VibeFox Khipu for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later.

Currency: Chilean peso (CLP), Argentine peso (ARS) or Peruvian sol (PEN). The currency must exist in System > Localisation > Currencies. Khipu is offered only while the customer pays in one of these currencies; for other currencies the payment method is hidden at checkout.

Khipu account: you need the Receiver ID ("Id de cobrador"), the API key and the secret key of your Khipu collection account. You find them in your Khipu account under the merchant profile (khipu.com/merchant/profile). All three are required: without them Khipu is not offered at checkout, and without the secret key no payment can be confirmed. Nothing needs to be configured in the Khipu account.

Reachable store: Khipu confirms payments by calling your store, so the notification URL must be reachable from the internet, without password protection or a firewall blocking Khipu. Maintenance mode of the store does not block it.

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_khipu_gateway-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_khipu_gateway.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_khipu_gateway-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of this package into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Khipu Gateway and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Enter the Receiver ID, API key and Secret key of your Khipu collection account (see Configuration).

5. Turn on Enable / Disable and click Save. To test first, use the keys of a Khipu developer account, then replace them with the keys of your production account.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_khipu_gateway.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Khipu Gateway, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key and the Khipu keys as in steps 3 to 5 for OpenCart 3. The settings page and its fields are the same in both versions. Only the notification URL is different (see Payment notifications).

A new install starts with the payment method turned off.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox Khipu Gateway > Edit. The sections are listed on the left; the Save button under the list saves the whole page. Above the settings the page warns you when the Receiver ID, API key or secret key is missing (Khipu is then not offered at checkout) and when the default currency of the store is not supported by Khipu (Khipu is then offered only while the customer pays in CLP, ARS or PEN). Without the right to modify the extension the page shows the settings but cannot save them.

When you save, Title must not be empty or longer than 128 characters, Sort Order must be a whole number, Total a number of 0 or more, and the geo zone and order statuses must exist. Otherwise nothing is saved and the page names the field. Missing keys do not block saving.

Khipu

Enable / Disable: Enable Khipu payments turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. It is also the payment method name stored in the order. Default: Khipu. Required, 1 to 128 characters.

Description: the text shown to the customer at the Confirm Order step, above the confirm button. Default: Pay by bank transfer with Khipu.

Sort Order: the position of Khipu among the payment methods at checkout. Leave it empty or enter a whole number.

Geo Zone: offer Khipu only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones.

Total: the checkout total, in the default currency of the store, that an order must reach before Khipu is offered. Leave it empty to offer Khipu for any total.

Khipu account

Copy the Receiver ID, API key and secret key from your Khipu collection account (the section links to khipu.com/merchant/profile). Khipu has no separate sandbox server and the extension has no test mode switch. To test, use the keys of a developer ("desarrollo") collection account: it pays with the DemoBank test bank, and no real money is moved. Switch to the keys of your production collection account when you go live.

Receiver ID: your Khipu Receiver ("cobrador") ID. Payments of other Khipu accounts are rejected.

API key: used to create payments and to verify every payment with Khipu.

Secret key: used to verify the signature (HMAC-SHA256) of Khipu payment notifications. Without it no payment can be confirmed.

Saved keys are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove a saved key, tick Clear the saved value under the field and click Save.

Payment notifications

Notification URL: Khipu confirms payments by calling the URL shown here. On OpenCart 3 it looks like https://your-store/index.php?route=extension/payment/wcp_khipu_gateway/webhook, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_khipu_gateway/payment/wcp_khipu_gateway.webhook. It is built from the storefront address of your OpenCart installation. The URL is sent automatically with every payment, so there is nothing to configure in your Khipu account, but the URL must be reachable from the internet.

Each notification must carry a valid signature made with your Secret key. Notifications without a valid signature are rejected. The extension never trusts the content of the notification: it asks Khipu for the payment status and acts on what Khipu reports:

Status after payment: which status the order gets once Khipu confirms the payment. The status is set at once, with one status change.

OpenCart creates the order at the Confirm Order step without a status (a missing order). It gets a status only after Khipu has confirmed the payment. Each field below lists your OpenCart order statuses.

Paid Order Status: the status after a confirmed payment when Status after payment is Processing. Default: Processing.

