VibeFox Cardcom for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later.

HTTPS: your store must be reachable from the internet over HTTPS, so that Cardcom can send the payment notification.

Currency: the order currency (the currency the customer shops in) must be ILS, USD, EUR or GBP. For any other currency the payment method is hidden at checkout.

Cardcom account: for live payments you need a Cardcom merchant account with a terminal number, an API username and an API password. Payments need only the terminal number and the API username. The API password is used only for refunds from OpenCart. Test mode works without a Cardcom account.

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_cardcom_payment_gateway-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_cardcom_payment_gateway.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_cardcom_payment_gateway-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of this package into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Cardcom Payment Gateway and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Turn on Enable/Disable, leave Test Mode on and click Save. Place a test order with the card 4580 0000 0000 0000, any future expiry date, CVV 123.

5. For real payments turn off Test Mode, enter the Terminal Number, API Username and API Password you received from Cardcom and click Save. Nothing has to be set up in the Cardcom dashboard: the notification and return addresses are sent with every payment.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_cardcom_payment_gateway.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Cardcom Payment Gateway, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key, test the payment and enter the live credentials as in steps 3 to 5 for OpenCart 3. The settings page and its fields are the same in both versions. Only the notification URL is different (see Notification URL).

A new install starts with the payment method turned off and test mode on.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox Cardcom Payment Gateway > Edit. The sections are listed on the left; the Save button under the list saves the whole page. Above the settings the page shows a warning while test mode is on. In live mode it warns you when the terminal number or API username is missing (Cardcom is then hidden at checkout), when the live fields hold the public test terminal 1000 / CardTest1994 (Cardcom is then hidden at checkout too, because no real money would be charged), and reminds you that without the API password refunds from OpenCart are not possible. It also warns you when the default currency of your store is not supported. Without the right to modify the extension the page shows the settings but cannot save them.

When you save, Title must not be empty (at most 128 characters), Sort Order must be a whole number, Total a number of 0 or more, and the geo zone and order statuses must exist; otherwise nothing is saved. When you save live mode with missing or test credentials, the settings are saved with a warning that the gateway stays hidden at checkout until your own terminal number and API username are entered.

Cardcom

Enable/Disable: Enable Cardcom Payment Gateway turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. It is also the payment method name stored in the order. Default: Credit Card (Cardcom). Required.

Description: the text shown to the customer at the Confirm Order step, above the confirm button. Default: Pay securely with your credit card via Cardcom.

Sort Order: the position of Cardcom among the payment methods at checkout. Leave it empty or enter a whole number.

Geo Zone: offer Cardcom only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones.

Total: the checkout total, in the default currency of the store, that an order must reach before Cardcom is offered. Leave it empty to offer Cardcom for any total.

Test mode

Test mode uses the public Cardcom test terminal 1000 (API user CardTest1994). No real money is charged and no Cardcom account is needed. Test card: 4580 0000 0000 0000, any future expiry date, CVV 123. In test mode the Confirm Order step also shows a line with this test card.

Test Mode: enables test mode (terminal 1000, no real money). Default: on. Turn it off to accept real payments with the live credentials below. Refunds are always sent with the credentials of the mode the order was paid in.

Live credentials

The terminal number, API username and API password are provided by Cardcom with your merchant account: in the Cardcom dashboard under API settings, or from Cardcom support. These fields are used only in live mode.

Terminal Number: your Cardcom terminal number. It must contain digits only. If you enter anything else, the other settings are saved with a warning and the previous terminal number is kept.

API Username: your Cardcom API username (ApiName) for this terminal. Spaces are removed on save.

API Password: your Cardcom API password. It is needed only for refunds from OpenCart. The saved password is never shown again: the field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove it, tick Clear the saved API password under the field and click Save.

Payment page

Notification URL: Cardcom sends payment notifications (IndicatorUrl) to this address. On OpenCart 3 it looks like https://your-store/index.php?route=extension/payment/wcp_cardcom_payment_gateway/webhook, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_cardcom_payment_gateway/payment/wcp_cardcom_payment_gateway.webhook. It is built from the storefront address of your OpenCart installation. The address is passed to Cardcom automatically with every payment, together with the order number, so there is nothing to configure in Cardcom. It must be reachable from the internet over HTTPS.

Operation: what Cardcom does on the payment page.

Max Installments: the maximum number of installments (payments) the customer can choose on the Cardcom page, from 1 to 36. 1 means no installments. Default: 1.

Orders

OpenCart creates the order at the Confirm Order step without a status (a missing order). The order gets a status only after Cardcom has confirmed the payment. Each field below lists your OpenCart order statuses.

Success Order Status: the status set after a confirmed payment. Default: Processing.

On Hold (Review) Status: payments that do not match the order (amount, currency, no transaction number) get this status and a note explaining why. Default: Pending, because OpenCart has no On hold status. You can create your own status in System > Localisation > Order Statuses and select it here.

Refunded Status: set after the payment is fully refunded from the order page. Default: Refunded.

