Invoice Pay Links Without Login for WHMCS
Clients pay a WHMCS invoice from an email link without a password, through a login that opens only that invoice and its payment pages.
What does the pay link addon do?
Invoices often stay unpaid because the client has to find a password before they can pay. This addon adds a {$pay_link} merge field to WHMCS invoice emails. The link signs the client in through WHMCS' own single sign-on, but only for that invoice: they can view it, pay it, and download the PDF. Opening any other page of the account sends them to the normal login with a short notice explaining why. It also fills {$auto_login_link}, so invoice templates written for older auto-login modules work without edits.
If you prefer, switch the pay-only login off and a link signs the client in fully.
What stops a link from being misused?
Each link uses a long random token. Only a keyed hash of it and an encrypted copy are stored; the token itself is never logged or shown in lists. A link stops working when it expires, 20 days by default and anywhere from 1 to 90, when the invoice is paid, canceled, refunded or deleted, when an admin revokes or regenerates it, or when the invoice moves to another client. The pay-only session lasts 60 minutes. Too many invalid links from one visitor bring up a "too many attempts" page, and the visitor's address is kept only as a salted hash for 15 minutes. Link pages are never cached or indexed.
What is included?
| Part | What it does |
|---|---|
| Invoice emails | Pay link, HTML link and expiry date merge fields, with the normal invoice address as a fallback so an email never holds an empty link |
| Email template | An "Invoice Payment Link" template created on activation |
| Admin invoice page | Link status and opens, copy link, email to client, regenerate and revoke |
| Links page | Filters, search and status for every link, showing only the last four characters |
| Statistics | Links created and opened, invoices paid after opening and amounts per currency |
| Client notice | A slim banner telling the client they opened a payment link |
Who is it for?
Hosting companies and service businesses on WHMCS that want fewer overdue invoices and fewer "I forgot my password" tickets, without handing out full account access through an email link.
What do you need, and what are the limits?
Requirements: WHMCS 9, PHP 8.1 or newer, and the WHMCS daily cron for clean-up. Access to the links is given per admin role; admins without access see only the link status on the invoice.
Limits: the pay-only gate allows the invoice, card and payment routes WHMCS uses, along with Stripe and PayPal helper routes. A gateway that loads its own extra routes may need its route prefix added, so test each gateway once with a small invoice. Mail security scanners that open links in emails count as opens and can start a short pay-only session; they see nothing beyond the email they already hold. The client page template was written for a custom WHMCS 9 theme, so another theme needs template and language changes to match.
It costs $39 once for a lifetime license with twelve months of updates and support, an instant download and license key, and a seven-day refund window.
Key features
- Pay link merge fields for any WHMCS invoice email
- Pay-only login limited to one invoice, its PDF and payment pages
- Links expire after a set number of days or when the invoice is paid
- Copy, email, regenerate and revoke from the admin invoice page
- Tokens stored only as a keyed hash and an encrypted copy
- Rate limit on invalid links, with hashed visitor addresses
- Links list with filters, search and status
- Statistics on opens and invoices paid after opening
- Works with templates that already use the auto_login_link field
Why customers buy this module
- →Clients pay in a couple of clicks instead of resetting a password
- →An email link never exposes the rest of the client's account
- →Staff can resend or cancel a link from the invoice itself
- →Statistics show how many invoices the links helped get paid
Frequently asked questions
Can someone holding the link see the rest of the client's account?
<p>Not with the pay-only login on, which is the default. The link opens only that invoice, its payment pages and its PDF. Visiting any other page ends the session through the normal WHMCS logout and shows the login page with a note, and background requests get a refusal without logging the client out.</p>
What happens once the invoice is paid?
<p>The link is closed for payment right away. The receipt and PDF stay open until the 60-minute session ends, and anyone opening the link later sees a page saying the invoice is already paid, with a login button. In the admin list the link shows as paid, and the statistics count it as paid after the link was opened.</p>
Do I have to rewrite my invoice email templates?
<p>Usually not. Templates that already contain the auto_login_link field work unchanged once the addon is active, and you can add the pay_link field to any template of type Invoice. The addon never edits your templates. When no link can be made, for example for an inactive client, the field holds the normal invoice address instead.</p>
Technical specifications
- WHMCS
- Built for WHMCS 9
- PHP
- 8.1+
- Link lifetime
- 20 days by default, 1 to 90 days
- Pay-only session
- 60 minutes, limited to one invoice
- License
- Lifetime, 1 year of updates and support included
- Delivery
- Instant download and license key
- Refund window
- 7 days