VibeFox Adyen for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later.

Adyen account: you need your Adyen merchant account name, an API key and an HMAC key for each environment you use (test and live), and for live payments the live URL prefix. The API key belongs to an API credential with the Checkout webservice and Merchant PAL webservice roles. The HMAC key is generated for the Standard webhook (see Configuration). The test Customer Area is ca-test.adyen.com, the live one ca-live.adyen.com. Test and live keys are separate. No client key is needed, because the payment page is hosted by Adyen.

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_adyen_gateway-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_adyen_gateway.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_adyen_gateway-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of the archive into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Adyen Gateway and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Enter your merchant account, the test API key and the test HMAC key, and later the live API key, live HMAC key and live URL prefix.

5. In the Adyen Customer Area (test and live) add a Standard webhook with the URL shown in the Webhook section of the settings (see Configuration).

6. Turn on Enable/Disable and click Save. Test a payment with Test mode on, then turn it off.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_adyen_gateway.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the extension type Payments. Find VibeFox Adyen Gateway, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key and the settings as in steps 3 to 6 for OpenCart 3. The settings page and its fields are the same in both versions. Only the webhook URL is different (see Webhook).

A new install starts with the payment method turned off and test mode on.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox Adyen Gateway > Edit. The sections are listed on the left; the Save button under the list saves the whole page. While the settings of the current mode are incomplete, the page shows Adyen is hidden at checkout until the test settings are complete (or live settings) and lists what is missing: Merchant account, the API key, the HMAC key and, in live mode, Live URL prefix. While test mode is on, the page shows Test mode is on: payment links and refunds go to the Adyen test environment, no real money. Without the right to modify the extension the page shows the settings but cannot save them.

When you save, Title must have 1 to 128 characters, Sort Order must be a whole number and Total a number of 0 or more, and the geo zone and order statuses must exist; otherwise nothing is saved and the page names the field. An HMAC key that is not hexadecimal and a live URL prefix with other characters than letters, digits and dashes are not saved: a warning names the field, the previous value is kept, and the other settings are saved.

Adyen

Enable/Disable: Enable Adyen payment gateway turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. It is also the payment method name stored in the order. Default: Adyen. Required, up to 128 characters.

Description: the text shown to the customer at the Confirm Order step, above the confirm button. Default: Pay securely via Adyen.

Sort Order: the position of Adyen among the payment methods at checkout. Leave it empty or enter a whole number.

Geo Zone: offer Adyen only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones.

Total: the checkout total, in the default currency of the store, that an order must reach before Adyen is offered. Leave it empty to offer Adyen for any total.

Adyen account

API keys are created in the Adyen Customer Area under Developers > API credentials (the section links to the test and live Customer Area). Fill in both sets of keys; the Test mode switch selects which one is used.

Test mode: uses the Adyen test environment (no real money). When on, payment links and refunds go to checkout-test.adyen.com with the test API key. Default: on. Turn it off to take real payments. While it is on, customers see Test mode: no real payment is taken. at the Confirm Order step.

Merchant account: your Adyen merchant account name (not the company account), for example MyShopECOM. It is usually the same in the test and live Customer Area.

Test credentials

Used while Test mode is enabled.

Test API key: from the test Customer Area: Developers > API credentials > your credential > API key.

Test HMAC key: from the test Customer Area: Developers > Webhooks > your Standard webhook > HMAC key (hexadecimal). Required: webhooks without a valid signature are rejected.

Live credentials

Used when Test mode is disabled.

Live API key: from the live Customer Area: Developers > API credentials > your credential > API key.

Live HMAC key: from the live Customer Area: Developers > Webhooks > your Standard webhook > HMAC key (hexadecimal).

Live URL prefix: from the live Customer Area: Developers > API URLs, for example 1797a841fbb37ca7-AdyenDemo from https://1797a841fbb37ca7-AdyenDemo-checkout-live.adyenpayments.com. You can paste the whole URL; the prefix is taken from it when you save.

