Accept crypto on WHMCS, settled to your own wallet

The NoHoldPay module adds a crypto payment gateway to WHMCS as a redirect-to-hosted-checkout flow. A client opens an invoice, clicks Pay with crypto, and is taken to a hosted page with a QR code, a live countdown, and real-time status. A signed webhook then marks the invoice Paid, which lets WHMCS provision the service. Funds go to wallets you configured in your NoHoldPay account, never through the platform. Pricing is 0.5% per confirmed payment.

Requirements

  • A self-hosted WHMCS install, version 8.13 (LTS) or 9.0, on PHP 7.4 or newer
  • A free NoHoldPay account with at least one receiving wallet added, and an API key
  • A publicly reachable HTTPS store, so webhooks can be delivered

The module is open source under GPL, and you install it from the release archive on the plugin repository on GitHub. WHMCS Cloud cannot install third-party modules, so this is a self-hosted integration.

Install and connect in five steps

  1. Download the latest release and extract it into your WHMCS root, keeping the modules and gateways folder structure. WHMCS 9 has no install-from-zip, so upload every file before you activate the module.
  2. In WHMCS go to Configuration, then Apps and Integrations, then Payment Gateways, and activate NoHoldPay.
  3. Paste your API key. The prefix decides the mode: a pk_test_ key runs against testnets, a pk_live_ key against mainnet. Nothing else needs switching between the two.
  4. Copy the callback URL the settings screen shows you, add it as a webhook endpoint on that API key in your NoHoldPay dashboard, and paste the generated signing secret back into the module. Until that secret is set the pay button is not offered, because a confirmed payment could not be credited without it.
  5. Save, then raise a test invoice and pay it on a testnet.

Choosing which coins to accept

WHMCS binds one payment method to each gateway module, so this module does not split coins into separate methods the way the WooCommerce plugin does. Instead it takes a plain accepted-coins list, a comma-separated set of CHAIN:SYMBOL pairs such as ETH:USDC,BASE:USDC,BTC:BTC. Leave it empty to offer every coin your API key allows.

A Restrict to accepted coins toggle decides how firm the list is. Ticked, the buyer can only pay with the coins on it. Unticked, the list only pre-selects which coin the hosted checkout opens on, and the buyer may still switch to anything else your account accepts.

Recurring invoices and renewals

Crypto cannot be charged automatically, so a renewal invoice is paid by the client clicking Pay Now on it, the same as the first invoice. The module never attempts an automatic charge, and WHMCS will not either, because a crypto gateway is not a card gateway. Run it as a complement to whatever card method you already offer, so clients who prefer crypto have the option on every invoice.

What keeps an invoice from being marked paid incorrectly?

The charged amount is taken from the invoice on your server, so nothing in the browser can lower it. Status updates arrive as HMAC-signed webhooks that the module verifies against your signing secret. And before an invoice is credited, the module independently re-reads the payment from the API and re-checks the amount, the currency, and the order binding, so even a correctly signed but stale or mismatched event cannot settle the wrong invoice.

The module also defines no capture function, which is what stops WHMCS from ever trying to auto-charge on its own. If a buyer sends slightly less than invoiced, your dashboard tolerance decides whether it still counts as paid. A larger shortfall you accept by hand is recorded for you to review rather than closing the invoice for money that did not arrive, and an overpayment credits the invoice for what it owed and leaves the surplus in your wallet.

Do a full dry run on a testnet first

Generate a pk_test_ key, configure the module with it, and pay a real test invoice against a testnet. Test mode ships with test credit, so the run costs nothing. Watch the invoice flip to Paid as the confirmed webhook lands, then swap in the pk_live_ key. The configuration is otherwise identical, which is the point: what you rehearsed is what runs in production. The public accepted coins directory lists every route, and which of them your key accepts is set in your account dashboard.

Common questions

Does WHMCS charge crypto renewals automatically?
No. Crypto cannot be auto-charged, so WHMCS generates the renewal invoice and emails the client, who pays it by clicking Pay Now. The module never attempts an automatic charge and WHMCS will not try one either, so it sits alongside a card gateway rather than replacing it.
Which WHMCS versions and hosting does it support?
Self-hosted WHMCS 8.13 (LTS) and 9.0, on PHP 7.4 or newer. WHMCS Cloud cannot install third-party modules, so the module runs on self-hosted installs only. Your store must be reachable over public HTTPS for webhooks to arrive.
The pay button disappeared on an invoice. Why?
The most common cause is the WHMCS Convert To For Processing setting on the gateway, which hands the module an amount in one currency while the invoice stays in another. The module refuses to quote across two currencies rather than risk mischarging, so clear that setting. A missing webhook secret, or an invoice below a chain minimum, will also replace the button with a notice.
Can I limit which coins customers pay with?
Yes. Set an accepted-coins list of CHAIN:SYMBOL pairs and tick Restrict to accepted coins to hold buyers to it, or leave it unticked to only pre-select the opening coin. WHMCS binds one method per module, so coins are managed as a list rather than as separate payment methods.
What happens if a buyer underpays or lets the invoice expire?
Your NoHoldPay dashboard tolerance decides whether a small shortfall still counts as paid. A larger shortfall you accept by hand is recorded for you to handle, not credited automatically, and an expired invoice can still be revived by a late transaction within the grace window. Blockchain reversals are never auto-adjusted, they are recorded for manual review.