VibeFox Peach Payments for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later with the OpenSSL extension (used to decrypt webhooks).

Currency: the checkout currency of the customer must be ZAR, KES or MUR, so your store needs at least one of these currencies in System > Localisation > Currencies. For customers paying in other currencies the payment method is hidden. The settings page warns you when the default currency of the store is not one of them.

Peach Payments account: you need the Card API credentials of your Peach Payments account: the Entity ID and the Access Token. Test credentials come from the Peach Payments sandbox dashboard, live credentials from the Peach Payments dashboard; they are different. For webhooks you also need a webhook decryption key, which Peach Payments sends you when they enable Card webhooks for your store (see Configuration). Your store must be reachable from the internet to receive webhooks.

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_peach_pay-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_peach_pay.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_peach_pay-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of this package into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Peach Payments Pay Gateway and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Enter the test Entity ID and Access Token from the Peach Payments sandbox dashboard, and ask Peach Payments to enable Card webhooks for the webhook URL shown on the settings page (see Configuration).

5. Turn on Enable/Disable and click Save. Keep Test mode on and make a payment with a Peach Payments sandbox test card in ZAR, KES or MUR. Then turn off Test mode, enter the live credentials and the live webhook key, and click Save.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_peach_pay.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Peach Payments Pay Gateway, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key, the Peach Payments credentials and the webhook as in steps 3 to 5 for OpenCart 3. The settings page and its fields are the same in both versions. Only the webhook URL is different (see Webhook).

A new install starts with the payment method turned off and test mode on.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox Peach Payments Pay Gateway > Edit. The sections are listed on the left; the Save button under the list saves the whole page. Above the settings the page shows notices: Test mode is on: payments go to the Peach Payments sandbox and no real money is charged.; an error when the Entity ID or Access Token of the current mode is missing (until then the payment method is not shown at checkout); a warning when the webhook decryption key of the current mode is missing (then payments are confirmed only when the customer returns to the store); and a notice when the default currency of the store is not supported (the payment method is then shown only to customers paying in a supported currency). Without the right to modify the extension the page shows the settings but cannot save them.

When you save, Title must not be empty or longer than 128 characters (the page shows Enter a title for the payment method (up to 128 characters).), Sort Order must be a whole number (negative values are allowed), Total a number 0 or greater, and the geo zone and order statuses must exist. Otherwise nothing is saved. Spaces are removed from the credentials. A webhook key that is not a 64-character hexadecimal value, or an empty card brand list, is saved with a warning.

Peach Payments

Enable/Disable: Enable Peach Payments turns the payment method on or off. Default: off.

Title: the payment method name shown to the customer at checkout. It is also the payment method name stored in the order. Default: Credit / Debit Card (Peach Payments). Required, up to 128 characters.

Description: the text shown to the customer at the Confirm Order step, above the confirm button, next to a card icon. Default: Pay securely with your card. You will enter the card details in the Peach Payments form on the next page.

Sort Order: the position of Peach Payments among the payment methods at checkout. Leave it empty or enter a whole number.

Geo Zone: offer Peach Payments only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones.

Total: the checkout total, in the default currency of the store, that an order must reach before Peach Payments is offered. Leave it empty to offer it for any total.

API credentials

The Access Token and the Entity ID of the Card API are shown in the Peach Payments dashboard (test credentials: in the sandbox dashboard). The section links to both dashboards and to the Peach Payments developer documentation.

Test mode: sends new payments to the Peach Payments sandbox with the test credentials, and no real money is charged. Turn it off to accept real payments with the live credentials. A payment started in one mode is always checked in that mode, even after you switch. Default: on. While it is on, customers see Test mode: no real payment will be made. at the Confirm Order step.

Test Entity ID: the Entity ID (3-D Secure channel) of your sandbox account.

Test Access Token: the bearer access token of your sandbox account.

Test Webhook Decryption Key: the 64-character hexadecimal key used to decrypt the Card webhooks of the sandbox.

