WHMCS Payment Gateway · v0.0.1

Accept Zoho Payments in WHMCS, natively.

A drop-in payment gateway that brings the embedded Zoho Payments checkout to your WHMCS invoices — with OAuth2 auto-refresh, HMAC-secured webhooks, and support for both India and US data centers.

WHMCS 8.x compatible India & US data centers Embedded checkout widget Webhook-ready
Acme Hosting Pvt Ltd
Powered by
SECURE CHECKOUT
Invoice No.INV-2026-00427
Reference#427
Data CenterZoho IN
ModeLive
UPI
CardsVisaMastercardRuPay
Net Banking
Wallets
OAuth2 refreshed·HMAC verified·API CAPTURED
Amount Due₹ 10,605.84
✓ PAY WITH ZOHO
2Data centers
India · United States
OAuth2Auto-refresh tokens
No manual re-auth
HMACSHA-256 webhooks
Timing-safe verify
APIServer-side verify
Not signature-only
PHP 7.4+WHMCS 8.x
ionCube ready
Pricing

Simple, transparent licensing

One license per WHMCS installation. Includes updates, support, and unlimited transactions.

Leased License

Yearly plan with continuous updates

$1.56/mo
Billed Annually. Renews at $18.77/year.
  • One WHMCS installation
  • Unlimited transactions
  • One-click auto-updates
  • Email & ticket support
Choose Monthly
* Prices are exclusive of GST. 18% GST applicable on Indian invoices.  ·  Need multiple installations? Contact us for volume pricing.
Built for WHMCS 8.x

Everything you need to accept Zoho Payments

From the embedded checkout to asynchronous webhook reconciliation — verified server-side and ready for production.

Embedded checkout widget

The Zoho ZPayments widget renders right on the invoice — customers pay by UPI, cards, net banking, or wallets without leaving your client area.

OAuth2 auto-refresh

Authenticates with Zoho via OAuth2 and refreshes the access token automatically. Set the refresh token once — no manual re-authorization later.

Asynchronous webhooks

A dedicated webhook handler processes Payment Link notifications out-of-band, so invoices reconcile even when the customer closes the tab early.

Multi-data center (IN / US)

Switch between Zoho's India (.in) and United States (.com) data centers with a single dropdown — endpoints and OAuth domains adjust automatically.

API-based verification

Every payment is confirmed by querying the Zoho API directly — the gateway never marks an invoice paid on a client signature alone.

Automatic fee tracking

Gateway fees returned by Zoho are extracted and recorded against the transaction in WHMCS, so your accounting reflects the true net received.

Sandbox / test mode

Flip a single toggle to run against Zoho's test environment. Validate the full payment flow safely before flipping to live.

License integration

Licensed per WHMCS installation via a simple license key, with local key caching so a brief licensing check won't interrupt live payments.

Embedded Checkout

Customers pay without ever leaving WHMCS.

The Zoho ZPayments widget loads directly on the invoice. Your customer picks UPI, a card, net banking, or a wallet and completes payment in place — no redirect, no broken back-button, no lost sessions.

  • In-page widget rendered via Zoho's ZPayments.js
  • UPI, cards, net banking and wallets in one flow
  • Invoice reference and amount passed automatically
  • Graceful handling of cancelled or closed widgets
client / invoice / pay-with-zoho
Payment MethodTypeMode
UPIInstantLive
CardsVisaMastercard3-D SecureLive
Net BankingBankLive
WalletsWalletLive
Amount Due · INV-2026-00427₹ 10,605.84
Pay with Zoho Payments
Admin Configuration

Configured in minutes, from the WHMCS admin.

Enter your Zoho credentials, pick a data center, and click once to generate the OAuth refresh token. The webhook URL is shown ready to copy into your Zoho dashboard — no config files to edit by hand.

  • Account ID, Widget API Key, Client ID & Secret
  • One-click OAuth refresh-token generator
  • IN / US data-center dropdown
  • Copy-ready webhook URL and secret field
admin / configgateways / zohopayments
Account ID60xxxxxxx
Client ID1000.AB12…XZ
Client Secret••••••••••••
Data CenterIN — India
Refresh Token✓ generated
Test ModeOff — Live
…/zohopayments/webhooks/paylink_webhook.phpcopy
Verification & Reconciliation

Marked paid only after Zoho confirms it.

Both the post-payment callback and the webhook re-check the payment against the Zoho API before recording it. Signatures are HMAC-SHA256 verified, duplicates are blocked, and gateway fees are captured on the transaction.

