VibeFox Moyasar for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later.

Currency: the checkout currency must be SAR, AED, USD, EUR, KWD, BHD or OMR. For any other currency the payment method is hidden at checkout.

Moyasar account: you need the secret API keys of your Moyasar account (test and live). Only the secret keys are used. The publishable key is not needed, because the payment happens on the Moyasar page. A webhook in the Moyasar Dashboard is recommended (see Configuration).

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_moyasar_payment_gateway-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_moyasar_payment_gateway.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_moyasar_payment_gateway-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of this package into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Moyasar Payment Gateway and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Paste your Moyasar secret keys and click Save. The first save generates the webhook shared secret and shows it once above the settings. Set up the webhook in the Moyasar Dashboard with it (see Configuration).

5. Turn on Enable/Disable and click Save. Place a test order in test mode, then turn off Test mode.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_moyasar_payment_gateway.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Moyasar Payment Gateway, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key, the Moyasar keys and the webhook as in steps 3 to 5 for OpenCart 3. The settings page and its fields are the same in both versions. Only the webhook URL is different (see Webhook URL).

A new install starts with the payment method turned off and test mode on.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox Moyasar Payment Gateway > Edit. The sections are listed on the left; the Save button under the list saves the whole page. Above the settings the page warns you when the current mode has no secret key (the payment method is then hidden at checkout), when no webhook shared secret is saved (the webhook then rejects every call) or when the default currency of the store is not supported. While the extension is enabled in test mode it shows Test mode is active: payments are simulated, no money is charged. Without the right to modify the extension the page shows the settings but cannot save them.

When you save, Title must be 1 to 128 characters long, Sort Order must be a whole number (negative numbers are allowed), Total must be a number, 0 or greater, and the geo zone and order statuses must exist; otherwise nothing is saved. The extension refuses a publishable key, a key of the other mode or a key with spaces: the rest is saved with Settings saved, except the key shown in red., the previous key is kept and the reason is shown. If the extension is enabled without the secret key of the current mode, the settings are saved with a warning.

Moyasar

Enable/Disable: Enable Moyasar turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. It is also the payment method name stored in the order. Default: Pay with Moyasar. Required, up to 128 characters.

Description: the text shown to the customer at the Confirm Order step, above the confirm button. Default: You will be redirected to the secure Moyasar payment page to pay with mada, Visa, Mastercard, Apple Pay or STC Pay. In test mode the step adds (Test mode: no real payment is made.)

Sort Order: the position of Moyasar among the payment methods at checkout. Leave it empty or enter a whole number.

Geo Zone: offer Moyasar only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones.

Total: the checkout total, in the default currency of the store, that an order must reach before Moyasar is offered. Leave it empty to offer Moyasar for any total.

API keys

Copy the secret keys from Moyasar Dashboard > Settings > API Keys (the page links there). Test and live keys are separate. Test mode uses only the test key, live mode only the live key.

Test mode: uses the test secret key: payments are simulated and no money is charged. Default: on. Turn it off to accept real payments with the live secret key. Invoices of the other mode keep using the key of their own mode for status checks and refunds.

Test secret key: the secret key of the test mode. It starts with sk_test_.

Live secret key: the secret key of the live mode. It starts with sk_live_.

Saved keys and secrets are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove a saved value, tick Clear the saved value on save under the field and click Save.

Payment notifications (webhook)

The webhook is recommended, not required. Orders are also confirmed when the customer returns to the store and by the invoice notification that Moyasar sends to your store automatically when the invoice is paid. The webhook covers customers who close the browser before returning and reports refunds made in the Moyasar Dashboard. Add it in Moyasar Dashboard > Settings > Webhooks.

Webhook URL: shown read-only with a Copy button. On OpenCart 3 it looks like https://your-store/index.php?route=extension/payment/wcp_moyasar_payment_gateway/webhook, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_moyasar_payment_gateway/payment/wcp_moyasar_payment_gateway.webhook. It is built from the storefront address of your OpenCart installation. Copy the URL exactly as the settings show it. HTTP method: POST. The URL must be reachable from the internet.

