Configuring Xendit Webhooks

Callback Address

Use the public HTTPS URL of your WHMCS installation followed by /modules/gateways/callback/xendit.php. Replace the example host and include the installation subdirectory if applicable:

https://billing.example.com/modules/gateways/callback/xendit.php

# WHMCS installed in a subdirectory:
https://example.com/clients/modules/gateways/callback/xendit.php

Configure The Events

1. Open the webhook settings for the relevant test or live environment in your Xendit dashboard.
2. Configure Payment Session completed notifications (payment_session.completed) to the callback address above. Configure payment_session.expired notifications to the same endpoint if available.
3. Save and verify delivery using a real test Payment Session created by this module. A generic dashboard sample may lack an actual WHMCS invoice reference and can be rejected.
4. Ensure DNS, HTTPS and the web server allow incoming POST requests to this endpoint without login, CAPTCHA, browser challenges or redirect loops. Do not disable protection for the entire site.

How A Payment Is Applied

1. The callback reads the event and identifies the WHMCS invoice reference.
2. For a completed event it retrieves the session from Xendit with the configured Secret Key.
3. It checks the session identity, reference, COMPLETED status, IDR currency, payment ID and positive amount.
4. It checks for an existing transaction, retrieves the WHMCS invoice and compares the verified payment amount with the outstanding balance.
5. If the checks pass, it records the payment using the verified payment ID. Expired sessions are logged without applying a payment.

Important Behaviours

• Returning to the invoice page is not proof of payment. The server-side callback performs the payment update.
• The reviewed version has no configurable callback-token field and does not validate the x-callback-token header. It verifies completed sessions through Xendit’s API; do not claim token validation for this version.
• HTTP 200 can mean paid, ignored, expired or already processed. Confirm the invoice and gateway log, not only the response code.
• Opening the callback URL in a browser sends GET and should return HTTP 405 when the gateway is configured. This is expected and is not an end-to-end test.

Provider Reference

See Xendit Payment Session webhook reference. Dashboard labels and event availability can change; match the event names to your account’s settings.