VibeFox OpenPay for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later.

HTTPS: your store must use HTTPS, because the card form is on your checkout page.

OpenPay account: an OpenPay account from Mexico, Colombia or Peru. You need its Merchant ID, private key (sk_...) and public key (pk_...). The sandbox and production dashboards have different Merchant IDs and keys, and the extension keeps them apart.

Currency: the customer must pay in a currency your account country accepts: Mexico — MXN or USD, Colombia — COP or USD, Peru — PEN or USD. For other currencies the payment method is hidden at checkout.

VibeFox license key: bought on vibefox.net. One key works on one domain.

The card is typed on your checkout page, but it is read and tokenized in the browser by openpay.js. The card fields have no name and are never sent to your server. Because the card form is on your page, your PCI DSS scope is SAQ A-EP; ask your acquirer.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_openpay_gateway-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_openpay_gateway.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_openpay_gateway-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of this package into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox OpenPay Gateway and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Choose the Account country and enter the sandbox and live keys (see Configuration).

5. Recommended: add the webhook URL in the OpenPay dashboard (see Configuration).

6. Turn on Enable / Disable and click Save. Test a payment with the OpenPay sandbox test cards, then turn off Sandbox mode to take real payments. Keep the sandbox keys while you may still refund sandbox orders.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_openpay_gateway.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the type Payments. Find VibeFox OpenPay Gateway, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key, the OpenPay keys and the webhook as in steps 3 to 6 for OpenCart 3. The settings page and its fields are the same in both versions. Only the webhook URL is different (see Webhook).

A new install starts with the payment method turned off and sandbox mode on.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox OpenPay Gateway > Edit. The sections are listed on the left; the Save button under the list saves the whole page. Above the settings the page warns you when the keys of the current mode are incomplete (the payment method is then hidden at checkout) and when the default currency of your store is not accepted by the selected account country, and shows Sandbox mode is enabled — no real charges are made. while sandbox mode is on. Without the right to modify the extension the page shows the settings but cannot save them.

When you save, the keys are checked. A Merchant ID may contain only letters and digits, a private key must start with sk_ and a public key with pk_. An invalid value is not saved: the previous value is kept and an error is shown, for example Sandbox: The private key must start with sk_. The same applies to a Sort Order that is not a whole number (Sort Order must be a whole number — the previous value was kept.) and to a Total that is not a number of 0 or more. The other fields are saved. If the payment method is enabled but the keys of the current mode are incomplete, you also see a message that the gateway stays hidden at checkout. An empty Title or one longer than 128 characters is refused with Enter a title for the payment method (1 to 128 characters)., and then nothing is saved.

OpenPay

Enable / Disable: Enable OpenPay card payments turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. It is also the payment method name stored in the order. Default: Credit or debit card (OpenPay). Required, up to 128 characters.

Description: the text shown above the card form at the Confirm Order step. Default: Pay securely with your credit or debit card. Your bank may ask you to confirm the payment (3D Secure).

Sort Order: the position of OpenPay among the payment methods at checkout. Leave it empty or enter a whole number (negative numbers are allowed).

Geo Zone: offer OpenPay only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones. On OpenCart 4, when the store asks for no payment address, the shipping address is used.

Total: the checkout total, in the default currency of the store, that an order must reach before OpenPay is offered. Leave it empty to offer OpenPay for any total.

OpenPay account

The Merchant ID, private key (sk_) and public key (pk_) are in your OpenPay dashboard under Settings (Configuración). The section has links to the sandbox and production dashboards of Mexico, Colombia and Peru.

Account country: the country of your OpenPay account. It selects the OpenPay API, the openpay.js library of that country and the accepted currencies. Default: Mexico.

Sandbox mode: uses the OpenPay sandbox (test keys, no real charges) and switches both the keys and the API to the sandbox. A SANDBOX MODE badge is shown at checkout while it is on. Default: on. Turn it off to take real payments.

Sandbox Merchant ID: the Merchant ID from the sandbox dashboard, Settings (Configuración), API keys.

Sandbox Private Key: the sandbox private key. It starts with sk_. It is used only on the server; never share it.

Sandbox Public Key: the sandbox public key. It starts with pk_. openpay.js uses it in the browser to tokenize the card.

