VibeFox PagSeguro for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later.

Currency: Brazilian Real (BRL). The store must have the currency BRL (System > Localisation > Currencies), and the payment method is shown only when the customer checks out in BRL.

Reachable site: your store must be reachable from the Internet so that PagBank can deliver payment notifications.

PagBank account: a production token for real payments and a sandbox token for tests. Production: log in to your PagBank account, open Venda online > Integrações and click Gerar token; PagBank sends the token by e-mail. Sandbox: copy the token of your sandbox account in the PagBank developer portal. Sandbox and production tokens only work in their own environment.

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_pagseguro_gateway-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_pagseguro_gateway.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_pagseguro_gateway-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of this package into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox PagSeguro Gateway and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Enter the sandbox token and, to take real payments, the production token. Nothing has to be set up in PagBank: the notification URL is sent with every payment.

5. Turn on Enable / Disable and click Save. Make test payments with Sandbox Mode on, then switch it off to take real payments.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_pagseguro_gateway.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the type Payments. Find VibeFox PagSeguro Gateway, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key and the tokens and test the payments as in steps 3 to 5 for OpenCart 3. The settings page and its fields are the same in both versions. Only the notification URL is different (see Notification URL); it is sent to PagBank with every payment as well.

A new install starts with the payment method turned off and sandbox mode on.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox PagSeguro Gateway > Edit. The sections are listed on the left; the Save button under the list saves the whole page. Above the settings the page shows the current mode: SANDBOX MODE (payments are created in the PagBank sandbox, no real charges) or LIVE (payments are created with the production token). It warns you when the token of the current mode is missing (the payment method is then hidden at checkout) and when the default currency of the store is not BRL. Without the right to modify the extension the page shows the settings but cannot save them.

When you save, Title must not be empty (up to 128 characters), Sort Order must be a whole number (negative numbers are allowed), Total a number of 0 or more, and the geo zone and order statuses must exist. If a value is wrong, an error names it and nothing is saved.

PagSeguro / PagBank

Enable / Disable: Enable PagSeguro/PagBank payments turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. It is also the payment method name stored in the order. Default: PagSeguro / PagBank. Required, up to 128 characters.

Description: the text shown to the customer at the Confirm Order step, above the confirm button. Default: Pay securely via PagSeguro/PagBank. You will be redirected to complete your payment.

Sort Order: the position of PagBank among the payment methods at checkout. Leave it empty or enter a whole number.

Geo Zone: offer PagBank only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones. On OpenCart 4, when the store asks for no payment address, the shipping address is used.

Total: the checkout total, in the default currency of the store, that an order must reach before PagBank is offered. Leave it empty to offer PagBank for any total.

PagBank account

The section explains where to get the tokens and links to your PagBank account and to the PagBank page about tokens.

Sandbox Mode: Enable sandbox/test mode (no real charges). New payments go to the PagBank sandbox with the sandbox token, and customers see SANDBOX MODE — Using test environment. No real charges. at the Confirm Order step. Status checks and refunds of an order always use the environment and token in which its payment was created. Default: on.

Sandbox token: the PagBank sandbox token. Used while sandbox mode is on.

Production token: the PagBank production token (Bearer). Used when sandbox mode is off. Keep it secret.

Saved tokens are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove a saved token, tick Clear the saved token on save under the field and click Save.

Payment notifications

Notification URL: every payment tells PagBank to send its checkout and payment notifications to this URL, so there is nothing to configure in PagBank. On OpenCart 3 it looks like https://your-store/index.php?route=extension/payment/wcp_pagseguro_gateway/webhook, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_pagseguro_gateway/payment/wcp_pagseguro_gateway.webhook. It is built from the storefront address of your OpenCart installation. The URL must be reachable from the Internet.

Notifications that carry an x-authenticity-token header are checked with the token of the environment in which the payment was created; an invalid signature is rejected. The notification body itself is never trusted: the extension always reads the checkout and the PagBank order from the PagBank API (status, amount, currency) before the order changes. Without notifications, the order gets its status when the customer returns to the store after paying.

