VibeFox HyperPay for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later with the OpenSSL extension (it decrypts the webhooks).

HyperPay account: HyperPay issues the Access Token and Entity ID when your merchant account is set up. Test and live credentials are different. You also need a payment webhook in the HyperPay dashboard and its decryption key (webhook key), shown under Administration > Webhooks (see Configuration).

Card data: the card is entered only in the HyperPay widget, so card data never touches your server (PCI DSS SAQ A).

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_hyperpay_payment_gateway-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_hyperpay_payment_gateway.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_hyperpay_payment_gateway-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of this package into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox HyperPay Payment Gateway and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Enter the test Access Token, Entity ID and webhook key issued by HyperPay and keep Test Mode on.

5. In the HyperPay dashboard (Administration > Webhooks) add a payment webhook with the URL shown in the Webhook section and copy its decryption key into the webhook key field of the same mode.

6. Turn on Enable/Disable, click Save and make a test payment with a HyperPay test card. Then enter the live credentials and turn Test Mode off.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_hyperpay_payment_gateway.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the type Payments. Find VibeFox HyperPay Payment Gateway, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key, the HyperPay credentials and the webhook as in steps 3 to 6 for OpenCart 3. The settings page and its fields are the same in both versions. Only the webhook URL is different (see Webhook).

A new install starts with the payment method turned off and test mode on.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox HyperPay Payment Gateway > Edit. The sections are listed on the left; the Save button under the list saves the whole page. Above the settings the page shows Test mode is on: payments go to the HyperPay test system and no real money is charged. while test mode is on. It warns you when the Access Token or Entity ID of the current mode is missing (the payment method is then not shown at checkout), and when the current mode has no valid webhook key (payments are then confirmed only when the customer returns to the store). Without the right to modify the extension the page shows the settings but cannot save them.

When you save, Title must not be empty and at most 128 characters, Transaction Type must be valid, Sort Order must be a whole number, Total a number, 0 or greater, and the geo zone and order statuses must exist; otherwise nothing is saved. Spaces are removed from the credentials. The settings are saved with a warning if a webhook key is not a 64-character hexadecimal key or no payment brand is ticked.

HyperPay

Enable/Disable: Enable HyperPay Payment turns the payment method on or off. Default: off.

Title: the title the customer sees during checkout. It is also the payment method name stored in the order. Default: Credit/Debit Card (HyperPay). Required.

Description: the text shown to the customer at the Confirm Order step, above the confirm button, under a card icon. Default: Pay securely using your credit or debit card.

Sort Order: the position of HyperPay among the payment methods at checkout. Leave it empty or enter a whole number.

Geo Zone: offer HyperPay only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones.

Total: the checkout total, in the default currency of the store, that an order must reach before HyperPay is offered. Leave it empty to offer HyperPay for any total.

API credentials

The Access Token, Entity ID and webhook key are issued by HyperPay when your merchant account is set up. Test and live credentials are different. The webhook key is shown in the HyperPay dashboard under Administration > Webhooks. The section links to the HyperPay website and the developer documentation.

Test Mode: uses the HyperPay test system (eu-test.oppwa.com) and the test credentials. No real money is charged. Turn it off to accept real payments with the live credentials (eu-prod.oppwa.com). Default: on. While it is on, customers see Test mode: no real payment will be made. at the Confirm Order step.

Test Access Token: the bearer token of your HyperPay test account.

Test Entity ID: the Entity ID of the test payment channel.

Test Webhook Key: the 64-character hexadecimal key used to decrypt webhook notifications of the test system.

Live Access Token: the bearer token of your HyperPay live account.

Live Entity ID: the Entity ID of the live payment channel.

Live Webhook Key: the 64-character hexadecimal key used to decrypt webhook notifications of the live system.

Saved access tokens and webhook keys are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove a saved value, tick Clear the saved value on save under the field and click Save.

