Payment Authorization and Chargeback Evidence for WHMCS
Customers sign a payment authorization at checkout and before paying an invoice, and you keep a tamper-evident record for disputes.
What does the payment authorization addon do?
It puts a short authorization agreement in front of every payment and keeps proof that the customer accepted it. On the checkout page, an agreement block with a checkbox and a typed signature is added to the cart, and the order is refused on the server until it is accepted. On an invoice, a modal opens when the customer clicks Pay Now; they tick the box, type their name, and the payment carries on. Their consent is saved before the payment form is submitted.
Each record holds the client's name and email, the typed signature, IP address, user agent, amount, currency, the exact agreement text and version they saw, and a UTC timestamp. The record is fingerprinted with an HMAC-SHA256 hash, so if anyone edits the row in the database later, the admin view flags it as tampered.
What is included?
| Part | What it does |
|---|---|
| Checkout agreement | Checkbox and typed signature, enforced on the server |
| Invoice modal | Authorization captured when the customer clicks Pay Now |
| Account mandate | One-time standing authorization for existing and auto-pay clients, optionally forced at login |
| Plan choice | Customer picks one-time payment or month-to-month billing |
| Admin dashboard | Stat cards, mandate coverage, searchable records and an activity log |
| Certificate | Printable certificate of payment authorization for each record |
| Client views | A widget on the admin client summary and a client area page of past authorizations |
| Export | CSV of every authorization, including the integrity hash |
How does it handle customers who pay automatically?
Customers on a stored card are charged by the WHMCS cron and never see the invoice page, so the modal cannot reach them. For them the module offers an account mandate: a one-time blanket authorization covering current and future recurring charges. Turn on force at login and each client sees a blocking authorization screen the next time they sign in. Background charges are then logged against that mandate, and a charge taken before a client has signed is logged separately so you can follow up.
If you offer the plan choice on invoices, picking month-to-month also moves the services on that invoice to the auto-pay gateway you name, so later renewals are charged automatically once a card is stored.
Who should use it?
It suits hosting, VPS and service businesses that take card or PayPal payments and want a clear record of consent when a customer later says they did not authorize a charge.
What do you need, and what is outside its scope?
Requirements: WHMCS 8 (exact version confirmed at purchase), PHP 7.4 or newer, and a client area theme whose invoice pay button submits a standard form.
Limits: the record is evidence, not a promise that a dispute goes your way. Payments made before you install the addon cannot be authorized after the fact. Records stay in the database when the addon is deactivated, by design.
It costs $99 once for a lifetime license with twelve months of updates and support, an instant download and license key, and a seven-day refund window.
Key features
- Authorization checkbox and typed signature at checkout
- Authorization modal before an invoice is paid
- Name, IP, user agent, amount, agreement text and UTC time stored
- HMAC-SHA256 fingerprint with tamper warning
- Account mandate for existing and auto-pay clients
- One-time or month-to-month choice that sets the gateway
- Printable certificate of payment authorization
- Editable agreement text with version numbers
- Client area history and admin client summary widget
- CSV export of all authorizations
Why customers buy this module
- →A ready evidence pack when a chargeback or PayPal dispute arrives
- →Customers confirm what they are paying for before they pay
- →Auto-pay customers are covered by a signed standing mandate
- →You can show that a record has not been edited since it was signed
Frequently asked questions
Will this stop chargebacks?
<p>No module can stop a customer from opening a dispute. What it gives you is a signed record for each payment: who agreed, from which IP address and browser, to what text, for what amount and when, plus a printable certificate. That is the kind of evidence card networks and PayPal ask for when you respond.</p>
What about customers already on automatic card payments?
<p>Enable the account mandate and, when you are ready, force it at login. Each client signs a one-time standing authorization the next time they log in, and later background charges are logged against it. The dashboard shows how many active clients have signed so far.</p>
Can I change the agreement wording later?
<p>Yes. Edit the text in the settings and raise the version number. Every record keeps a copy of the exact text the customer saw, so old and new acceptances stay distinct. Raising the mandate version asks all clients to sign the new mandate again.</p>
Technical specifications
- WHMCS
- 8.x (confirmed at purchase)
- PHP
- 7.4+
- Integrity check
- HMAC-SHA256 per record
- Placeholders
- {client_name}, {company}, {amount}, {invoice_id}
- License
- Lifetime, 1 year of updates and support included
- Delivery
- Instant download and license key
- Refund window
- 7 days