Live Entity ID: the Entity ID (3-D Secure channel) of your live account.

Live Access Token: the bearer access token of your live account.

Live Webhook Decryption Key: the 64-character hexadecimal key used to decrypt the Card webhooks of the live account.

Saved access tokens and webhook keys are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove a saved value, tick Clear the saved value on save under the field and click Save.

Webhook

Webhooks confirm payments even when the customer closes the browser before returning to the store. The Webhook URL field shows the webhook URL of your store. On OpenCart 3 it looks like https://your-store/index.php?route=extension/payment/wcp_peach_pay/webhook, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_peach_pay/payment/wcp_peach_pay.webhook. It is built from the storefront address of your OpenCart installation. Copy the URL exactly as the settings show it. Ask Peach Payments (support@peachpayments.com) to enable Card webhooks for your account with this URL, then enter the decryption key you receive in the Webhook Decryption Key field of the same mode.

Peach Payments encrypts every webhook (AES-256-GCM). A webhook that cannot be decrypted with the test or live key is rejected, so only Peach Payments can change your orders. A webhook decrypted with the key of one mode is applied only to payments started in that mode. The extension uses payment notifications:

Other notifications, for example the test notification sent when the webhook is activated, are answered with ignored. Without the webhook key, an order gets its status only when the customer comes back to the store after paying.

Payment form

Card brands: the brands shown in the Peach Payments form: Visa, Mastercard, American Express, Diners Club. Select only brands enabled for your Entity ID. Default: Visa and Mastercard. If no brand is selected, the save shows a warning and the form shows Visa and Mastercard.

Orders

The order is created at the Confirm Order step without a status (a missing order) and gets a status only after Peach Payments has confirmed the payment. A declined or abandoned payment leaves it without a status, and the cart is kept. Each field below lists your OpenCart order statuses.

Order Status After Payment: set when Peach Payments confirms the payment and the amount and currency match. Default: Processing.

Awaiting Payment Status: Peach Payments reported an asynchronous payment that waits for a confirmation; the webhook confirms it later. Default: Pending, because OpenCart has no On hold status. You can create your own status in System > Localisation > Order Statuses and select it here.

On Hold (Review) Status: manual review: the paid amount or currency differs from the order, or a payment arrived after the order was cancelled. A note explains the reason. Default: Pending.

Payment Failed Status: set when the asynchronous payment the order was waiting for is declined. A later successful payment still completes the order. Default: Failed.

Canceled Status: the extension does not set it. A payment for an order in this status puts it on hold instead of re-opening it. Default: Canceled.

Refunded Status: the extension does not set it. A payment received for an order in this status is only noted, and the order is not changed. Default: Refunded.

Advanced

Logging: logs API requests and payment results to peach_p_debug.log.php in the OpenCart logs folder (storage/logs). The file cannot be read from the web, and at 5 MB it is moved to peach_p_debug.old.log.php. Errors and warnings are always logged. Logs contain no card data, keys or customer data. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete data on uninstall: when on, uninstalling the extension removes the gateway settings and the log. The Peach Payments data of the orders (checkout attempts, payment IDs) is kept, because it belongs to the orders. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. Access tokens and webhook keys are not exported.

Import: paste previously exported JSON and click Import to restore the settings. Saved access tokens and webhook keys are kept.

Checkout

At the Payment Method step the customer chooses the payment method (by default Credit / Debit Card (Peach Payments)). At the Confirm Order step the customer sees a card icon and your description; OpenCart creates the order at this step, still without a status. When the customer clicks Confirm Order, the extension prepares a Peach Payments checkout for the order total in the order currency and opens the Peach Payments payment page of your store with Please enter your card details to complete the payment:, the Peach Payments card form and the selected card brands, in the language of the customer when Peach Payments supports it. In test mode the page shows Test mode: use a Peach Payments test card, no real payment will be made. The card details are entered in the Peach Payments form, and the form script is loaded with a Subresource Integrity hash. The link Choose another payment method leads back to the checkout. Reloading the page reuses the same checkout for up to 25 minutes, unless the order total changed. On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options, and clicks Confirm Order at the bottom of the checkout page.