Saved API keys and HMAC keys are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove a saved key, tick Clear the saved value on save under the field and click Save.

Webhook

Orders are marked as paid only by Adyen webhooks. In the Customer Area (test and live) go to Developers > Webhooks and add a Standard webhook with the URL shown in Webhook URL in this section. On OpenCart 3 it looks like https://your-store/index.php?route=extension/payment/wcp_adyen_gateway/webhook, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_adyen_gateway/payment/wcp_adyen_gateway.webhook. It is built from the storefront address of your OpenCart installation. Copy the URL exactly as the settings show it, because Adyen does not follow redirects. Choose the method JSON, enable Generate HMAC key and copy the key into Test HMAC key or Live HMAC key.

The environment of each notification selects the HMAC key, and a notification is applied only to a payment link created in the same environment and merchant account. A test notification never confirms a live payment. Webhooks without a valid signature are rejected with HTTP 401, and Adyen retries them later. Without the webhook, no order gets a status.

The extension handles these events (they are also listed in this section):

Other events are added to the order notes. Notifications for an order without a status, other than AUTHORISATION, are ignored. Notifications that are not for an order of this store, for example the test button in the Customer Area, are accepted and ignored. The webhook also works while the store is in maintenance mode, because OpenCart lets payment extension requests through. On OpenCart 4 the extension adds a startup action for this.

Orders

OpenCart creates the order at the Confirm Order step without a status (a missing order). It gets a status only when Adyen confirms the payment with the signed AUTHORISATION webhook and the amount and currency match the order. The customer's return never changes the order. Each field below lists your OpenCart order statuses.

Order status after payment: the status set by a successful AUTHORISATION webhook. Default: Processing.

On hold (review) status: an amount or currency mismatch, a failed capture of a paid order, or a payment received after the order status was changed (for example cancelled). A note explains why. Default: Pending, because OpenCart has no On hold status. You can create your own status in System > Localisation > Order Statuses and select it here.

Cancelled status: set when Adyen cancels the payment of the order (CANCELLATION). Default: Canceled.

Refunded status: set after the payment is fully refunded from the order page. If Adyen then reports that this refund failed, the order goes to the review status with a note. Default: Refunded.

Advanced

Debug log: writes API calls and webhook events to adyg_debug.log.php in the OpenCart logs folder (storage/logs). The file cannot be opened from the web, and at 5 MB it is moved to adyg_debug.old.log.php. Errors are always logged, also when the switch is off. Logs never contain API or HMAC keys or shopper personal data. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete data on uninstall: when on, uninstalling the extension removes the gateway settings and the log. The Adyen payment records (PSP references, webhook events, refunds) always stay, so old orders remain refundable. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. API and HMAC keys are not exported.

Import: paste previously exported JSON and click Import to restore the settings. Saved keys are kept.

Checkout

At the Payment Method step the customer chooses the payment method (by default Adyen). At the Confirm Order step the customer sees your description and the note You will be redirected to Adyen to complete the payment securely. OpenCart creates the order at this step, still without a status. When the customer clicks Confirm Order, the extension creates an Adyen payment link for the order total in the order currency and sends the customer to the Adyen payment page. There the customer pays with any method enabled in your Adyen account. The customer's e-mail, name and billing country (or the store country) and the store language are passed to Adyen, and the payment shows as Order # and the order number.

After paying, the customer returns to your store. The return itself does not pay an order: the order is marked paid only after Adyen confirms it with the signed AUTHORISATION webhook and the amount and currency match the order. The order then gets its status the standard OpenCart way, with the usual order e-mails and stock update. If the webhook has already arrived, the customer sees the OpenCart order success page with Your payment with Adyen has been received. (or Your payment with Adyen has been received and is being reviewed by the store. for an order on review). If Adyen cancelled the payment before that, the page shows Your Adyen payment was not completed. Please contact us about this order. If the webhook has not arrived yet, a Payment confirmation page shows Your payment is being confirmed by Adyen. Your order will be confirmed as soon as Adyen confirms the payment, and you will receive an e-mail. with the buttons Check again and Back to checkout, for a customer who did not complete the payment.

