WHMCS Payment Gateway · v0.0.1

Accept PhonePe payments in WHMCS, the right way.

A production-grade PhonePe gateway for WHMCS built on the Standard Checkout V2 (O-Bearer OAuth2) API — UPI, cards, net banking and wallets, in redirect or iframe checkout, with SHA256-verified webhooks and automatic fee tracking.

View pricing See features

WHMCS 8.x compatible Standard Checkout V2 Redirect & iframe modes Sandbox ready

PhonePe Checkout

Acme Hosting Pvt Ltd · INR

PAYMENT

Order ID427_INV2026

MethodUPI · GPay

ModeStandard V2

StatusCOMPLETED

Google Paycustomer@okbank

Web Hosting — Pro (Annual)₹ 10,605.84

PhonePe fee (incl. GST)₹ 21.21

Net settled₹ 10,584.63

Amount captured₹ 10,605.84

✓ WEBHOOK + API VERIFIED

Pricing

Simple, transparent licensing

One license per WHMCS installation. Includes updates, support, and unlimited transactions — we never take a cut of your payments.

Leased License

Yearly plan with continuous updates

$1.56/mo

Billed Annually. Renews at $18.77/year.

One WHMCS installation
Unlimited transactions
One-click auto-updates
Email & ticket support

Choose Monthly

BEST VALUE

Lifetime License

Pay once, own it forever

$4.71one-time

Includes 1 year of free updates. Renew updates for $5.24/yr.

One WHMCS installation
Unlimited transactions
1 year free support & updates
Email & ticket support

Choose Lifetime

* Prices are exclusive of GST. 18% GST applicable on Indian invoices. · Need multiple installations? Contact us for volume pricing.

Built for WHMCS

Everything you need to accept PhonePe

From the OAuth handshake to the settlement reconciliation — secure, verified, and built on PhonePe's latest API.

Standard Checkout V2

Built on PhonePe's latest O-Bearer OAuth2 API — automatic access-token handling and a single, modern checkout endpoint.

Dual payment modes

Switch between full-page Redirect checkout and an in-page Iframe popup with a single dropdown — no code changes.

Webhook verification

SHA256-authenticated webhooks, then a second API status call to confirm the payment before it's ever recorded.

Automatic fee tracking

Reads the transaction fee straight from PhonePe's response and records it against the invoice — settlement reconciliation, done.

Sandbox support

Flip one toggle to point the gateway at PhonePe's sandbox, test end-to-end, then switch to production with confidence.

License managed

Just paste the license key from your purchase into the gateway settings. Local key caching with a fail-tolerance window means a momentary network blip never breaks checkout.

Gateway Setup

Configured in minutes, not days.

Activate PhonePe under Setup → Payment Gateways, paste your Client ID and Secret from the PhonePe Business dashboard, pick a checkout mode, and you're live. Every field is documented inline.

Client ID & Client Secret from your merchant dashboard
Redirect or Iframe checkout — a single dropdown
Webhook username & password for SHA256 auth
Sandbox toggle for safe end-to-end testing

setup / payment gateways / phonepe

SettingTypeValue

Client IDtextSU24••••5F2

Client Secretpassword••••••••••

Client Versiontext1

Payment ModedropdownRedirect

Sandbox Modeon / offOff

License KeytextRW-PP-••••

Checkout Experience

Redirect or iframe — your customer's call to make easy.

Redirect mode sends customers to PhonePe's hosted page for the full payment-app experience. Iframe mode keeps them on your site with a popup checkout. Either way, they get UPI, cards, net banking and wallets in one place.

UPI — GPay, PhonePe, Paytm & any UPI app
Credit & debit cards, net banking, wallets
Local card input disabled — PhonePe handles PCI scope
Switch modes without touching theme code

phonepe checkout — order 427_INV2026

RedirectIframe

UPI — GPay · PhonePe · PaytmRecommended

Credit & Debit Cards

Net Banking

Wallets

Pay to Acme Hosting₹ 10,605.84

Payment Integrity

Two checks before a payment is ever marked paid.

A webhook alone can be spoofed. This gateway authenticates the SHA256 hash on every webhook, then makes an independent API status call to PhonePe before recording the payment — and it reads the transaction fee straight from the response.

