. This plugin is built so a payment is only
credited when it can be *proven* genuine, so your settings can't leak, and so the gateways simply
aren't available unless they should be. Here's how each layer works and why it matters to you.

## Every event is signature-verified

Razorpay signs the messages it sends back — the payment callback after checkout, the subscription
callbacks for recurring charges, and the webhooks that report events. The plugin verifies each one with
**HMAC-SHA256** before acting on it:

* **Payment callbacks** — the one-time result after checkout.
* **Subscription callbacks** — recurring-charge results.
* **Webhooks** — the events Razorpay posts to your site.

If a message is **unsigned or tampered with, it is rejected**. A replayed success URL or a forged
webhook simply doesn't pass, so no invoice is marked paid on a fake signal.

::: info What HMAC verification is
An HMAC signature is a fingerprint computed from the message *and* a shared secret. Only Razorpay and
your server know the secret, so a matching signature proves the message really came from Razorpay and
wasn't altered on the way.
:::

## Outcomes are confirmed server-side

Even a correctly signed browser callback isn't the final word. The plugin **confirms the outcome
server-side** with Razorpay before crediting anything — **client callbacks are never trusted** on their
own. This closes the gap between "the browser says it succeeded" and "the payment truly settled."

## The settings page is admin-gated

The settings page renders your **API Key Secret**, so it is **admin-gated** — it requires an admin
login to open. Your Key Secret is entered as a password field and never exposed in client-side code, so
day-to-day users and customers can't reach your credentials.

## License and plugin-state gating

Two more gates decide whether the gateways run at all:

* **License gating.** Payment processing is disabled while the license is inactive. Until the key is
  **Active**, neither Razorpay gateway appears in **Admin → Payment Gateways**. The check is a local
  background check against relyweb.co — brief outages are tolerated, and re-saving Settings restores it.
* **Plugin-state gating.** Deactivating the plugin **removes both gateways** from Payment Gateways;
  reactivating **restores them**. When the plugin is off, there is no live payment path at all.

Together these mean a lapsed license or a deactivated plugin can never quietly keep taking payments.

## Related pages

* [Direct Payment](/razorpay-acellemail/features/direct-payment) — one-time payment verification
* [Subscriptions](/razorpay-acellemail/features/subscriptions) — mandate and renewal verification
* [Configure webhooks](/razorpay-acellemail/guides/configure-webhooks) — set the Webhook Secret to verify events
* [Licensing](/razorpay-acellemail/licensing) — how license gating works
* [Settings](/razorpay-acellemail/settings) — where the Key Secret and Webhook Secret live