If the payment is refused, the order stays without a status and the customer can pay the same link again or go back to checkout. Each new attempt (OpenCart 3 creates a new order every time the Confirm Order step is shown, OpenCart 4 updates the order of the checkout) expires the previous payment links of the order and the cart, so they cannot be paid as well. If the order already has a status, the customer goes to the success page instead of a new payment.

On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options, and clicks Confirm Order at the bottom of the checkout page. The payment address is optional on OpenCart 4: without it, the customer's name is passed as the payer name and the country of the shipping address (or the store country) as the country. OpenCart 4 keeps one order for the checkout and updates it: Back to checkout and a new Confirm Order create a new payment link for the same order and expire the previous one. If that order was closed without a payment meanwhile (for example Adyen cancelled the payment or you cancelled the order), the customer is sent back to the checkout with Your previous order was cancelled without a payment. Please confirm the order again to pay with a new order. above the checkout page, and the next Confirm Order pays a new order. If the order of the checkout was already paid for a different cart, the customer is sent back to the checkout and pays a new order. A change of the cart, including a new quantity, counts as a new cart that needs its own payment.

If the payment link cannot be created, the customer stays at the Confirm Order step with Payment could not be initiated. Please try again or choose another payment method. The reason is written to the log. If the settings are incomplete, the message is Payment gateway is not configured properly. Please contact the store administrator.

The extension has no subscriptions or recurring payments, no saved cards, no on-site card fields (Drop-in or Components), no capture or cancel buttons in OpenCart and no basic authentication for webhooks.

Orders and refunds

Order statuses

No status (missing order): the customer was sent to Adyen and has not paid, the payment was refused, or Adyen has not confirmed the payment yet. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders.

Order status after payment (default Processing): the payment was authorised. A note shows the amount, the PSP reference and the payment method.

On hold (review) status (default Pending): Adyen confirmed a different amount or currency than the order total, a capture failed, a full refund failed, or the payment arrived after the order status had been changed, for example cancelled. The note explains it. Check the payment in the Customer Area, then fulfil the order or refund the payment. A correct payment for an order on review after a mismatch marks it paid.

Cancelled status (default Canceled): the payment of this order was cancelled in Adyen.

Refunded status (default Refunded): the payment was fully refunded through the extension. It is set when the refund is sent; if Adyen later reports that this refund failed, the order goes to the review status.

If a second successful payment arrives for an order that is already paid, for example from an old payment link, the order is not changed. A note asks you to check the Customer Area for a duplicate charge and refund it there if needed. The same applies to a cart: once one order of the cart is paid, no new payment link is created for another order of that cart, and a payment that still arrives for such an order does not give it a status; the paid order gets the note.

On OpenCart 4 an unpaid order of the checkout can get the status Voided, which OpenCart 4 sets when the customer comes back to the Confirm Order step. The extension treats such an order as an order without status, and a later payment still confirms it.

Notes are entries in the order History that the customer does not see.

VibeFox Adyen Gateway tab

In Sales > Orders open an order paid with Adyen. At the bottom of the order page, next to History and Additional, the VibeFox Adyen Gateway tab shows the PSP reference with a Test mode label for test payments, the Payment link, the Merchant account, the payment Status, the amounts Paid / refunded, the refund form, the refund history and the Adyen notes of the order. The tab is shown to users who have access to the extension.

Refunds

In the VibeFox Adyen Gateway tab enter the Amount (the amount not refunded yet is filled in), optionally a Reason (optional), and click Refund via Adyen. Confirm the question Refund this amount through Adyen? This cannot be undone. Full and partial refunds are supported. You need the right to modify the extension (set in System > Users > User Groups). Refunds are made in the amount and currency Adyen authorised, so after an amount or currency mismatch you can refund up to what the customer actually paid, not the order total. The refund is sent to the environment and merchant account the payment was made with, so that environment's API key must be set. Only one refund of an order runs at a time. If Adyen does not accept the request, the tab shows the error and no refund is recorded. Refunds are available once Adyen has authorised the payment.