Webhook shared secret: enter the same value as Shared secret of the webhook in Moyasar, or tick Generate a new secret and save. If nothing is saved, Save generates a random secret. A generated secret is shown once above the settings after saving and never again, so copy it into Moyasar at once. Webhooks without the correct shared secret are rejected. One shared secret serves both modes.

Select these events for the webhook (they are also listed in this section):

Nothing in a webhook or notification is trusted directly: for each one, the extension reads the invoice from the Moyasar API with the secret key of the mode the invoice was created in and checks that it was created by this store. Payments of other integrations on the same Moyasar account are ignored.

Orders

OpenCart creates the order at the Confirm Order step without a status (a missing order). The order gets a status only after Moyasar has confirmed the invoice. Each field below lists your OpenCart order statuses.

Status after payment: the status set after a confirmed payment. Default: Processing. Choose Complete if paid orders should be completed at once, or your review status if every paid order should wait for a manual check.

Awaiting Moyasar payment status: Moyasar holds the payment for review; the order moves to Status after payment when Moyasar confirms it. Default: Pending.

Moyasar payment on hold status: Moyasar reported another amount or currency than the order total, or the invoice was paid after the order had been cancelled or given another status. The order is not marked paid. Default: Pending, because OpenCart has no On hold status. You can create your own status in System > Localisation > Order Statuses and select it here.

Payment error status: the payment under review failed. Default: Failed.

Refunded status: set after the payment is fully refunded from the order page. Default: Refunded.

Advanced

Debug log: logs API calls and notifications to moyasar_p_debug.log.php in the OpenCart logs folder (storage/logs). The file cannot be opened from the web, and at 5 MB it is moved to moyasar_p_debug.old.log.php. Errors and warnings are always logged. API keys, card data and customer details are never logged. Default: off.

Log: shows the current size and the latest entries of the log. Click Clear log to empty it.

Clean uninstall: when on, uninstalling the extension deletes the gateway settings and the log. Payment details stored with orders (Moyasar invoice and payment IDs) are kept, so refunds remain traceable. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. Keys and secrets are not exported.

Import: paste previously exported JSON and click Import to restore the settings. Saved keys and secrets are kept.

Checkout

At the Payment Method step the customer chooses the payment method (by default Pay with Moyasar). At the Confirm Order step the customer sees your description. OpenCart creates the order at this step, still without a status. When the customer clicks Confirm Order, the extension creates a Moyasar invoice for the order total in the order currency and sends the customer to its payment page. There the customer pays with any method active on your Moyasar account. On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options, and clicks Confirm Order at the bottom of the checkout page. The invoice shows Order #, the order number and your store name.

The order is marked paid only after Moyasar confirms it: the extension reads the invoice from the Moyasar API and checks that it is paid, belongs to this order and has the exact order amount and currency. The order then gets its status the standard OpenCart way, with the usual order e-mails and stock update, and the customer sees the OpenCart order success page with Your payment with Moyasar has been received. If Moyasar holds the payment for review, the page shows Your payment is being reviewed by Moyasar. The order will be updated automatically when Moyasar confirms it — please do not pay again. If the order is on hold for your review, the page shows We have received your payment and are reviewing your order. We will contact you if anything is needed — please do not pay again. If a payment under review later fails, the page shows Your Moyasar payment was not completed. Please contact us about this order.

If the customer comes back without paying (for example with the back button of the payment page), they are back at checkout with one of these messages: The payment at Moyasar was not completed. You can try again or choose another payment method., Your Moyasar payment was declined or has expired. Please try again or choose another payment method. or, when the payment cannot be checked yet, We could not confirm your payment with Moyasar yet. If you completed the payment, the order will be updated automatically in a few minutes — please check your e-mail before paying again. On OpenCart 4 these messages are shown above the checkout page. The cart is kept.

