eKYC Guard for WHMCS

Identity (KYC) verification gate for WHMCS. Blocks product/service and domain provisioning until a customer passes identity verification, with automated reminders and grace-period enforcement.

Commercial module by arahoster, distributed under the arahoster EULA and protected by the WHMCS Licensing Addon. It is an independent, clean-room implementation of the common "verify before provisioning" pattern and contains no third-party proprietary code.

A valid arahoster license key is required. Without one the module is fail-open: it disables itself (no provisioning gate, no automation) and shows admins a renewal notice — your WHMCS keeps working normally.

• Provisioning gate — aborts Create for products/services and domain registration/transfer until the customer is verified (PreModuleCreate, PreRegistrarRegisterDomain, PreRegistrarTransferDomain).
• Providers (all behind one abstraction)
  • Didit (global, 220+ countries) — hosted ID + liveness, HMAC webhook + poll.
  • DigiLocker (India) — OAuth2 + PKCE government identity verification.
  • Stripe Identity, Sumsub, Onfido, Persona, Shufti Pro — hosted flows with signed webhooks.
  • Manual — customer (or admin) uploads documents for admin review.
• AML / sanctions + PEP screening (OpenSanctions) — a hit routes the customer to manual review instead of auto-approving.
• Scope controls — enforce by product / product group (all / include / exclude) and by TLD for domains (all / whitelist / blacklist).
• Periodic re-KYC — verifications expire after N months and re-gate.
• Auto-provisioning on verify — Pending services/orders held by the gate are created/accepted automatically once the customer passes.
• Automation — invite emails (editable WHMCS templates), first/second reminders, auto-suspend → auto-terminate → account-disable after a grace period.
• Compliance — consent capture (GDPR), document encryption at rest (libsodium) on a configurable out-of-webroot path, retention auto-purge, and document-access audit logging.
• Client area — localised status page (English/Spanish/French/Arabic), provider chooser, mobile-camera document upload, auto-refresh while pending, nav badge and a cross-theme banner.
• Admin area — dashboard with stats/filters and bulk actions, per-customer review (approve / reject / upload-on-behalf), provider Test connection buttons, full activity log, integration endpoints.
• Integration hooks — EkycGuardVerified / EkycGuardRejected / EkycGuardManualReview / EkycGuardStatusChanged for other modules.
• Security — HMAC webhook verification with replay protection and a no-downgrade guard, OAuth state/PKCE, CSRF tokens (POST start), private encrypted storage streamed only to authenticated admins, upload MIME/size checks.

• WHMCS 8.0 – 9.x
• PHP 7.4+ (8.1+ recommended), cURL extension
• sodium extension (optional, for document encryption at rest)
• HTTPS (mandatory for provider redirects/webhooks)

This module verifies against arahoster's WHMCS Licensing Addon:

• Customers paste their license key into the addon's License Key field (Configuration → Addon Modules → eKYC Guard). The module phones home, binds the license to the WHMCS domain, and caches a signed local key so it keeps working offline for 15 days (+5 days grace if the licensing server is briefly down).
• Invalid / expired / missing → fail-open: the gate and automation switch off and admins see a renewal banner. Buy/renew at the configured arahoster store.

1. Create the product in your WHMCS Licensing Addon and note its MD5 Hash Verification Value.
2. In lib/License.php, set SERVER_URL (your WHMCS root) and SECRET (the MD5 hash value). These are the only two vendor constants.
3. ionCube-encode the module so SECRET and the license logic can't be stripped (the included Docker image already bundles ionCube for testing).
4. Package with make package (or your encoder's pipeline) and sell the zip + per-customer license keys.

1. Copy modules/addons/ekycguard/ into your WHMCS installation (<whmcs>/modules/addons/ekycguard/), or upload the packaged zip.
2. Configuration → Addon Modules, find eKYC Guard, click Activate, set permissions for the admin roles that should see it, then Save Changes.
3. Enter your arahoster License Key, then the settings (enforcement, grace period, providers) and Save.
4. Open Addons → eKYC Guard → Settings & endpoints and copy the two URLs:
   • Didit webhook → paste into your Didit workflow's webhook settings.
   • DigiLocker redirect URI → register it in the DigiLocker partner portal (it must match exactly).

The activation step creates four tables (mod_ekycguard_verifications, mod_ekycguard_documents, mod_ekycguard_logs, mod_ekycguard_meta), installs the customer email templates, generates the document-encryption key, and creates a private storage/ dir.

The Addons → eKYC Guard → Settings & endpoints tab shows the exact webhook URL for every enabled provider (Didit, Stripe, Sumsub, Onfido, Persona, Shufti) plus the DigiLocker redirect URI — copy each into the matching provider console.

• Set Didit — API key, KYC workflow ID and webhook secret from your Didit console.
• Optionally, configure a Didit — KYB workflow ID. If set, clients with a populated Company Name in WHMCS will automatically be routed to the KYB verification flow.
• Base URL defaults to https://verification.didit.me.
• The customer is redirected to Didit; the decision arrives at webhook.php?provider=didit and is HMAC-verified with your webhook secret.

• Set client ID, client secret and (optionally) an explicit redirect URI from your Meripehchaan / API Setu app.
• The customer is redirected to DigiLocker's OAuth screen and returns to index.php?m=ekycguard&action=return&provider=digilocker, where the authorization code is exchanged (PKCE) and the verified profile is stored.

• Customers upload documents from the client area; admins approve or reject from the per-customer review screen. Admins can also upload on a customer's behalf.

A verification record is opened the first time a customer is gated or emailed. The daily cron then, per unverified record:

1. sends reminder #1 after reminder1_days, reminder #2 after reminder2_days;
2. once grace_days elapse, suspends active services (if enabled), terminates already-suspended services (if enabled), and/or sets the account Inactive (if enabled).

Passing verification automatically lifts these (un-suspend, re-activate) and emails the customer.

Deactivating keeps your data. To fully remove the tables, drop the three mod_ekycguard_* tables manually (intentionally not automatic, to avoid accidental data loss).

Proprietary — © arahoster. Use of this module requires a valid arahoster license key and is governed by the arahoster End User License Agreement.