Gateway Settings
| Field | How To Configure It |
|---|---|
| Show on Order Form | Enable when the gateway is ready for the intended customers. Keep production exposure controlled during testing. |
| Display Name | Customer-facing payment method label, for example Credit Card (Xendit). |
| Test Mode | Enable for testing and supply a Test Secret Key. The checkbox does not replace the key. |
| Public Key | Optional compatibility field; not used by the reviewed PAYMENT_LINK implementation. |
| Secret Key | Required server-side Xendit Secret API Key for the intended environment. Never put it in client-side HTML or public screenshots. |
| External ID Prefix | A short identifier for your installation, for example MyHosting. Letters, digits, underscores and hyphens are retained; other characters are removed. |
Test Mode And Live Mode
The Secret Key determines the Xendit environment. The reviewed implementation uses the same API hostname for test and live. Changing the Test Mode checkbox while retaining a live key does not make a transaction a sandbox transaction. Use a dedicated test installation and Test Secret Key for testing. Before go-live, deliberately replace the key with the Live Secret Key, disable Test Mode and verify the live webhook configuration.
Currency And Amounts
The reviewed gateway rejects non-IDR invoices and non-positive amounts. It submits whole-rupiah amounts using rounding. Use whole-rupiah test invoices, and investigate fractional balances rather than weakening the callback’s amount checks. USD and other invoice currencies are not supported by this implementation.
HTTPS And Customer Details
The invoice return URL must use HTTPS. Configure the WHMCS System URL correctly and resolve certificate or proxy issues before testing. Supply accurate customer names and email details. The reviewed code sanitizes names and limits field lengths before calling Xendit.
Protect Credentials
Restrict access to gateway settings and logs. If credentials are exposed, rotate them through Xendit and update the private gateway configuration. Re-test after a rotation, including outstanding payment callbacks. Do not share Secret Keys, card details or full customer records with support.