Accept Zoho Payments in WHMCS, natively.
A drop-in payment gateway that brings the embedded Zoho Payments checkout to your WHMCS invoices — with OAuth2 auto-refresh, HMAC-secured webhooks, and support for both India and US data centers.
India · United States
No manual re-auth
Timing-safe verify
Not signature-only
ionCube ready
Simple, transparent licensing
One license per WHMCS installation. Includes updates, support, and unlimited transactions.
Leased License
Yearly plan with continuous updates
- One WHMCS installation
- Unlimited transactions
- One-click auto-updates
- Email & ticket support
Lifetime License
Pay once, own it forever
- One WHMCS installation
- Unlimited transactions
- 1 year free support & updates
- Email & ticket support
Everything you need to accept Zoho Payments
From the embedded checkout to asynchronous webhook reconciliation — verified server-side and ready for production.
Embedded checkout widget
The Zoho ZPayments widget renders right on the invoice — customers pay by UPI, cards, net banking, or wallets without leaving your client area.
OAuth2 auto-refresh
Authenticates with Zoho via OAuth2 and refreshes the access token automatically. Set the refresh token once — no manual re-authorization later.
Asynchronous webhooks
A dedicated webhook handler processes Payment Link notifications out-of-band, so invoices reconcile even when the customer closes the tab early.
Multi-data center (IN / US)
Switch between Zoho's India (.in) and United States (.com) data centers with a single dropdown — endpoints and OAuth domains adjust automatically.
API-based verification
Every payment is confirmed by querying the Zoho API directly — the gateway never marks an invoice paid on a client signature alone.
Automatic fee tracking
Gateway fees returned by Zoho are extracted and recorded against the transaction in WHMCS, so your accounting reflects the true net received.
Sandbox / test mode
Flip a single toggle to run against Zoho's test environment. Validate the full payment flow safely before flipping to live.
License integration
Licensed per WHMCS installation via a simple license key, with local key caching so a brief licensing check won't interrupt live payments.
Customers pay without ever leaving WHMCS.
The Zoho ZPayments widget loads directly on the invoice. Your customer picks UPI, a card, net banking, or a wallet and completes payment in place — no redirect, no broken back-button, no lost sessions.
- In-page widget rendered via Zoho's ZPayments.js
- UPI, cards, net banking and wallets in one flow
- Invoice reference and amount passed automatically
- Graceful handling of cancelled or closed widgets
Configured in minutes, from the WHMCS admin.
Enter your Zoho credentials, pick a data center, and click once to generate the OAuth refresh token. The webhook URL is shown ready to copy into your Zoho dashboard — no config files to edit by hand.
- Account ID, Widget API Key, Client ID & Secret
- One-click OAuth refresh-token generator
- IN / US data-center dropdown
- Copy-ready webhook URL and secret field
Marked paid only after Zoho confirms it.
Both the post-payment callback and the webhook re-check the payment against the Zoho API before recording it. Signatures are HMAC-SHA256 verified, duplicates are blocked, and gateway fees are captured on the transaction.
- Server-side payment status fetched from Zoho
- HMAC-SHA256 webhook signatures, timing-safe
- Duplicate transaction protection
- Gateway fees recorded against the invoice
Built to verify every rupee — not just trust a signature
Payment gateways are a favourite target. This module assumes nothing on the client side and confirms everything with Zoho server-side.
API-based verification
Payment status is always fetched from the Zoho API before an invoice is marked paid — a forged or replayed callback can't fake a successful payment.
HMAC-SHA256 signatures
Every webhook is validated with an HMAC-SHA256 signature using a timing-safe comparison (hash_equals), so tampered notifications are rejected.
Enforced TLS
All outbound API calls use CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST. Webhook endpoints require a valid SSL certificate.
Duplicate protection
A transaction-ID check (checkCbTransID) prevents the same payment from being recorded twice across callback and webhook paths.
Requirements & compatibility
Zoho Payments runs on standard WHMCS environments. A valid SSL certificate is required for webhook delivery.
System Requirements
PHP Extensions
What does the Zoho Payments gateway for WHMCS do?
It's a payment gateway module that lets your WHMCS customers pay invoices through Zoho Payments. The Zoho checkout widget is embedded directly on the invoice, so customers can pay by UPI, card, net banking, or wallet without leaving your client area.
Behind the scenes it handles OAuth2 authentication, verifies each payment against the Zoho API, processes asynchronous webhooks for Payment Links, and records the transaction and gateway fees back into WHMCS.
Which data centers does it support?
Both Zoho India (.in) and Zoho United States (.com). You select the data center from a dropdown in the gateway settings, and the module automatically uses the matching API endpoints and OAuth domains — no code changes needed.
How do I set up the OAuth credentials and refresh token?
Create a server-based application in the Zoho Developer Console for your region to get a Client ID and Client Secret. Enter those in the gateway settings along with your Account ID and Widget API Key, save, then click the "Generate Token" helper — it walks you through authorizing with Zoho and stores the refresh token automatically.
Because the module refreshes the access token on its own, this is a one-time setup; you won't need to re-authorize during normal operation.
How secure is it — how are payments verified?
The module never marks an invoice paid on client data alone. After the widget reports success, the payment status is fetched directly from the Zoho API and confirmed server-side. Webhooks are validated with HMAC-SHA256 signatures using a timing-safe comparison, all API calls enforce SSL verification, and a transaction-ID check prevents the same payment from being processed twice.
What are the Payment Link webhooks for?
Some payments complete asynchronously — for example if a customer closes the browser before the page returns. The webhook handler at /modules/gateways/zohopayments/webhooks/paylink_webhook.php receives the notification from Zoho, re-verifies it via the API, and reconciles the invoice so it's still marked paid. You add this URL and a webhook secret in your Zoho Payments dashboard.
Can I test it in sandbox mode before going live?
Yes. There's a Test Mode toggle in the gateway settings. With it enabled you can run the complete payment flow against Zoho's test environment, validate webhooks and verification, and only switch to live once you're satisfied everything works.
What are the requirements and how does licensing work?
You need WHMCS 8.0+, PHP 7.4+ with ionCube, a valid SSL certificate for webhooks, the curl/openssl/json/mbstring extensions, and a Zoho account with Payments API access. Licensing is simple: you enter the license key we provide, and the module validates it and caches the result locally so a brief check won't interrupt payments. Each license covers one WHMCS installation.
Do you offer support and refunds?
Yes. All licenses include email and ticket support, with priority response on the Lifetime license. We're based in Ahmedabad and provide support in English and Hindi. Every purchase is covered by a 14-day money-back guarantee — if it doesn't work for your setup, contact support within 14 days for a full refund.
Release history
What’s new in Zoho Payments — newest first.
v1.1.0 08 Sep 2026 Latest
New
- Added a webhook handler to process payment updates and payment links.
- Added customization options for the payment widget in the Zoho Payments link function.
- Added tax calculations for fees.
- Added instructions for generating credentials.
Improvements
- License checks now fail gracefully if the license has expired.
- License management is more resilient against unavailable or malformed checks.
- Updated documentation to match current software behavior.
- Improved logging and naming conventions for payment blocks.
Related apps
Other Relyweb apps that fit alongside Zoho Payments.
PhonePe Payment Gateway
Accept PhonePe payments in WHMCS, the right way.
Razorpay Payment Gateway
Razorpay integration with subscription billing for Acellemail.
Cashfree Payment Gateway
Cashfree checkout for Acellemail subscriptions and one-time plans.
Start accepting Zoho Payments in WHMCS.
Embedded checkout, API-verified payments, and dual data-center support. 14-day money-back guarantee, no risk.