A drop-in payment gateway that brings the embedded Zoho Payments checkout to your WHMCS invoices — with OAuth2 auto-refresh, HMAC-secured webhooks, and support for both India and US data centers.
One license per WHMCS installation. Includes updates, support, and unlimited transactions.
Yearly plan with continuous updates
Pay once, own it forever
From the embedded checkout to asynchronous webhook reconciliation — verified server-side and ready for production.
The Zoho ZPayments widget renders right on the invoice — customers pay by UPI, cards, net banking, or wallets without leaving your client area.
Authenticates with Zoho via OAuth2 and refreshes the access token automatically. Set the refresh token once — no manual re-authorization later.
A dedicated webhook handler processes Payment Link notifications out-of-band, so invoices reconcile even when the customer closes the tab early.
Switch between Zoho's India (.in) and United States (.com) data centers with a single dropdown — endpoints and OAuth domains adjust automatically.
Every payment is confirmed by querying the Zoho API directly — the gateway never marks an invoice paid on a client signature alone.
Gateway fees returned by Zoho are extracted and recorded against the transaction in WHMCS, so your accounting reflects the true net received.
Flip a single toggle to run against Zoho's test environment. Validate the full payment flow safely before flipping to live.
Licensed per WHMCS installation via a simple license key, with local key caching so a brief licensing check won't interrupt live payments.
The Zoho ZPayments widget loads directly on the invoice. Your customer picks UPI, a card, net banking, or a wallet and completes payment in place — no redirect, no broken back-button, no lost sessions.
Enter your Zoho credentials, pick a data center, and click once to generate the OAuth refresh token. The webhook URL is shown ready to copy into your Zoho dashboard — no config files to edit by hand.
Both the post-payment callback and the webhook re-check the payment against the Zoho API before recording it. Signatures are HMAC-SHA256 verified, duplicates are blocked, and gateway fees are captured on the transaction.
Payment gateways are a favourite target. This module assumes nothing on the client side and confirms everything with Zoho server-side.
Payment status is always fetched from the Zoho API before an invoice is marked paid — a forged or replayed callback can't fake a successful payment.
Every webhook is validated with an HMAC-SHA256 signature using a timing-safe comparison (hash_equals), so tampered notifications are rejected.
All outbound API calls use CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST. Webhook endpoints require a valid SSL certificate.
A transaction-ID check (checkCbTransID) prevents the same payment from being recorded twice across callback and webhook paths.
Zoho Payments runs on standard WHMCS environments. A valid SSL certificate is required for webhook delivery.
It's a payment gateway module that lets your WHMCS customers pay invoices through Zoho Payments. The Zoho checkout widget is embedded directly on the invoice, so customers can pay by UPI, card, net banking, or wallet without leaving your client area.
Behind the scenes it handles OAuth2 authentication, verifies each payment against the Zoho API, processes asynchronous webhooks for Payment Links, and records the transaction and gateway fees back into WHMCS.
Both Zoho India (.in) and Zoho United States (.com). You select the data center from a dropdown in the gateway settings, and the module automatically uses the matching API endpoints and OAuth domains — no code changes needed.
Create a server-based application in the Zoho Developer Console for your region to get a Client ID and Client Secret. Enter those in the gateway settings along with your Account ID and Widget API Key, save, then click the "Generate Token" helper — it walks you through authorizing with Zoho and stores the refresh token automatically.
Because the module refreshes the access token on its own, this is a one-time setup; you won't need to re-authorize during normal operation.
The module never marks an invoice paid on client data alone. After the widget reports success, the payment status is fetched directly from the Zoho API and confirmed server-side. Webhooks are validated with HMAC-SHA256 signatures using a timing-safe comparison, all API calls enforce SSL verification, and a transaction-ID check prevents the same payment from being processed twice.
Some payments complete asynchronously — for example if a customer closes the browser before the page returns. The webhook handler at /modules/gateways/zohopayments/webhooks/paylink_webhook.php receives the notification from Zoho, re-verifies it via the API, and reconciles the invoice so it's still marked paid. You add this URL and a webhook secret in your Zoho Payments dashboard.
Yes. There's a Test Mode toggle in the gateway settings. With it enabled you can run the complete payment flow against Zoho's test environment, validate webhooks and verification, and only switch to live once you're satisfied everything works.
You need WHMCS 8.0+, PHP 7.4+ with ionCube, a valid SSL certificate for webhooks, the curl/openssl/json/mbstring extensions, and a Zoho account with Payments API access. Licensing is simple: you enter the license key we provide, and the module validates it and caches the result locally so a brief check won't interrupt payments. Each license covers one WHMCS installation.
Yes. All licenses include email and ticket support, with priority response on the Lifetime license. We're based in Ahmedabad and provide support in English and Hindi. Every purchase is covered by a 14-day money-back guarantee — if it doesn't work for your setup, contact support within 14 days for a full refund.
Embedded checkout, API-verified payments, and dual data-center support. 14-day money-back guarantee, no risk.