Appearance
Security
Handling payments means handling trust. This gateway is built so that a payment is only ever marked paid when Zoho itself confirms it, credentials are kept fresh automatically, and no forged message can slip through. Here's what protects you and your customers, and why each piece matters.
OAuth2 with automatic token refresh
The gateway connects to Zoho using OAuth2 rather than a static password. You authorise it once during setup and paste in a refresh token; from then on the gateway obtains short-lived access tokens as needed and refreshes them automatically in the background.
Why OAuth2?
Short-lived tokens mean that even if one is exposed it expires quickly, and you can revoke access in Zoho without changing anything else. You never store a long-lived password in WHMCS.
You only revisit this if you deliberately revoke access in Zoho — then re-generate the refresh token as shown in the Zoho OAuth setup guide.
Payments are verified, not trusted
A browser can be tampered with, so the gateway never accepts an on-screen "success" at face value. Every payment is confirmed two ways:
- API verification — after the widget checkout, WHMCS asks the Zoho API whether the payment really succeeded before marking the invoice Paid.
- HMAC-SHA256 webhook verification — every incoming webhook is checked against your Webhook Secret using HMAC-SHA256, then re-verified against the Zoho API.
Together these make it effectively impossible to fake a paid invoice by editing a page or replaying a webhook.
What is HMAC-SHA256?
It's a signature computed from the message and a shared secret. Only someone who knows your Webhook Secret can produce a valid signature, so WHMCS can tell a genuine Zoho message from a forged one.
SSL/TLS is enforced
All communication with Zoho — and the webhook endpoint Zoho calls — runs over SSL/TLS. A valid HTTPS certificate on your WHMCS domain is required for the webhook to work at all, which also keeps customer traffic encrypted end to end.
The license protects in-progress payments
The license gates the start of new payments, but it never abandons a payment already underway:
- New payments blocked — while the license is inactive, the customer sees "Online payment is temporarily unavailable. Please contact us to complete your order." and no new charge begins.
- In-progress payments still recorded — if the customer already paid at Zoho, that payment is still verified and recorded, even while the license is inactive. Nobody pays and loses their invoice.
Renew or re-enter your key to restore new payments. See Licensing for details.
Automatic fee tracking
When a payment is recorded, the gateway also stores the processing fee Zoho reports for that transaction. Your WHMCS figures reflect what actually landed in your account, with no manual reconciliation.