---
url: /zoho-payments-whmcs/features/security.md
description: >-
  How Zoho Payments for WHMCS protects payments — OAuth2 with automatic token
  refresh, HMAC-verified webhooks, API-based verification, enforced SSL, and
  license-safe handling of in-progress payments.
---

# Security

Handling payments means handling trust. This gateway is built so that a payment is only ever
marked paid when Zoho itself confirms it, credentials are kept fresh automatically, and no forged
message can slip through. Here's what protects you and your customers, and why each piece matters.

## OAuth2 with automatic token refresh

The gateway connects to Zoho using **OAuth2** rather than a static password. You authorise it once
during setup and paste in a **refresh token**; from then on the gateway obtains short-lived access
tokens as needed and **refreshes them automatically** in the background.

::: info Why OAuth2?
Short-lived tokens mean that even if one is exposed it expires quickly, and you can revoke access
in Zoho without changing anything else. You never store a long-lived password in WHMCS.
:::

You only revisit this if you deliberately revoke access in Zoho — then re-generate the refresh
token as shown in the [Zoho OAuth setup guide](/zoho-payments-whmcs/guides/zoho-oauth).

## Payments are verified, not trusted

A browser can be tampered with, so the gateway never accepts an on-screen "success" at face value.
Every payment is confirmed two ways:

* **API verification** — after the [widget checkout](/zoho-payments-whmcs/features/widget-checkout),
  WHMCS asks the **Zoho API** whether the payment really succeeded before marking the invoice Paid.
* **HMAC-SHA256 webhook verification** — every incoming
  [webhook](/zoho-payments-whmcs/features/webhooks-and-payment-links) is checked against your
  **Webhook Secret** using **HMAC-SHA256**, then re-verified against the Zoho API.

Together these make it effectively impossible to fake a paid invoice by editing a page or replaying
a webhook.

::: info What is HMAC-SHA256?
It's a signature computed from the message and a shared secret. Only someone who knows your Webhook
Secret can produce a valid signature, so WHMCS can tell a genuine Zoho message from a forged one.
:::

## SSL/TLS is enforced

All communication with Zoho — and the webhook endpoint Zoho calls — runs over **SSL/TLS**. A valid
HTTPS certificate on your WHMCS domain is required for the webhook to work at all, which also keeps
customer traffic encrypted end to end.

## The license protects in-progress payments

The license gates the start of **new** payments, but it never abandons a payment already underway:

* **New payments blocked** — while the license is inactive, the customer sees *"Online payment is
  temporarily unavailable. Please contact us to complete your order."* and no new charge begins.
* **In-progress payments still recorded** — if the customer already paid at Zoho, that payment is
  still verified and recorded, even while the license is inactive. Nobody pays and loses their
  invoice.

Renew or re-enter your key to restore new payments. See [Licensing](/zoho-payments-whmcs/licensing)
for details.

## Automatic fee tracking

When a payment is recorded, the gateway also stores the **processing fee** Zoho reports for that
transaction. Your WHMCS figures reflect what actually landed in your account, with no manual
reconciliation.

## Related pages

* [Widget checkout](/zoho-payments-whmcs/features/widget-checkout)
* [Webhooks and Payment Links](/zoho-payments-whmcs/features/webhooks-and-payment-links)
* [Zoho OAuth setup](/zoho-payments-whmcs/guides/zoho-oauth)
* [Licensing](/zoho-payments-whmcs/licensing)