After paying, the customer returns to your store. The order is marked paid only after Peach Payments confirms it: the store reads the result of this order's checkout from the Peach Payments API, in the mode the checkout was created in, and checks that the payment belongs to this order. The webhook does the same independently, so whichever arrives first sets the order status and the other one changes nothing. The order then gets its status the standard OpenCart way, with the usual order e-mails and stock update, and the customer sees the OpenCart order success page. On OpenCart 4, when the customer comes back from a 3-D Secure page of the bank, a short intermediate page opens the return address again from your store, so the cart and the customer login are kept.

If the payment is not completed, the customer is back at checkout with a message and can try again: Payment failed: followed by the reason from Peach Payments and Please try again or use another card., or The payment was not completed. Please try again. The cart is kept. If the result cannot be confirmed yet (for example, Peach Payments did not answer, or the webhook is processing the same cart at that moment), the message is We could not confirm your payment yet. If you were charged, the order will be updated automatically; otherwise please try again. When no webhook key is set for the mode of the payment, the customer is instead asked to contact you. On OpenCart 4 these messages are shown above the checkout page.

OpenCart 3 creates a new order every time the Confirm Order step is shown, OpenCart 4 updates the order of the checkout. A cart is paid only once: if another order of the same cart is already paid, the customer goes straight to the success page. A change of the cart, including a new quantity, counts as a new cart that needs its own payment.

OpenCart 4 keeps the order in the checkout until the success page is shown. After a declined attempt the customer pays the same order again with a new Peach Payments checkout. If that order was closed meanwhile (for example its awaited payment failed or you cancelled it), the customer is sent back to the checkout with Your previous order is already closed or paid. Please confirm the order again: the cart will be paid with a new order., and the next Confirm Order pays a new order. If the order was paid and then cancelled or refunded by you, the message is This order was cancelled or refunded by the store. Please contact the store about its payment, or confirm the order again: the cart will be paid with a new order.

If the payment form cannot be prepared, the customer stays at the Confirm Order step with a short message: The payment form is not available right now (payment configuration error). Please contact us or choose another payment method. (missing or wrong credentials), a message that some billing details were not accepted by the payment provider, or The payment form could not be loaded. Please try again in a moment. The technical reason is written to the log.

The webhook also works while the store is in maintenance mode, because OpenCart lets payment extension requests through. On OpenCart 4 a startup action of the extension lets the webhook and the customer return through.

The extension has no card form on the checkout step itself, no saved cards, no subscriptions, no pre-authorisation and capture, and no EFT, BNPL, QR or other non-card methods.

Orders

Order statuses

No status (missing order): the customer has not paid, the payment was declined or not completed, or Peach Payments has not confirmed it yet. The customer can pay again. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders. On OpenCart 4.1 such an order can also have the status Voided, which OpenCart sets when the confirm step is shown again; the extension counts it as an order without a status.

Order Status After Payment (default Processing): the payment was confirmed and the amount and currency match the order. A note shows the Peach Payments result code, description and payment ID. If Peach Payments flagged the payment for manual review, the note asks you to check it in the Peach Payments dashboard before shipping.

Awaiting Payment Status (default Pending): Peach Payments reported a payment that waits for a confirmation. The webhook later moves the order to Order Status After Payment or to Payment Failed Status.

On Hold (Review) Status (default Pending): the paid amount or currency differs from the order (note amount/currency mismatch — manual review required), or the payment arrived after the order had been cancelled. Check the payment in the Peach Payments dashboard, then process the order or refund the payment.

Payment Failed Status (default Failed): Peach Payments declined the payment the awaiting order was waiting for. A declined attempt never changes an order that is paid or on hold.

If a second payment for an already paid order succeeds, or a payment for another order of a cart that is already paid, the paid order is not changed. A note says it is a duplicate payment and asks you to refund it in the Peach Payments dashboard. A payment that arrives for a refunded order is only noted on the order.