The customer can try again. OpenCart 3 creates a new order every time the Confirm Order step is shown, OpenCart 4 keeps one order for the checkout and pays the same order again. The extension checks the open invoices of the same cart first: if the open payment page of this order still has the same mode, amount and currency, it is reused; otherwise the old invoice is cancelled at Moyasar and a new one is created, so the old one can no longer be paid. If a previous invoice of the cart turns out to be paid already, that payment is confirmed instead of a new one.

OpenCart 4 keeps the order in the checkout until the success page is shown. If that order was closed without a payment meanwhile (for example you cancelled it or its payment failed), the customer is sent back to the checkout with Your previous order was cancelled or its payment failed. Please confirm the order again., and the next Confirm Order pays a new order. An order of the cart that was paid and then cancelled or refunded no longer holds the cart.

If Moyasar cannot start the payment, the customer stays at the Confirm Order step with a short message above the button, for example The Moyasar payment service is not responding. Please try again in a few minutes., and can choose another payment method. The details are written to the log.

The webhook and the invoice notification also work while the store is in maintenance mode, because OpenCart 3 lets payment extension requests through and on OpenCart 4 the extension adds a startup action for them, which also lets the customer return from Moyasar.

The extension takes one-time payments on the Moyasar page only. It has no card form on your own checkout, no saved cards or tokenization, no subscriptions and no separate authorize and capture.

Orders and refunds

Order statuses

No status (missing order): the customer was sent to Moyasar and has not paid, Moyasar has not confirmed the payment yet, or the payment was declined, expired or cancelled. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders.

Status after payment (default Processing): the payment was confirmed. A note shows how the payment was confirmed (webhook, invoice notification, customer return or checkout), the invoice ID, the payment ID and the payment method, for example the card brand and the last four digits.

Awaiting Moyasar payment status (default Pending): Moyasar holds the payment for review. The order moves to Status after payment when Moyasar confirms the payment, or to Payment error status when it fails.

Moyasar payment on hold status (default Pending): Moyasar reported a different amount or currency than the order total, or the invoice was paid after you had cancelled the order or changed its status. The order is not marked paid, but the amount actually charged is recorded for refunds. The note explains it. Check the payment in the Moyasar Dashboard and fulfil the order or refund the payment.

Payment error status (default Failed): the payment under review failed.

Refunded status (default Refunded): the payment was fully refunded through the extension.

A paid or refunded order is never changed back by later events. If you have already set a paid status yourself, the payment is recorded and the status is not changed. If a second invoice of a cart that is already paid is paid too (for example from two browser tabs), the paid order is not changed. A note asks you to refund the duplicate payment in the Moyasar Dashboard.

Notes are entries in the order History that the customer does not see.

VibeFox Moyasar Payment Gateway tab

In Sales > Orders open an order paid with Moyasar. At the bottom of the order page, next to History and Additional, the VibeFox Moyasar Payment Gateway tab shows the Moyasar invoice (with a Test mode label for test payments), the Moyasar payment, the Method, the Status, the amounts Paid / refunded, the refund form, the refund history and the Moyasar notes of the order. The tab is shown to users who have access to the extension.

Refunds

In the VibeFox Moyasar Payment Gateway tab enter the Amount (the amount not refunded yet is filled in), optionally a Reason (optional), and click Refund via Moyasar. Confirm the question Refund this amount through Moyasar? This cannot be undone. Full and partial refunds are supported. You need the right to modify the extension (set in System > Users > User Groups). Refunds are made in the amount and currency Moyasar charged, so after an amount mismatch you can refund up to what the customer actually paid, not the order total. A full refund of a card payment made less than 2 hours ago is sent as a void (cancel before settlement, no fees); STC Pay payments and all other cases are refunded. The refund uses the secret key of the mode the payment was made in (test or live), so that mode's key must be set. The extension first checks the currency, status and refundable amount of the payment at Moyasar. If Moyasar does not accept the refund, the tab shows the error and no refund is recorded. A successful refund or void is added to the refund history and the notes. A full refund sets the order to Refunded status without notifying the customer and without returning products to stock, like a manual status change. A partial refund does not change the status. Refunds are available once Moyasar has confirmed the payment.

