Payment callbacks and webhooks allow a gateway to notify WHMCS about events independently of the customer's browser. If a customer pays successfully but WHMCS remains unpaid, investigate the transaction and notification path before requesting another payment.
IN THIS ARTICLE
01 Find the correct endpoint
- Identify the exact gateway module in use. Different PayPal and Stripe integrations can use different events and callback behavior.
- Read that module's setup instructions and compare the configured WHMCS System URL with the provider's registered destination.
- Confirm that the endpoint uses a valid HTTPS certificate and is reachable without an interactive login, maintenance page or browser challenge.
- Review the provider's delivery result and WHMCS Gateway Log at the relevant time. Match the event or transaction identifier.
- Correct the endpoint, credentials or narrowly identified access rule, then use the provider's supported resend or test function where appropriate.
02 After a WHMCS address change
For the PayPal integrations covered by WHMCS's webhook-update tutorial, open the WHMCS application in the PayPal Developer Portal, select its live webhook and update the URL ending in /modules/gateways/callback/paypalwebhooks.php. Verify the exact module before applying that endpoint to another PayPal integration.
The native Stripe module can generate its webhook secrets when its configuration is saved, and its documented events include payment-method updates. Do not assume every Stripe event belongs at that endpoint or copy credentials between Stripe module variants.
How do I reconcile a payment after an interrupted callback?
Check whether WHMCS already holds the transaction before resending an event or entering a manual payment. Compare amount, currency, merchant account and invoice reference. A provider event marked delivered still needs a successful application result.
Keep callback routes narrowly accessible according to the integration's authentication requirements. Do not disable signature verification or remove site-wide security to repair a single blocked request. Record the corrected route and test it again after migrations, reverse-proxy changes or gateway upgrades.