Notes are entries in the order History that the customer does not see.

VibeFox Peach Payments Pay Gateway tab

In Sales > Orders open an order paid with Peach Payments. At the bottom of the order page, next to History and Additional, the tab of the extension shows the Payment ID with a Test mode label for test payments, the Checkout ID, the Merchant transaction ID, the Amount sent to Peach Payments, the Result and result code, and the Peach Payments notes of the order. The tab is shown to users who have access to the extension.

Refunds

Refunds from OpenCart are not available. Refund the payment in the Peach Payments dashboard and record it in OpenCart if needed. With the webhook set up, refunds, reversals and chargebacks made in Peach Payments are added to the order notes with the amount and ID; the order status is not changed. Product returns in Sales > Returns do not send money back through Peach Payments.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox Peach Payments Pay Gateway is the first block on Extensions > Extensions > Payments > VibeFox Peach Payments Pay Gateway > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-peach and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain: the store address from the OpenCart configuration. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, Peach Payments is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed by the customer return and the webhook.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

Peach Payments does not appear at checkout: check that the license is active, Enable/Disable is on, the Entity ID and Access Token of the current mode are entered (Test Entity ID and Test Access Token in test mode, Live Entity ID and Live Access Token in live mode) and the customer pays in ZAR, KES or MUR. Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings. The notices at the top of the settings name the problem.

The payment went through, but the order stays without a status: the customer did not come back to the store and the webhook did not arrive. Check that Peach Payments enabled Card webhooks for exactly the URL shown in the settings, that the Webhook Decryption Key of the mode the payment was made in is entered, and that no firewall or password protection blocks the URL. Turn on Logging and look at the Log field for rejected webhooks.

Webhook answers Decryption failed: the webhook could not be decrypted with the test or live key. The key is wrong or belongs to another account or mode. Enter the key Peach Payments sent for this webhook URL.

Webhook answers Webhook key not configured: neither webhook key is set or valid. Enter the 64-character key. Peach Payments sends the webhook again later.

Webhook answers Busy, retry later: the cart was being processed by the customer return at the same moment. Nothing was changed, and Peach Payments sends the webhook again. The log shows the reason.

Webhook answers Missing or malformed data: the request had no encrypted body or no X-Initialization-Vector / X-Authentication-Tag headers, for example because a proxy changed it. Nothing was changed.

Webhook answers ignored: the notification is authentic but does not belong to a checkout of this store (another store on the same Entity ID), or it came from the other mode than the payment. Nothing was changed.

The webhook URL shows Method not allowed in the browser: this is normal. The URL accepts only requests from Peach Payments.

The customer sees The payment form is not available right now: the Access Token or Entity ID of the current mode is wrong. Check the credentials and the mode, and read the log for the Peach Payments code.

The customer sees The payment session was not found. Please confirm the order again.: the payment page was opened for an order that is no longer the customer's current order, or the payment method was turned off meanwhile. The customer confirms the order again.

The order is in the review status after payment: read the notes in the tab of the extension. The paid amount or currency differed from the order, or the payment arrived after the order had been cancelled. Check the payment in the Peach Payments dashboard, then process the order or refund the payment.

Saving shows that the webhook key must be the 64-character hexadecimal key: the value is not the key from Peach Payments. Webhooks cannot be decrypted until it is corrected.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox Peach Payments Pay Gateway. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable/Disable, Sort Order, Geo Zone, Total and the order statuses of the Orders section, which return to their defaults on a re-install. If Delete data on uninstall is on, the other gateway settings (title, description, test mode, credentials, webhook keys, card brands, logging) and the log are removed. If it is off, they are kept for a later re-install. The checkout attempts and payment IDs are always kept. On OpenCart 4 the events of the extension and its startup action, which lets the webhook and the customer return through in maintenance mode, are always removed. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox Peach Payments Pay Gateway in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

Peach Payments is a trademark of its respective owner. This extension is not affiliated with or endorsed by Peach Payments.