Product returns in Sales > Returns do not send money back through Moyasar.

Refunds and voids made in the Moyasar Dashboard arrive by the webhook. If Moyasar shows more refunded than the extension recorded, a note is added to the order. The order status is not changed automatically. Update it manually if needed, without Refund via Moyasar.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox Moyasar Payment Gateway is the first block on Extensions > Extensions > Payments > VibeFox Moyasar Payment Gateway > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-moyasar and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, Moyasar is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed, and refunds work.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

Moyasar does not appear at checkout: check that the license is active, Enable/Disable is on and the current mode has a secret key: Test secret key in test mode, Live secret key in live mode. The settings page shows a warning when the key is missing. The customer must pay in SAR, AED, USD, EUR, KWD, BHD or OMR (the currency selected in the store). Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings.

The payment went through, but the order stays without a status: the confirmations did not reach your store. Set up the webhook: in the Moyasar Dashboard check that it exists, that its URL is exactly the Webhook URL from the settings, the method is POST, the four events are selected and its shared secret equals the one saved in Webhook shared secret. The order also gets its status when the customer returns to the store or tries to pay the same cart again.

Webhook answers Unauthorized: the shared secret in Moyasar differs from the saved one. Type the secret of the Moyasar webhook into Webhook shared secret and save, or tick Generate a new secret, save and paste the secret shown into Moyasar.

Webhook answers Webhook secret not configured: no shared secret is saved, for example after it was removed with Clear the saved value on save. Click Save to generate one and copy it to Moyasar.

Webhook answers Key not configured: the invoice was created in a mode (test or live) whose secret key is empty. Enter that key.

Webhook answers Verification failed or Try again later: the invoice could not be read from the Moyasar API, the cart was being updated by another request at the same moment, or the order status could not be set. Moyasar retries the webhook. Turn on Debug log to see the reason.

The webhook URL shows Method not allowed in the browser: this is normal. The URL accepts only POST requests from Moyasar.

Error on save about the key: a publishable key (pk_...) or a key of the other mode was pasted, or the key contains spaces. The previous value was kept. Test keys start with sk_test_, live keys with sk_live_.

The customer sees an error after Confirm Order: turn on Debug log and look at the Log field on the extension page. This payment method is not available. means the checkout session no longer matches the order, or the payment method was turned off meanwhile: the customer reloads the checkout. This payment method is temporarily unavailable. Please choose another payment method or contact us. usually means a wrong or missing secret key. A payment for this order has already been received and is being reviewed. Please contact us instead of paying again. means the cart already has a paid invoice whose order status could not be set; check the log.

Order is in the on hold status after payment: read the Moyasar notes in the VibeFox Moyasar Payment Gateway tab. The paid amount or currency differed from the order, or the payment came after the order was cancelled. Fulfil the order or refund the payment.

No refund form in the tab: the tab says why: the payment is not confirmed yet, it is fully refunded, or your user group has no right to modify the extension.

Refund fails: read the message. If the payment was made in the other mode, enter that mode's secret key. If the amount is larger than the amount still refundable at Moyasar, part of the payment was already refunded, for example in the Moyasar Dashboard. If Moyasar did not confirm the refunded amount, check the payment in the Moyasar Dashboard before trying again.

For developers: the extension triggers the OpenCart events moyasar_p_supported_currencies and moyasar_p_invoice_params to change the supported currencies and the invoice data.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox Moyasar Payment Gateway. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable/Disable, Sort Order, Geo Zone, Total and the order statuses of the Orders section, which return to their defaults on a re-install. The OpenCart event of the extension is removed too (on OpenCart 4 its events and its startup action, which lets the webhook through in maintenance mode). If Clean uninstall is on, the other gateway settings (title, description, test mode, keys, webhook shared secret, debug log) and the log are removed. If it is off, they are kept for a later re-install. The Moyasar invoices, payments and refunds are always kept, so old orders can still be refunded after a re-install. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox Moyasar Payment Gateway in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

Moyasar is a trademark of its respective owner. This extension is not affiliated with or endorsed by Moyasar.