Orders

OpenCart creates the order at the Confirm Order step without a status (a missing order). The order gets a status only after PagBank has reported the payment by a notification or on the customer's return; the payment is always read back from PagBank. Each field below lists your OpenCart order statuses.

Order Status After Payment: the status set after a verified PagBank payment. Default: Processing.

Awaiting PagBank Payment Status: a boleto or PIX was issued, or the payment is under analysis (WAITING / IN_ANALYSIS); PagBank confirms the money later. Default: Pending.

PagBank Payment On Hold Status: the payment needs your review (see Order statuses). Default: Pending, because OpenCart has no On hold status. You can create your own status in System > Localisation > Order Statuses and select it here.

Payment Declined Status: the payment of a waiting order was declined. If PagBank reports it paid later, the order gets the status after payment. Default: Failed.

Payment Cancelled Status: the payment of a waiting order was cancelled in PagBank. A payment that arrives for an order in this status puts it in the review status. Default: Canceled.

Refunded Status: set after the payment is fully refunded from the order page or in the PagBank dashboard. Default: Refunded.

Advanced

Debug log: writes API requests and notifications to wc_psg_debug.log.php in the OpenCart logs folder (storage/logs). The file cannot be opened from the web. Logs contain no tokens and no customer data. Errors and warnings are always logged. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete Data on Uninstall: when on, uninstalling the extension removes the gateway settings and the log. Orders and their PagBank references (needed for refunds) are always kept. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. Tokens are not exported.

Import: paste previously exported JSON and click Import to restore the settings. Saved tokens are kept.

Checkout

At the Payment Method step the customer chooses the payment method (by default PagSeguro / PagBank). At the Confirm Order step the customer sees your description and the note You will be redirected to the PagBank payment page (credit card, PIX, boleto) and returned to the store. OpenCart creates the order at this step, still without a status. On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options, and clicks Confirm Order at the bottom of the checkout page. When the customer clicks Confirm Order, the extension creates a PagBank checkout for the order total in BRL as one item, Order # with the order number and your store name (coupons, shipping and taxes are included in the total), and sends the customer to the PagBank payment page. The customer's name and e-mail are passed, as well as the CPF or CNPJ (11 or 14 digits) from a custom field of the customer or the payment address whose name contains CPF or CNPJ, and a Brazilian phone number. OpenCart has no CPF field by default; you can add one in Customers > Custom Fields. On OpenCart 4, when the store asks for no payment address, the shipping address and its custom fields are used. The customer can complete or correct these details on the PagBank page and pays with the methods enabled in your PagBank account. The payment page expires after 120 minutes.

After paying, the customer returns to your store. The order is marked paid only after PagBank confirms it: the extension reads the payment from the PagBank API when the notification arrives or when the customer comes back, and the charged amount (without PagBank installment interest) and currency must match the order. The order then gets its status the standard OpenCart way, with the usual order e-mails and stock update, and the customer sees the OpenCart order success page. For a generated boleto or PIX, or a payment in analysis, the page also shows Your PagBank payment is awaiting confirmation (boleto / PIX / analysis). The order will be confirmed as soon as PagBank reports the payment. For an order in the review status it shows We are confirming your payment with PagBank. The order will be updated automatically — please do not pay again. If PagBank has not confirmed the payment yet when the customer comes back, a Payment confirmation page shows the same text with Check again and Back to checkout buttons.

If the payment was not completed, the customer is back at checkout with The PagBank payment was not completed. You can try again or choose another payment method., The PagBank payment page has expired. You can try again or choose another payment method. or The payment was declined by PagBank. Please try again with another card or payment method. The cart is kept. On OpenCart 4 these messages are shown above the checkout page. If an order that was waiting for a boleto or PIX was cancelled, the customer sees The PagBank payment was cancelled, so the order was cancelled. If the cart is already empty (for example, the order had reached the success page before its boleto or PIX expired), there is nothing to pay at checkout: a Payment confirmation page shows the message instead, for an unpaid order The PagBank payment of order #N was not completed (declined, canceled or expired), so the order will not be shipped. To buy these items, please place a new order., with a Continue button.