Live Merchant ID: the Merchant ID from the production dashboard, Settings (Configuración), API keys.

Live Private Key: the production private key (sk_...).

Live Public Key: the production public key (pk_...).

Saved private keys are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove a saved private key, tick Clear the saved key on save under the field and click Save.

Webhook

The webhook is not required, but recommended. It confirms payments when the customer does not come back from the 3D Secure page, for example after closing the browser. In the OpenPay dashboard go to Settings > Webhooks and add the URL shown in Webhook URL in this section. On OpenCart 3 it looks like https://your-store/index.php?route=extension/payment/wcp_openpay_gateway/webhook, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_openpay_gateway/payment/wcp_openpay_gateway.webhook. It is built from the storefront address of your OpenCart installation. Copy it exactly as the settings show it. Add the webhook in the dashboard of each mode you use (sandbox and production).

When you add the webhook, OpenPay sends a verification code to this URL. The code appears in this section with the date it arrived, so you can confirm the webhook in the OpenPay dashboard. Until then the section shows No verification code received yet.

The extension handles these events:

OpenPay does not sign webhooks, so the extension never trusts the notification itself. It only uses it to find the charge, then reads the charge from the OpenPay API with the private key of the mode and account country the payment was made in. A notification for a charge this store did not create is ignored. The webhook also works while the store is in maintenance mode: OpenCart 3 lets payment extension requests through, and on OpenCart 4 the extension adds a startup action that lets the webhook and the customer's return from 3D Secure through.

Orders

OpenCart creates the order at the Confirm Order step without a status (a missing order). The order gets a status only after OpenPay has confirmed the charge. A declined card or a failed 3D Secure check leaves the order without a status, a note explains why, and the customer may pay again. Each field below lists your OpenCart order statuses; you can create your own statuses in System > Localisation > Order Statuses.

Order Status After Payment: OpenPay confirmed the charge and its amount and currency match the order. Default: Processing.

Awaiting OpenPay Payment: the charge is in progress (not captured yet); the webhook completes or fails it later. Default: Pending.

OpenPay Payment On Hold: OpenPay charged another amount or currency than the order, or a charge was completed after the order had been cancelled. Default: Pending.

Payment Error Status: the charge of an order awaiting OpenPay or on hold failed, was cancelled or expired. Default: Failed.

Refunded Status: the charge is fully refunded from the order page. Partial refunds only add a note. Default: Refunded.

Advanced

Debug log: logs the payment steps to wc_opy_debug.log.php in the OpenCart logs folder (storage/logs). The file cannot be opened from the web, and at 5 MB it is moved to wc_opy_debug.old.log.php. Errors and warnings are logged even when it is off. Keys, card data and customer details are never logged. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete data on uninstall: when on, uninstalling the extension removes the gateway settings, the stored webhook verification code and the log. The OpenPay charge records of orders are payment history and are always kept, so orders can still be refunded after a re-install. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. Private keys are not exported.

Import: paste previously exported JSON and click Import to restore the settings. Saved private keys are kept.

Checkout

At the Payment Method step the customer chooses the payment method (by default Credit or debit card (OpenPay)). At the Confirm Order step the customer sees your description and the card form: Cardholder name, Card number, Expiry (MM/YY) and Card code (CVV). In sandbox mode the form shows SANDBOX MODE — Test environment. No real charges will be made. OpenCart creates the order at this step, still without a status. On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options; the card form is in the confirmation section at the bottom of the checkout page, above Confirm Order. When the customer clicks Confirm Order, openpay.js turns the card into a one-time token in the browser, and the antifraud library adds a device session ID. Only these two values are sent to your store. An incomplete form shows Please fill in all card fields. under the form.

The extension then creates the charge with 3D Secure for the order total in the order currency and sends the customer to the 3D Secure page of their bank, served by OpenPay. Each attempt gets its own OpenPay order reference. The charge description is Order #, the order number and your store name. The customer's name, e-mail and phone from the payment address are passed to OpenPay; no OpenPay customer account is created.