Complete Order Status: the status after a confirmed payment when Status after payment is Completed. Default: Complete.

On Hold (Review) Status: payments whose amount or currency do not match the order, or that arrive after the order was cancelled, get this status and a note explaining why. Default: Pending, because OpenCart has no On hold status. You can create your own status in System > Localisation > Order Statuses and select it here.

Advanced

Debug log: logs API calls and notifications to wc_khp_debug.log.php in the OpenCart logs folder (storage/logs). The file cannot be opened from the web, and at 5 MB it is moved to wc_khp_debug.old.log.php. Errors are always logged, even while the switch is off. Keys and payer data are never written. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete data on uninstall: when on, uninstalling the extension removes the gateway settings and the log. Order data (Khipu payment IDs of orders) is always kept. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. The API key and the secret key are not exported.

Import: paste previously exported JSON and click Import to restore the settings. The saved API key and secret key are kept.

Checkout

At the Payment Method step the customer chooses the payment method (by default Khipu). At the Confirm Order step the customer sees your description above the confirm button. OpenCart creates the order at this step, still without a status. When the customer clicks Confirm Order, the extension creates a Khipu payment for the order total in the order currency and sends the customer to the Khipu payment page. The payment shows at Khipu as Order # with the order number and the store name, with the list of products. The customer's e-mail is passed to Khipu when it is valid. On the Khipu page the customer pays by bank transfer from their own bank.

On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options, and clicks Confirm Order at the bottom of the checkout page.

After paying, the customer returns to your store. The order is marked paid only after Khipu confirms it: by the signed notification, or by a status request to Khipu when the customer comes back. The return itself never marks anything as paid. The order then gets its status the standard OpenCart way, with the usual order e-mails and stock update, and the customer sees the OpenCart order success page. If the bank is still verifying the transfer or Khipu cannot be reached, a Payment confirmation page shows Khipu is confirming your bank transfer. Your order will be confirmed automatically as soon as Khipu confirms the payment, and you will receive an e-mail. with the buttons Check again and Back to checkout. If the latest Khipu payment of the order cannot be matched to it (for example, it belongs to another Receiver ID), the customer is back at checkout with We could not match this payment to an order. If you paid, please contact us.

If the customer cancels on the Khipu page, or the payment was not completed, the customer is back at checkout with The Khipu payment was not completed. You can try again or choose another payment method. The cart is kept. On OpenCart 4 these messages are shown above the checkout page. Each new attempt (OpenCart 3 creates a new order every time the Confirm Order step is shown, OpenCart 4 updates the order of the checkout and pays it with a new Khipu payment) deletes the previous unpaid Khipu payment of the order or cart, so the old link can no longer be paid. If Khipu already received the previous payment, it is applied and the customer goes to the success page, with no new payment. If the previous transfer is still being verified, the customer sees Your previous Khipu payment for this order is still being verified by the bank. Please wait a few minutes before paying again. If the previous payment is on review, the customer is asked to contact the store before paying again. A change of the cart, including a new quantity, counts as a new cart that needs its own payment.

OpenCart 4 keeps the order in the checkout until the success page is shown. If that order was closed without a payment meanwhile (for example you cancelled it), the customer is sent back to the checkout with Your previous order was cancelled without a payment. Please confirm the order again to pay with a new order. If the order is already placed and the cart has changed since, the message is Your previous order has already been placed. Your cart has changed since — please confirm the order again to pay for the current cart with a new order. In both cases the next Confirm Order pays a new order of the cart.

If Khipu cannot create the payment, the customer stays at the Confirm Order step with a short message above the button, for example Khipu could not create the payment for this order. Please check your billing details and try again, or contact the store. or Khipu is temporarily unavailable. Please try again in a few minutes. The details are written to the log.

The notification also works while the store is in maintenance mode: OpenCart 3 lets payment extension requests through, and on OpenCart 4 the extension adds a startup action that lets the notification and the customer's return through.

The extension takes one-off bank transfer payments only. Refunds are not sent to Khipu from OpenCart, and it has no subscriptions, saved payment methods or pre-authorisations. Unpaid payments are not tied to a stock reservation.