Adyen processes refunds asynchronously: the request is added to the refund history and the notes with the status received, and the final result arrives by the REFUND or REFUND_FAILED webhook. A failed refund no longer counts as refunded. When the refunds sent reach the amount paid, the order is set to Refunded status without notifying the customer and without returning products to stock, like a manual status change. A partial refund does not change the status. With manual capture in Adyen, only captured payments can be refunded.

Product returns in Sales > Returns do not send money back through Adyen. Refunds made in the Adyen Customer Area arrive by webhook and are added to the notes. The order status is not changed automatically.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox Adyen Gateway is the first block on Extensions > Extensions > Payments > VibeFox Adyen Gateway > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-adyen and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain: the store address from the OpenCart configuration. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, Adyen is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed, and refunds work.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

Adyen does not appear at checkout: check that the license is active, Enable/Disable is on and the settings of the current mode are complete: Merchant account, the API key and the HMAC key of that mode, and in live mode Live URL prefix. The settings page lists what is missing. Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings.

The payment went through, but the order stays without a status: the webhook is not working. In the Customer Area of the environment you use (test or live) check that the Standard webhook exists, that its URL is exactly the one shown in Webhook URL and that the method is JSON. Check that the HMAC key of that webhook is in the matching field (Test HMAC key or Live HMAC key). With an invalid or missing HMAC key the extension answers HTTP 401 and Adyen retries the delivery later, so the order gets its status automatically once the key is fixed. The log shows that the HMAC signature is invalid or the HMAC key is not configured.

Webhook answers [rejected] HMAC key not configured: the HMAC key of the notification's environment is empty. Paste it into the settings.

Webhook answers [rejected] invalid HMAC signature: the HMAC key belongs to another webhook or another environment. If one item of a batch has a wrong signature, the whole batch is rejected.

Webhook answers [rejected] busy, retry later: the order was being processed by another delivery at the same moment, or processing failed. Adyen retries the webhook automatically. The reason is in the log.

The webhook URL shows [rejected] POST required in the browser: this is normal. The URL accepts only notifications from Adyen.

The HMAC key warning on save: the field must contain the hexadecimal HMAC key from the Customer Area. The previous value was kept.

The customer sees Payment could not be initiated: look at the Log field on the extension page (errors are always logged). Check the API key, the merchant account and, in live mode, the live URL prefix.

The customer sees This payment method is not available. Please reload the checkout page.: the checkout session no longer matches the order, or the payment method was turned off meanwhile. The customer reloads the checkout.

Order is in the review status after payment: read the notes in the VibeFox Adyen Gateway tab. The amount or currency confirmed by Adyen did not match the order, a capture failed, or the payment came after the order status had been changed.

No refund form in the tab: the tab says why: Adyen has not authorised the payment yet, it is fully refunded, your user group has no right to modify the extension, or the credentials of the environment the payment was made in are not configured.

Refund fails: the tab shows the message from Adyen. With manual capture, only captured payments can be refunded. If another refund of the order is running, wait a moment and try again.

For developers: before the payment link is created, the extension triggers the OpenCart event adyg_payment_link_request with the request data and the order.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox Adyen Gateway. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable/Disable, Sort Order, Geo Zone, Total and the order statuses of the Orders section, which return to their defaults on a re-install. The OpenCart event of the extension is removed too (on OpenCart 4 its events and its startup action, which lets the webhook through in maintenance mode). If Delete data on uninstall is on, the other gateway settings (title, description, test mode, merchant account, keys, live URL prefix, logging) and the log are removed. If it is off, they are kept for a later re-install. The Adyen payment records (PSP references, webhook events, refunds) are always kept, so orders paid before can still be refunded after a re-install. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox Adyen Gateway in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

Adyen is a trademark of its respective owner. This extension is not affiliated with or endorsed by Adyen.