When the customer comes back, the extension reads the charge from the OpenPay API. The order is marked paid only after OpenPay confirms it: the charge must belong to this order, be completed and match the order total and currency exactly. The order then gets its status the standard OpenCart way, with the usual order e-mails and stock update, and the customer sees the OpenCart order success page with Your card payment has been received. If OpenPay reports the charge as in progress, the order gets the Awaiting OpenPay Payment status and the page shows We are confirming your card payment with OpenPay. The order will be updated automatically — please do not pay again. If the result is not known yet, a Payment confirmation page shows the same text with a Check again button and a Back to checkout button; the webhook sets the order status as soon as it arrives. If a charge in progress fails later, the success page shows Your OpenPay card payment was not completed. Please contact us about this order.

If the card is declined or 3D Secure fails, the order stays without a status, a note is added, and the customer is back at checkout with The card payment was not completed (declined or 3-D Secure failed). Please try again or use another card. The cart is kept. On OpenCart 4 this message is shown above the checkout page. OpenCart 3 creates a new order every time the Confirm Order step is shown; OpenCart 4 keeps one order for the checkout and updates it, so the customer pays the same order again with a new attempt. Before a new attempt the extension checks the previous charge of the cart: if it was in fact paid, that order gets its status without a second charge; if it is still in progress, the customer sees A previous payment for this order is still being processed. Please do not pay again — the order will be updated automatically.; if its state cannot be checked, no new charge is made and the customer sees We could not confirm the status of your previous payment attempt. Please try again in a few minutes. A cart that is already paid is never charged again.

OpenCart 4 keeps the order in the checkout until the success page is shown. If that order was closed meanwhile (for example its charge failed after it was awaiting payment, or you cancelled or refunded it), the customer is sent back to the checkout with This order can no longer be paid. Please reload the checkout page and confirm the order again., and the next Confirm Order pays a new order. If that order already has a status and the cart now has other products or quantities, the customer is sent back to the checkout as well, and the new cart gets a new order.

Declined cards get a clear message, for example The card has insufficient funds. Please use another card., The card has expired. Please use another card. or The security code (CVV) is not valid. Please check it and try again. Technical errors of OpenPay are never shown to customers; they go to the log and the order notes.

The payment method is hidden at checkout when it is disabled, when the keys of the current mode are incomplete or when the customer pays in a currency the account country does not accept.

The extension takes card payments only, captured immediately. It has no saved cards, subscriptions, months without interest (MSI) or installments, payment with card points, cash, SPEI, PSE or CoDi payments, and no separate authorize and capture.

Orders and refunds

Order statuses

No status (missing order): the customer is on the 3D Secure page, has not finished the payment, or the card was declined. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders.

On OpenCart 4 an unpaid order of the checkout can get the status Voided, which OpenCart 4 sets when the customer comes back to the Confirm Order step. The extension treats such an order as an order without status, and a later payment still confirms it.

Order Status After Payment (default Processing): the payment was confirmed. A note shows the OpenPay charge ID and the mode (live or sandbox).

Awaiting OpenPay Payment (default Pending): OpenPay reports the charge as in progress (not captured yet). The order moves to Order Status After Payment when the charge is completed, or to Payment Error Status if it fails.

OpenPay Payment On Hold (default Pending): OpenPay reports a completed charge with a different amount or currency than the order (the order is not marked paid, the note shows the difference), or a payment arrived for an order that had already been cancelled or refunded. Check the order and fulfil it or refund the payment.

Payment Error Status (default Failed): a charge in progress failed, was cancelled or expired.

Refunded Status (default Refunded): the charge was fully refunded through the extension.

If a second completed charge arrives for an order or a cart that is already paid, the order is not changed. A note starting with OpenPay WARNING on the paid order asks you to refund the duplicate in the OpenPay dashboard.

Notes are entries in the order History that the customer does not see.

VibeFox OpenPay Gateway tab

In Sales > Orders open an order paid with OpenPay. At the bottom of the order page, next to History and Additional, the VibeFox OpenPay Gateway tab shows the charge ID, the charge status, the environment and account country with a Sandbox label for sandbox payments, the amounts Charged / order, the amount refunded, the refund form, the refund history and the OpenPay notes of the order. The tab is shown to users who have access to the extension.