OpenCart 3 creates a new order every time the Confirm Order step is shown. OpenCart 4 keeps one order for the checkout and updates it, so after a declined card, an unfinished payment or an expired page the customer pays the same order with a new PagBank checkout. Before a new payment the extension checks the earlier PagBank checkouts of the same order and cart: a payment made on an earlier page is applied instead of a new payment, and if another order of the cart is paid or waiting, the customer goes to the success page. The open checkout of the order is reused if the amount and environment are the same and it does not expire within 10 minutes; otherwise it is deactivated, so it can no longer be paid. If a second payment arrives anyway, a note asks you to refund it.

If the order was paid and then closed by you (for example cancelled or refunded), the customer who comes back from PagBank is not shown the success page: the customer is back at checkout with Your previous order #(number) was closed by the store. Please confirm the order again to pay with a new order., or sees this message on a Payment confirmation page when the cart is already empty.

OpenCart 4 keeps the order in the checkout until the success page is shown. If that order was closed meanwhile, Confirm Order sends the customer back to the checkout with the matching message: the messages about a cancelled boleto or PIX and a declined payment above, Your previous order was cancelled without a payment. Please confirm the order again to pay with a new order. or, for an order that was paid and then closed by you, the message about the order closed by the store. The next Confirm Order pays a new order. If that order is already paid or waiting and the cart now has other products or quantities, the message is Your previous order #(number) has already been placed. Your cart has changed: please confirm the new order to pay for it.

If PagBank cannot start the payment, the customer stays at the Confirm Order step with a short message, for example PagBank did not accept your billing details (CPF/CNPJ). Please check them and try again. or Could not connect to PagBank. Please try again in a moment. The technical reason is written to the log.

Notifications also work while the store is in maintenance mode: OpenCart 3 lets payment extension requests through, and on OpenCart 4 the extension adds a startup action that lets the notifications and the customer's return from PagBank through.

The extension has no on-site card form, no saved cards, no subscriptions or recurring payments and no split payments or marketplaces. Payment methods and installments are those configured in your PagBank account.

Orders and refunds

Order statuses

No status (missing order): the customer was sent to PagBank and has not paid, the card was declined or the payment page expired; the customer can pay again. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders.

On OpenCart 4 an unpaid order of the checkout can get the status Voided, which OpenCart 4 sets when the customer comes back to the Confirm Order step. The extension treats such an order as an order without status, and a later payment still confirms it.

Order Status After Payment (default Processing): the payment was confirmed with the expected amount and currency. A note shows the amount, the payment method and the PagBank charge ID.

Awaiting PagBank Payment Status (default Pending): a boleto or PIX was generated and is waiting for payment, or the payment is in analysis. The order moves to Order Status After Payment when PagBank reports it as paid.

PagBank Payment On Hold Status (default Pending): PagBank reported a different amount or currency than the order, a payment arrived after the order had been cancelled (check stock, then complete the order or refund the payment in PagBank), or a card payment was authorized but not captured (capture it in PagBank). The note explains it. The money actually received is recorded for refunds.

Payment Declined Status (default Failed): a payment that was waiting or in analysis was declined.

Payment Cancelled Status (default Canceled): a payment that was waiting, for example an expired boleto or PIX, was cancelled.

Refunded Status (default Refunded): the payment was fully refunded, through the extension or in the PagBank dashboard.

Every PagBank status is applied once, so repeated notifications or returns add no notes or status changes. A paid order is never changed back. If a second payment arrives for an order that is already paid, the order is not changed and a note asks you to refund the duplicate in PagBank. Notes are entries in the order History that the customer does not see.

VibeFox PagSeguro Gateway tab

In Sales > Orders open an order paid with PagBank. At the bottom of the order page, next to History and Additional, the VibeFox PagSeguro Gateway tab shows the PagBank checkout with a Sandbox label for sandbox payments, the PagBank order and Charge IDs, the Payment method, the Status, the amounts Paid / refunded, the refund form, the refund history and the PagBank notes of the order. The tab is shown to users who have access to the extension.