Webhook

The webhook tells your store about payments even when the customer closes the browser before returning to the store. In the HyperPay dashboard (Administration > Webhooks) add a webhook for payments with the URL shown in Webhook URL in this section. On OpenCart 3 it looks like https://your-store/index.php?route=extension/payment/wcp_hyperpay_payment_gateway/webhook, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_hyperpay_payment_gateway/payment/wcp_hyperpay_payment_gateway.webhook. It is built from the storefront address of your OpenCart installation. Copy the URL exactly as the settings show it. Then copy the webhook decryption key into Test Webhook Key or Live Webhook Key, for the same mode.

HyperPay webhooks are encrypted (AES-256-GCM). A webhook that cannot be decrypted with your keys is rejected. Only payment notifications are processed, and the payment must belong to a checkout of one of your orders, created in the same mode as the key that decrypted it. HyperPay test notifications are acknowledged. The webhook also reports captures, reversals, refunds and chargebacks made in the HyperPay dashboard (see Orders and refunds). Without the webhook, a payment is confirmed only when the customer returns to the store after paying. The webhook also works while the store is in maintenance mode: OpenCart 3 lets payment extension requests through, and on OpenCart 4 the extension adds a startup action that lets the webhook and the customer's return from HyperPay through.

Payment

Transaction Type: how the card is charged.

Payment Brands: the brands shown in the payment widget: VISA, Mastercard, mada, American Express, STC Pay, Apple Pay. Default: VISA and Mastercard. If no brand is ticked, the page warns you and the widget shows VISA and Mastercard. Select only brands that HyperPay enabled for your Entity ID; mada, STC Pay and Apple Pay often use their own entity, which this extension does not support.

Orders

OpenCart creates the order at the Confirm Order step without a status (a missing order). The order gets a status only after HyperPay has confirmed the payment. A declined or abandoned payment leaves it without a status, and the cart is kept. Each field below lists your OpenCart order statuses. OpenCart has no On hold status, so three of them default to Pending; you can create your own statuses in System > Localisation > Order Statuses and select them here.

Order Status After Payment: set when HyperPay confirms a debit with the right amount and currency, or a pre-authorization is captured. Default: Processing.

Authorized (Capture Required) Status: a pre-authorization reserved the amount; capture it in the tab of the order. A reversal in the HyperPay dashboard cancels the order while it has this status. Default: Pending.

Awaiting Payment Status: HyperPay reported a payment that waits for a confirmation; the webhook confirms it later. Default: Pending.

On Hold (Review) Status: the paid amount or currency differs from the order, or a payment arrived after the order was cancelled. A note explains the reason. Default: Pending.

Canceled Status: set when the pre-authorization is reversed in HyperPay. A payment for an order in this status puts it on hold instead of reopening it. Default: Canceled.

Refunded Status: a payment received for an order in this status is only noted; the order is not changed. Default: Refunded.

Advanced

Enable Logging: logs API requests and responses to hyperpay_p_debug.log.php in the OpenCart logs folder (storage/logs). The file cannot be opened from the web, and at 5 MB it is moved to hyperpay_p_debug.old.log.php. Errors and warnings are always logged. Logs contain no card data, keys or customer data. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete Data on Uninstall: when on, uninstalling the extension removes the settings and the log files. Orders and the HyperPay payment attempts are always kept, because late webhooks and captures of existing orders need them. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. Access tokens and webhook keys are not exported.

Import: paste previously exported JSON and click Import to restore the settings. Saved access tokens and webhook keys are kept.

Checkout

At the Payment Method step the customer chooses the payment method (by default Credit/Debit Card (HyperPay)). At the Confirm Order step the customer sees your description. OpenCart creates the order at this step, still without a status. When the customer clicks Confirm Order, the extension prepares a HyperPay checkout for the order total in the order currency and opens the HyperPay payment page of your store with the HyperPay widget and Please complete your payment below:. The widget uses the customer's language when HyperPay supports it. In test mode the page shows Test mode: use a HyperPay test card, no real payment will be made. The customer enters the card details in the widget, or follows Choose another payment method back to checkout. Reloading the page reuses the same checkout for up to 25 minutes while the order total does not change; after that a new checkout is prepared.

