f000

Yes, as you say, payment transaction ID from gateway has to be unique... Unfortunately WHMCS API does not check this so there can be multiple orders with same Trans ID! Is it a bug or a feature?

Anyway, the easiest solution might be the right one: "addinvoicepayment" call has transid param for ID of transaction from payment gateway. I think this has to be unique... Right response from API should be something like "result=errortransid;message=transid is not unique!"

tnx Klangaroo, your solution is fine, but I don't want to use direct access to WHMCS database... I would prefer solution within WHMCS API which is much cleaner way ... HTTP request from the gateway is even signed with OpenSSL checksum in special GET param. The problem is that malicious user can capture request URL and resubmit it several times...

Hi, I'm using addinvoicepayment API for callbacks from my custom payment gateway. I've got problem with multiple entered payments - there's no way to check if that invoice is already paid, so any malicious user can repeatedly submit callback URL from payment gateway to get credit because callback from the gateway is just plain HTTP request with GET params... One solution would be to add new parameter to the addinvoicepayment API call - something like "ifnotpaid" (mentioned in post http://forum.whmcs.com/showthread.php?t=7472#9) or to add another API function like "Get Invoice Data" or simple "Get Invoice Status". thanks