Refunds

In the VibeFox PagSeguro Gateway tab enter the Amount (the amount not refunded yet is filled in), optionally a Reason (optional), and click Refund via PagBank. Confirm the question Refund this amount through PagBank? This cannot be undone. Full and partial refunds are supported. You need the right to modify the extension (set in System > Users > User Groups). The limit is the amount PagBank charged, so after an amount mismatch you can refund up to what the customer actually paid, not the order total. The refund is sent in the environment and with the token in which the payment was made. A refund is recorded only when PagBank confirms it; otherwise the tab shows the error, for example PagBank refund failed: ... or PagBank did not confirm the refund, and nothing is recorded. Refunds of boleto payments and partial refunds of PIX follow PagBank's rules. A successful refund is added to the refund history and the notes with the charge ID. A full refund sets the order to Refunded Status without notifying the customer and without returning products to stock, like a manual status change. A partial refund does not change the status. Refunds are available once PagBank has reported the payment as paid.

Product returns in Sales > Returns do not send money back through PagBank.

Refunds made in the PagBank dashboard are seen with the next notification or check: a full refund sets the order to Refunded Status, a partial refund adds a note with the refunded amount.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox PagSeguro Gateway is the first block on Extensions > Extensions > Payments > VibeFox PagSeguro Gateway > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-pagseguro and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain: the store address from the OpenCart configuration. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, PagBank is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed, and refunds work.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

PagBank does not appear at checkout: check that the license is active, Enable / Disable is on, the token of the current mode is set (Sandbox token in sandbox mode, Production token in live mode) and the customer checks out in BRL. The settings page shows a warning when the token is missing or the store currency is not BRL. Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings.

The payment went through, but the order stays without a status: PagBank has not reported the payment yet and the customer did not return to the store. The order gets its status as soon as the notification arrives. Check that your store is reachable from the Internet at the Notification URL, and turn on Debug log to see the notifications.

The notification answers Invalid signature: the x-authenticity-token does not match the token of the environment in which the payment was made, or that token is not saved. Check that the right token is in the settings.

The notification answers Verification failed, retry later: the PagBank API could not be reached, the token of the payment's environment is missing, or the cart was being processed by another request at the same moment. PagBank retries the notification.

The notification answers Order not found: the notification is for an order that was not paid with this extension in this store. Nothing is changed.

The customer sees PagBank payments are temporarily unavailable. Please choose another payment method.: the token of the current mode is missing or PagBank rejected it.

The customer sees PagSeguro/PagBank only accepts payments in Brazilian Real (BRL).: the checkout is in another currency.

The customer sees This order has no amount to pay.: the order total is zero.

Order is in the review status after payment: read the notes in the VibeFox PagSeguro Gateway tab (see Order statuses), compare the amounts in PagBank, then fulfil the order or refund the payment.

No refund form in the tab: the tab says why: the payment is not reported as paid yet, it is fully refunded, your user group has no right to modify the extension, or the token of the payment's environment is not set.

Refund fails with a message about the token: the payment was made in the sandbox or in production, and the token of that environment is missing or rejected. Enter the right token and try again.

For developers: before the PagBank checkout is created, the extension triggers the OpenCart event wc_psg_checkout_data with the request body, the order and the environment. The item must stay equal to the order total.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox PagSeguro Gateway. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable / Disable, Sort Order, Geo Zone, Total and the order statuses of the Orders section, which return to their defaults on a re-install. The OpenCart event of the extension is removed too (on OpenCart 4 its events and its startup action, which lets the notifications and the customer's return through in maintenance mode). If Delete Data on Uninstall is on, the other gateway settings (title, description, sandbox mode, tokens, logging) and the log are removed. If it is off, they are kept for a later re-install. The PagBank payment and refund records are always kept, so orders paid before can still be refunded after a re-install. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox PagSeguro Gateway in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

PagSeguro and PagBank are trademarks of their respective owner. This extension is not affiliated with or endorsed by PagSeguro or PagBank.