On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options, and clicks Confirm Order at the bottom of the checkout page. By default OpenCart 4 does not ask for a payment address; the extension then sends the shipping address to HyperPay as the billing address.

After paying, the customer returns to your store. The extension checks that the payment belongs to one of this order's checkouts and asks HyperPay for the result with a server-to-server request, in the mode the checkout was created in. The order is marked paid only after HyperPay confirms it: by that request or by the webhook. The amount and currency must match the order. A return and a webhook arriving at the same moment, and results for two orders of the same cart, are handled one after the other, so the payment is never applied twice. The order then gets its status the standard OpenCart way, with the usual order e-mails and stock update, and the customer sees the OpenCart order success page.

If the payment did not go through, the customer is back at checkout with a message: Payment failed: and the reason from HyperPay, Payment was not completed. Please try again., or We could not confirm your payment yet. If you were charged, the order will be updated automatically; otherwise please try again. The cart is kept, and the customer can pay again. If the payment form cannot be prepared, the customer stays at the Confirm Order step with a short message, for example that some billing details were not accepted by the payment provider, or that the payment form is not available because of a payment configuration error. The technical reason is written to the log.

On OpenCart 4 these messages are shown above the checkout page. OpenCart 3 creates a new order every time the Confirm Order step is shown; OpenCart 4 updates the order of the checkout, so after a declined payment the customer pays the same order with a new payment attempt. If the same cart has already been paid through another order, the customer goes to the success page instead of paying again. A change of the cart, including a new quantity, counts as a new cart that needs its own payment.

OpenCart 4 keeps the order in the checkout until the success page is shown. If that order was closed meanwhile without a payment (for example you cancelled it), the customer is sent back to the checkout with Payment failed. Please try again or use another card. If it was paid and then cancelled or refunded, the message is Your previous order was closed by the store. Please confirm the order again to pay with a new order. If it is already paid and the cart now holds a new purchase, the message is Your previous order #(number) has already been placed. Your cart has changed: please confirm the new order to pay for it. In each case the next Confirm Order pays a new order of the cart. A paid order is never shown as paid for a different cart.

Amounts are sent with two decimals, as the HyperPay API requires. In 3-decimal currencies (KWD, BHD, JOD, OMR) the order total is rounded to two decimals.

The extension has no refunds or voids from OpenCart, no saved cards or tokenization, no subscriptions, no Apple Pay domain verification, no separate entity per brand and no Tabby, Tamara or other buy-now-pay-later methods.

Orders and refunds

Order statuses

No status (missing order): the customer was sent to the payment page and has not paid, the payment was declined, or HyperPay has not confirmed the payment yet. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders.

Order Status After Payment (default Processing): a debit payment was confirmed, or a pre-authorization was captured. A note shows the HyperPay result code, description and payment ID. If HyperPay flagged the payment for manual review, the note says so; check it in the HyperPay dashboard before shipping.

Authorized (Capture Required) Status (default Pending): the amount was reserved by a pre-authorization. Capture it in the tab of the order or in the HyperPay dashboard; the capture webhook then moves the order to Order Status After Payment.

Awaiting Payment Status (default Pending): HyperPay reported the payment as pending. The order moves to Order Status After Payment when HyperPay confirms it.

On Hold (Review) Status (default Pending): HyperPay reported a different amount or currency than the order (for example, the cart was changed after the payment page was opened), or the payment arrived after the order had been cancelled. The note explains it. Check the payment in the HyperPay dashboard, then fulfil the order or refund the payment.

Canceled Status (default Canceled): a pre-authorization was reversed in the HyperPay dashboard, and the reversal webhook cancels the authorized order.

A declined result never changes an order that already has a status. If another successful payment arrives for an order that is already paid, or another order of an already paid cart is paid, the paid order is not changed. A note asks you to refund the duplicate in the HyperPay dashboard. A successful payment for an order in the Refunded Status only adds a note.

Notes are entries in the order History that the customer does not see.