SHA256 hash verification of webhook credentials
Secondary API status check before recording
Duplicate & invoice validation guards
Transaction fee auto-extracted and logged

callback / phonepe.php — order 427_INV2026

Webhook auth (SHA256)✓ passed

API status check → COMPLETED✓ confirmed

Duplicate txn check✓ unique

Fee extracted: ₹ 21.21logged

addInvoicePayment() — ₹ 10,605.84✓ recorded

Security, end-to-end

Built so a payment is paid only when it's truly paid

Payment gateways are a favourite target for spoofed callbacks. Every layer here exists to make sure money is recorded accurately and only once.

01 / AUTH

SHA256 webhook auth

Every incoming webhook's credentials are verified against a SHA256 hash before a single line of processing runs. Unauthenticated calls are rejected.

02 / VERIFY

Dual payment verification

A passing webhook isn't enough. The handler makes an independent API status call to PhonePe and only records the payment if both agree it COMPLETED.

03 / GUARD

Dedup & invoice checks

Transaction-ID deduplication stops double-processing, and invoice validation confirms the invoice exists and belongs to this gateway before any payment is added.

04 / TLS

SSL & license gating

All PhonePe API traffic runs over HTTPS, and payment processing is disabled the moment the module license is inactive — no silent, unlicensed operation.

Compatibility

Requirements & compatibility

The PhonePe gateway runs on standard WHMCS environments. No exotic dependencies, no server-level changes required.

System Requirements

WHMCS Version8.x

PHP Version7.4 or higher

ionCube LoaderRequired

SSL CertificateRequired (webhooks)

Server OutboundHTTPS to relyweb.co

PHP Extensions & Account

curl✓ required

openssl✓ required

json✓ required

PhonePe BusinessKYC-verified

API CredentialsClient ID + Secret

FAQ

Common questions

Can't find what you're looking for? Get in touch.

What does the PhonePe gateway do?

It lets your WHMCS install accept payments through PhonePe using the Standard Checkout V2 (O-Bearer OAuth2) API. Customers can pay with UPI, credit and debit cards, net banking, and wallets — and you choose whether they pay on a full-page redirect or an in-page iframe popup.

When a payment completes, the gateway verifies it, records it against the invoice, and logs the transaction fee automatically.

What's the difference between Redirect and Iframe modes?

In Redirect mode, customers are sent to PhonePe's hosted checkout page to complete payment, then returned to your site. In Iframe mode, the PhonePe checkout opens as a popup over your own page so customers never appear to leave. You switch between them with a single dropdown in the gateway settings — no theme or code changes.

How do I get my Client ID and Client Secret?

Sign up for a PhonePe Business account, complete KYC verification, and generate your API credentials (Client ID and Client Secret) from the merchant dashboard. Paste them into the gateway configuration in WHMCS along with your webhook username and password, and you're ready to take payments.

Is the webhook handling secure?

Yes. Every webhook is authenticated with a SHA256 hash of your webhook credentials before anything is processed. The handler then makes an independent API status call back to PhonePe and only records the payment if PhonePe also confirms it as COMPLETED. Duplicate-transaction and invoice-ownership checks prevent double-processing or mismatched invoices.

Can I test before going live?

Yes. The gateway has a Sandbox Mode toggle that points all API calls at PhonePe's sandbox environment. You can run end-to-end test payments, confirm webhooks and callbacks behave correctly, then switch the toggle off to go live with your production credentials.

What WHMCS versions and server requirements are needed?

The gateway is built and tested for WHMCS 8.x on PHP 7.4 or higher, with the ionCube Loader. It needs the curl, openssl, and json PHP extensions and a valid SSL certificate (required for the webhook endpoint). These are standard on virtually all WHMCS-ready hosts, including all Relyweb hosting plans.

How does licensing work, and what if I cancel?

You purchase a license from relyweb.co and paste the license key into the gateway settings — there's nothing extra to install. Your license is validated at payment initiation, callback, and webhook handling, with the result cached locally for 15 days and a 5-day fail-tolerance window so a temporary network hiccup never blocks checkout.

If you cancel an annual license, the gateway keeps working but stops receiving updates and support. The Lifetime license never expires for the installation it's tied to.

Do you offer support and refunds?

Yes. All licenses include email and ticket support, with priority response on Lifetime licenses. We're based in Ahmedabad and support is provided in English and Hindi. Every purchase is backed by a 14-day money-back guarantee — if it doesn't work for your setup, contact us within 14 days for a full refund.