  • Server-side payment status fetched from Zoho
  • HMAC-SHA256 webhook signatures, timing-safe
  • Duplicate transaction protection
  • Gateway fees recorded against the invoice
gateway log — zohopayments
PaymentMethodStatusAmount
pay_3F9k…27UPIVerified₹ 10,605
pay_7Lm2…04CardVerified₹ 4,720
pay_9Qx8…61UPIVerified₹ 1,180
pay_2Bd5…39CardVerified$ 250.00
webhook · paylink.payment.success✓ signature ok
Security, end-to-end

Built to verify every rupee — not just trust a signature

Payment gateways are a favourite target. This module assumes nothing on the client side and confirms everything with Zoho server-side.

01 / VERIFY

API-based verification

Payment status is always fetched from the Zoho API before an invoice is marked paid — a forged or replayed callback can't fake a successful payment.

02 / WEBHOOK

HMAC-SHA256 signatures

Every webhook is validated with an HMAC-SHA256 signature using a timing-safe comparison (hash_equals), so tampered notifications are rejected.

03 / SSL

Enforced TLS

All outbound API calls use CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST. Webhook endpoints require a valid SSL certificate.

04 / DEDUPE

Duplicate protection

A transaction-ID check (checkCbTransID) prevents the same payment from being recorded twice across callback and webhook paths.

Compatibility

Requirements & compatibility

Zoho Payments runs on standard WHMCS environments. A valid SSL certificate is required for webhook delivery.

System Requirements

WHMCS Version8.0 or higher
PHP Version7.4 or higher
ionCube LoaderRequired
SSL CertificateRequired
DatabaseMySQL / MariaDB

PHP Extensions

curl✓ required
openssl✓ required
json✓ required
mbstring✓ required
Zoho accountPayments API access
FAQ

Common questions

Can't find what you're looking for? Get in touch.

What does the Zoho Payments gateway for WHMCS do?

It's a payment gateway module that lets your WHMCS customers pay invoices through Zoho Payments. The Zoho checkout widget is embedded directly on the invoice, so customers can pay by UPI, card, net banking, or wallet without leaving your client area.

Behind the scenes it handles OAuth2 authentication, verifies each payment against the Zoho API, processes asynchronous webhooks for Payment Links, and records the transaction and gateway fees back into WHMCS.

Which data centers does it support?

Both Zoho India (.in) and Zoho United States (.com). You select the data center from a dropdown in the gateway settings, and the module automatically uses the matching API endpoints and OAuth domains — no code changes needed.

How do I set up the OAuth credentials and refresh token?

Create a server-based application in the Zoho Developer Console for your region to get a Client ID and Client Secret. Enter those in the gateway settings along with your Account ID and Widget API Key, save, then click the "Generate Token" helper — it walks you through authorizing with Zoho and stores the refresh token automatically.

Because the module refreshes the access token on its own, this is a one-time setup; you won't need to re-authorize during normal operation.

How secure is it — how are payments verified?

The module never marks an invoice paid on client data alone. After the widget reports success, the payment status is fetched directly from the Zoho API and confirmed server-side. Webhooks are validated with HMAC-SHA256 signatures using a timing-safe comparison, all API calls enforce SSL verification, and a transaction-ID check prevents the same payment from being processed twice.

What are the Payment Link webhooks for?

Some payments complete asynchronously — for example if a customer closes the browser before the page returns. The webhook handler at /modules/gateways/zohopayments/webhooks/paylink_webhook.php receives the notification from Zoho, re-verifies it via the API, and reconciles the invoice so it's still marked paid. You add this URL and a webhook secret in your Zoho Payments dashboard.

Can I test it in sandbox mode before going live?

Yes. There's a Test Mode toggle in the gateway settings. With it enabled you can run the complete payment flow against Zoho's test environment, validate webhooks and verification, and only switch to live once you're satisfied everything works.

What are the requirements and how does licensing work?

You need WHMCS 8.0+, PHP 7.4+ with ionCube, a valid SSL certificate for webhooks, the curl/openssl/json/mbstring extensions, and a Zoho account with Payments API access. Licensing is simple: you enter the license key we provide, and the module validates it and caches the result locally so a brief check won't interrupt payments. Each license covers one WHMCS installation.

Do you offer support and refunds?

Yes. All licenses include email and ticket support, with priority response on the Lifetime license. We're based in Ahmedabad and provide support in English and Hindi. Every purchase is covered by a 14-day money-back guarantee — if it doesn't work for your setup, contact support within 14 days for a full refund.

Start accepting Zoho Payments in WHMCS.

Embedded checkout, API-verified payments, and dual data-center support. 14-day money-back guarantee, no risk.