VibeFox HyperPay Payment Gateway tab

In Sales > Orders open an order paid with HyperPay. At the bottom of the order page, next to History and Additional, the VibeFox HyperPay Payment Gateway tab shows the payment ID (and the capture ID after a capture) with a Test mode label for test payments, the transaction type, the checkout ID, the merchant transaction ID, the amount sent to HyperPay, the result and the HyperPay notes of the order. The tab is shown to users who have access to the extension.

Capture

For a pre-authorized order that is not captured yet, the tab shows Capture payment with the amount. Click it and confirm Capture the pre-authorized amount through HyperPay?. The current order total is captured, in the mode the pre-authorization was made in, so that mode's Access Token and Entity ID must be set. You need the right to modify the extension (set in System > Users > User Groups). After a successful capture the order gets Order Status After Payment and the capture ID is added to the tab and the notes. The status is written directly, without order e-mails or stock update. If HyperPay refuses the capture, the result code and description are shown and added to the notes, and the order stays authorized. A double click does not capture twice. Reversing (voiding) a pre-authorization is done in the HyperPay dashboard.

Refunds

Refunds from OpenCart are not supported. Product returns in Sales > Returns do not send money back through HyperPay. Refund the payment in the HyperPay dashboard. Refunds and chargebacks made in HyperPay are added to the order as a note by the webhook; the order status is not changed. Update it manually if needed.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox HyperPay Payment Gateway is the first block on Extensions > Extensions > Payments > VibeFox HyperPay Payment Gateway > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-hyperpay and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain: the store address from the OpenCart configuration. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, HyperPay is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed, and captures and refunds work.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

HyperPay does not appear at checkout: check that the license is active, Enable/Disable is on and the current mode has its Access Token and Entity ID: the test ones in test mode, the live ones in live mode. The settings page shows a warning when they are missing. Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings.

The payment went through, but the order stays without a status: the webhook is not working and the customer did not return to the store. In the HyperPay dashboard check that the payment webhook exists for the mode you use, that its URL is exactly the one shown in Webhook URL, and that its decryption key is in the webhook key field of the same mode. Turn on Enable Logging and look at the Log field on the extension page.

Webhook answers Decryption failed: the webhook key belongs to another webhook or another mode. Copy the key again from the HyperPay dashboard.

Webhook answers Webhook key not configured: no valid webhook key is set. Paste the 64-character key into the settings. HyperPay retries the webhook.

Webhook answers Busy, retry later: the order was being processed by another request at the same moment, or the order status could not be set. HyperPay retries the webhook. The reason is in the log.

Log shows Webhook ignored: the payment does not belong to an order of this store, or it was made in the other mode. Test and live payments are kept apart.

The webhook URL shows Method not allowed in the browser: this is normal. The URL accepts only POST requests from HyperPay.

The payment form does not load: look at the log. A configuration error usually means a wrong Access Token or Entity ID for the current mode. A message about billing details means HyperPay did not accept some customer data. Make sure the selected Payment Brands are enabled for your Entity ID.

The customer sees The payment session was not found. Please confirm the order again.: the payment page link is no longer valid for this order. The customer confirms the order again at checkout.

Order is in the on hold status: read the notes in the tab of the order (see Order statuses), check the payment in the HyperPay dashboard, then fulfil the order or refund the payment.

Capture fails: read the result code and description in the tab and the notes. The capture is sent in the mode of the pre-authorization, so that mode's credentials must be set; otherwise the tab says that the Access Token / Entity ID of that mode are empty.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox HyperPay Payment Gateway. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable/Disable, Sort Order, Geo Zone, Total and the order statuses of the Orders section, which return to their defaults on a re-install. On OpenCart 4 its events and its startup action, which lets the webhook and the customer's return through in maintenance mode, are removed too. If Delete Data on Uninstall is on, the other settings (title, description, test mode, credentials, webhook keys, transaction type, brands, logging) and the log files are removed. If it is off, they are kept for a later re-install. The HyperPay payment attempts are always kept, so late webhooks and captures of existing orders still work after a re-install. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox HyperPay Payment Gateway in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

HyperPay is a trademark of its respective owner. This extension is not affiliated with or endorsed by HyperPay.