Advanced

Debug log: logs API requests and notifications to cardcom_p_debug.log.php in the OpenCart logs folder (storage/logs). The file cannot be opened from the web, and at 5 MB it is rotated. Errors are always logged. Credentials, card tokens and card-holder details are never written. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete on Uninstall: when on, uninstalling the extension permanently removes the settings and the logs. Orders and the Cardcom transactions and refunds are always kept, so old orders can still be refunded after a re-install. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. The API password is not exported.

Import: paste previously exported JSON and click Import to restore the settings. The saved API password is kept.

Checkout

At the Payment Method step the customer chooses the payment method (by default Credit Card (Cardcom)). At the Confirm Order step the customer sees your description and the note You will be redirected to the secure Cardcom payment page. OpenCart creates the order at this step, still without a status. When the customer clicks Confirm Order, the extension creates a Cardcom payment page for the order total in the order currency and sends the customer there. The page opens in Hebrew when the order language is Hebrew, otherwise in English. The order products are passed to Cardcom as the product name. The customer enters the card details and, if installments are allowed, chooses the number of payments. On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options, and clicks Confirm Order at the bottom of the checkout page.

After paying, the customer returns to your store. The order is marked paid only after Cardcom confirms it. Cardcom calls the notification address, and the extension takes from that call only the payment page code. It checks that this code was issued by your store for that order and then asks Cardcom server-to-server for the real result. If the notification is late, the same check runs when the customer comes back. The order then gets its status the standard OpenCart way, with the usual order e-mails and stock update, and the customer sees the OpenCart order success page with Your payment with Cardcom has been received. If Cardcom has not confirmed the payment yet when the customer comes back, a Payment confirmation page shows Your payment is being confirmed by Cardcom. You will receive an e-mail as soon as it is confirmed. with the buttons Check again and Back to checkout; the notification sets the order status as soon as it arrives. On OpenCart 4 the browser does not send the store session when Cardcom sends the customer back, so the extension first shows a short page that opens the same return address again from your store: the customer keeps the cart and the login.

If the payment is not completed or Cardcom declines it, the customer is back at checkout with The card payment was not completed. Please try again or choose a different payment method. On OpenCart 4 this message is shown above the checkout page. The order stays without a status and the cart is kept. The customer can try again: OpenCart 3 creates a new order every time the Confirm Order step is shown, OpenCart 4 keeps one order for the checkout and updates it, and each attempt gets a new Cardcom payment page. Before a new page is created, the open Cardcom pages of this order and of the other orders of the same cart (same customer session and cart contents) from the last 24 hours are checked with Cardcom. If one of them turns out to be paid, that order is confirmed and the customer goes to the success page instead of paying twice. A cart that is already paid by another order is not charged again: the customer goes to the success page. A decline on an older page does not affect a newer attempt.

If the order of the checkout was closed without a payment meanwhile (for example you cancelled it), Confirm Order or the return from Cardcom sends the customer back to the checkout with This order can no longer be paid. Please confirm your order again., and the next Confirm Order pays a new order of the cart. OpenCart 4 keeps the order in the checkout until the success page is shown: if that order already has a status and the cart has changed since (other products or quantities), the customer gets the same message and the changed cart gets a new order and its own payment, while the same cart goes to the success page without a new payment.

If Cardcom cannot open the payment page, the customer stays at the Confirm Order step with a short message above the button, for example Could not connect to Cardcom. Please try again in a moment. or that Cardcom could not open the payment page, with the Cardcom code, and can choose another payment method.

The notification also works while the store is in maintenance mode: OpenCart 3 lets payment extension requests through, and on OpenCart 4 the extension adds a startup action that lets the notification and the customer's return through.

The extension takes card payments on the Cardcom page only. It has no saved cards or one-click payments, no subscriptions, does not charge stored tokens, has no Cardcom invoice or receipt settings, no Bit, Apple Pay, Google Pay or PayPal via Cardcom, no iframe mode and no capture-later deals.

Orders and refunds

Order statuses

No status (missing order): the customer was sent to Cardcom and has not paid, the payment was declined, or Cardcom has not confirmed the payment yet. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders.

Success Order Status (default Processing): the payment was confirmed. A note shows the Cardcom transaction and, when Cardcom reports them, the last four card digits, the invoice number and the number of installments, and how the payment was confirmed (notification, return or a new attempt). Test payments are marked Test mode — no real money was charged.

On Hold (Review) Status (default Pending): Cardcom confirmed a payment that does not match the order, for example a different sum or currency was charged, or Cardcom returned no transaction number. The note explains it, and the order tab shows it under Needs review:. Compare the payment in the Cardcom dashboard with the order, then fulfil it or refund the payment.

Refunded Status (default Refunded): the payment was fully refunded through the extension.

If a second successful payment arrives for an order that already has a status (for example the customer paid in two browser tabs), the order is not changed. A note warns that the customer may have been charged twice and asks you to refund it in the Cardcom dashboard. The same note is added to the paid order when the same cart was paid once more with another order (for example in a second tab); that other order keeps no status.

Notes are entries in the order History that the customer does not see.