Refunds

For accounts from Mexico and Peru: in the tab enter the Amount (the amount not refunded yet is filled in), optionally a Reason (optional), and click Refund via OpenPay. Confirm the question Refund this amount through OpenPay? This cannot be undone. Full and partial refunds are supported, up to the amount OpenPay charged. You need the right to modify the extension (set in System > Users > User Groups). The refund is sent with the keys of the mode and account country the charge was made in, so that mode's keys must be set. If OpenPay does not accept the refund, the tab shows the error, for example OpenPay refund failed: ..., and no refund is recorded. A successful refund is added to the refund history and the notes with the OpenPay refund ID. A full refund sets the order to Refunded Status without notifying the customer and without returning products to stock, like a manual status change. A partial refund does not change the status. Refunds are available once OpenPay has confirmed the payment; an order on hold after an amount mismatch is not refunded through the extension.

OpenPay Colombia does not support card refunds through the API, as in the official OpenPay plugins. For Colombian charges the tab offers no refund form and explains why; refund the charge in the OpenPay dashboard.

Product returns in Sales > Returns do not send money back through OpenPay.

Refunds and chargebacks made in the OpenPay dashboard arrive by webhook and are added to the notes once. The order status is not changed automatically. Update it manually if needed.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox OpenPay Gateway is the first block on Extensions > Extensions > Payments > VibeFox OpenPay Gateway > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-openpay and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain: the store address from the OpenCart configuration. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, OpenPay is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed, and refunds work.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

OpenPay does not appear at checkout: check that the license is active, Enable / Disable is on and the current mode has all three keys: the sandbox keys in sandbox mode, the live keys in live mode. Check that the customer pays in a currency accepted by the Account country (Mexico: MXN, USD; Colombia: COP, USD; Peru: PEN, USD). The settings page shows a warning in each case. Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings.

The payment went through, but the order stays without a status: the customer did not come back from the 3D Secure page and the webhook is not working. Check that the webhook URL is added in the OpenPay dashboard of the mode you use, exactly as the settings show it, with the events listed above. Check that the keys of the mode the payment was made in are filled in: without them the webhook answers not configured and OpenPay retries later. The order also gets its status when the customer returns to the store, or when the customer tries to pay the same cart again.

The webhook answers ignored (unknown order): the charge was not created by this store, for example a charge from another store on the same OpenPay account. Nothing is changed.

The webhook answers verification failed: the OpenPay API could not be reached to read the charge. OpenPay retries the webhook.

The webhook answers busy: the cart was being updated by another request at the same moment, or the order status could not be set. OpenPay retries the webhook. Turn on Debug log to see the reason.

The webhook URL shows invalid body in the browser: this is normal. The URL accepts only notifications from OpenPay.

The customer sees The secure card form could not be loaded: openpay.js or the antifraud library of OpenPay did not load in the browser, or the device session ID could not be created. Ask the customer to reload the page and try again.

The customer sees The payment could not be processed right now: OpenPay rejected the request or did not answer. The reason is in the log and the order notes. A wrong Merchant ID or private key is a typical cause. If OpenPay did not answer, check the OpenPay dashboard for the charge before the customer pays again.

The customer sees This test card cannot be used for real payments: a sandbox test card was used while sandbox mode is off.

The customer sees Billing email is required for OpenPay: the order has no valid e-mail address.

Order is in the OpenPay Payment On Hold status after payment: read the OpenPay notes in the tab (see Order statuses), then fulfil the order or refund the payment.

Refund fails with a message about the mode: the order was paid in sandbox or live mode, and the keys of that mode are not set. Enter them and try again.

Refund fails with The order is being updated right now: a webhook or another request was updating the order at the same moment. Try again in a moment.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox OpenPay Gateway. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable / Disable, Sort Order, Geo Zone, Total and the order statuses of the Orders section, which return to their defaults on a re-install. The OpenCart event of the extension is removed too (on OpenCart 4 its events and its startup action, which lets the webhook and the 3D Secure return through in maintenance mode). If Delete data on uninstall is on, the other gateway settings (title, description, account country, sandbox mode, keys, logging), the stored webhook verification code and the log are removed. If it is off, they are kept for a later re-install. The OpenPay charge and refund records are always kept, so orders paid before can still be refunded after a re-install. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox OpenPay Gateway in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

OpenPay is a trademark of its respective owner. This extension is not affiliated with or endorsed by OpenPay.