Orders

Order statuses

No status (missing order): the customer was sent to Khipu and has not paid, or Khipu has not confirmed the transfer yet. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders.

Paid Order Status or Complete Order Status (default Processing or Complete): Khipu confirmed the payment. The status follows Status after payment. A note shows Khipu payment verified. Payment ID: with the payment ID and amount.

On Hold (Review) Status (default Pending): Khipu confirmed a payment whose amount or currency does not match the order, or the payment arrived after the order had been cancelled or declined. A note explains it. Check the payment in your Khipu account, then complete the order or refund the customer. If a later payment of the right amount arrives for the same order, the order moves to the paid status and the customer is notified by e-mail. If the payment arrives after the order was set to another processing status, the status is not changed and only a note is added.

If a payment arrives for an order that is already paid, or for another order of a cart that is already paid, the order is not changed. A note asks you to refund it to the customer if it is a second payment. If Khipu reports a paid payment as reversed, the order gets a note and its status is not changed.

Notes are entries in the order History that the customer does not see. They start with the word Khipu.

VibeFox Khipu Gateway tab

In Sales > Orders open an order paid with Khipu. At the bottom of the order page, next to History and Additional, the VibeFox Khipu Gateway tab shows the Khipu payment attempts of the order (date, amount, Khipu payment ID, Khipu status and result), a Manual review warning while the order is in the review status, and the Khipu notes of the order. The tab is read only and is shown to users who have access to the extension.

Refunds

Refunds are not sent to Khipu from OpenCart, because Khipu offers no refund through its API. The tab says so. Refund the customer from your Khipu account or by bank transfer, then change the order status in OpenCart manually.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox Khipu Gateway is the first block on Extensions > Extensions > Payments > VibeFox Khipu Gateway > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-khipu and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain: the store address from the OpenCart configuration. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, Khipu is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

Khipu does not appear at checkout: check that the license is active, Enable / Disable is on and the Receiver ID, API key and Secret key are all entered. The customer must pay in CLP, ARS or PEN. The settings page shows a warning when something is missing. Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings.

The payment went through, but the order stays without a status: Khipu confirms a transfer after the bank has verified it. The order gets its status when the Khipu notification arrives or when the customer clicks Check again. Check that your store is reachable from the internet at the URL shown in Notification URL (no password protection or firewall blocking Khipu), and look at the Log field on the extension page.

Notification answers Secret key not configured: Secret key is empty. Enter it. Khipu sends the notification again.

Notification answers Invalid signature, Missing signature or Malformed signature: the Secret key does not belong to the collection account whose keys you use, or the request did not come from Khipu.

Notification answers Order not found, Payment not found for this account or Payment does not belong to this order: the payment was made to another Receiver ID, with other keys or for another order. Check the Receiver ID and the keys.

Notification answers Payment not final yet or Verification unavailable: the transfer is still being verified, or Khipu could not be reached. Khipu sends the notification again.

Notification answers Busy, retry later or Order could not be updated, retry later: the order was being confirmed by another request at the same moment, or the order status could not be set. Khipu sends the notification again. The reason is in the log.

Order is in the review status after payment: read the notes in the VibeFox Khipu Gateway tab. The amount or currency did not match the order, or the payment arrived after the order had been cancelled.

The customer sees "Khipu payments are not available right now": the API key is missing or wrong. Check the keys in your Khipu account.

For developers: the extension triggers the OpenCart events wc_khp_supported_currencies (to add a currency your Khipu account accepts, for example EUR for Khipu Spain), wc_khp_currency_decimals and wc_khp_payment_data.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox Khipu Gateway. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable / Disable, Sort Order, Geo Zone, Total and the three order statuses, which return to their defaults on a re-install. On OpenCart 4 its event and its startup action, which lets the notification and the customer's return through in maintenance mode, are removed too. If Delete data on uninstall is on, the other gateway settings (title, description, Receiver ID, keys, status after payment, debug log) and the log are removed. If it is off, they are kept for a later re-install. The Khipu payment attempts are always kept, so late notifications of orders paid before are still handled after a re-install. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox Khipu Gateway in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

Khipu is a trademark of its respective owner. This extension is not affiliated with or endorsed by Khipu.