VibeFox Cardcom Payment Gateway tab

In Sales > Orders open an order paid with Cardcom. At the bottom of the order page, next to History and Additional, the VibeFox Cardcom Payment Gateway tab shows the Transaction with a Test mode label for test payments, the Payment page (LowProfileCode), the Status, the Card, the Installments, the Invoice, the Card token (with Charge + Save token), the amount Charged, the Order total / refunded, the refund form, the refund history and the Cardcom notes of the order. The tab is shown to users who have access to the extension.

Refunds

In the tab enter the Amount (the amount not refunded yet is filled in), optionally a Reason (optional), and click Refund via Cardcom. Confirm the question Refund this amount through Cardcom? This cannot be undone. Full and partial refunds are supported, and several partial refunds can be made for one order. You need the right to modify the extension (set in System > Users > User Groups). Refunds are made in the amount and currency Cardcom charged, so after an amount or currency mismatch you can refund up to what the customer actually paid, not the order total. The refund is sent with the credentials of the mode the order was paid in: test orders are refunded on the Cardcom test terminal even after you switched to live mode, and live orders always use your live credentials. Live refunds need the API Username and API Password. If Cardcom does not accept the refund, the tab shows the error and no refund is recorded. A successful refund is added to the refund history and the notes with the Cardcom refund transaction and the reason. A full refund sets the order to Refunded Status without notifying the customer and without returning products to stock, like a manual status change. A partial refund does not change the status.

Product returns in Sales > Returns do not send money back through Cardcom. Refunds made in the Cardcom dashboard are not reported back to the store.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox Cardcom Payment Gateway is the first block on Extensions > Extensions > Payments > VibeFox Cardcom Payment Gateway > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-cardcom and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain: the store address from the OpenCart configuration. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, Cardcom is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed, and refunds work.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

Cardcom does not appear at checkout: check that the license is active, Enable/Disable is on and the customer's currency is ILS, USD, EUR or GBP. In live mode check that Terminal Number and API Username are filled in with your own credentials, not the test terminal 1000 / CardTest1994. The settings page shows a warning when something is missing. Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings.

The payment went through, but the order stays without a status: Cardcom could not reach your store, for example because of a firewall, password protection or a local development site. The notification address must be reachable from the internet over HTTPS. The order also gets its status when the customer returns to the store after paying. Turn on Debug log and look at the Log field on the extension page.

Notification answers Missing or invalid lowprofilecode or Unknown lowprofilecode for this order: the call did not carry a payment page code issued by your store for that order. Nothing is changed.

Notification answers Gateway not configured or Indicator check failed: the credentials of the mode the payment page was created in are missing, or Cardcom could not be reached for the check. Nothing is changed; the payment is checked again when the customer returns to the store.

Notification answers Busy, retry: the order was being confirmed by another request at the same moment, or the order status could not be set. Turn on Debug log to see the reason.

Notification answers ReturnValue mismatch or Terminal mismatch: Cardcom reported a payment for another order or another terminal. Nothing is changed. Check that Terminal Number is the terminal of your account.

The notification URL shows Missing or invalid lowprofilecode in the browser: this is normal. The URL accepts only calls from Cardcom.

The customer sees Payment error: this currency is not supported by Cardcom.: the order currency is not ILS, USD, EUR or GBP.

The customer sees Card payment is temporarily unavailable. Please choose another payment method.: live mode is on, but the terminal number or API username is missing, or the live fields hold the public test terminal.

The customer sees This payment method is not available. after Confirm Order: the checkout session no longer matches the order, or the payment method was turned off meanwhile. The customer reloads the checkout.

The customer sees another error after Confirm Order: turn on Debug log and look at the Log field. Connection problems and Cardcom error codes are written there.

Order is in the review status after payment: read the notes or Needs review: in the VibeFox Cardcom Payment Gateway tab. The paid amount or currency differed from the order. Fulfil the order or refund the payment.

No refund form in the tab: the tab says why: the transaction is not confirmed yet, the payment is fully refunded, your user group has no right to modify the extension, or the API username and password of the payment's mode are missing.

Refund fails with API username and API password are required for refunds: enter the API Password (and API Username) in the settings and try again.

Refund fails with Could not connect to Cardcom: check the Cardcom dashboard before you try again, because the refund may or may not have been made.

For developers: the extension triggers the OpenCart events cardcom_p_supported_currencies, which extends the list of currencies (add only currencies enabled on your Cardcom terminal), and cardcom_p_low_profile_params, which changes the parameters of the payment page before it is created.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox Cardcom Payment Gateway. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable/Disable, Sort Order, Geo Zone, Total and the order statuses of the Orders section, which return to their defaults on a re-install. The OpenCart event of the extension is removed too (on OpenCart 4 its events and its startup action, which lets Cardcom through in maintenance mode). If Delete on Uninstall is on, the other gateway settings (title, description, test mode, credentials, payment page options, logging) and the log are removed. If it is off, they are kept for a later re-install. The Cardcom transactions and refunds are always kept, so orders paid before can still be refunded after a re-install. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox Cardcom Payment Gateway in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

Cardcom is a trademark of its respective owner. This extension is not affiliated with or endorsed by Cardcom.