VibeFox Redsys for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later.

Redsys merchant account: your bank (the acquirer that gave you the Redsys virtual POS) gives you the merchant code (FUC), the terminal number and access to the Redsys administration panel, where the SHA-256 secret key of each environment is shown. The key of the test environment is different from the real one. The online notification (HTTP) must be active for your terminal. Ask your bank if you are not sure.

Currency: one of the currencies the extension supports (see Configuration), and your Redsys terminal must be enabled by the bank for it. Most terminals accept EUR only.

Reachable store: Redsys must be able to reach your store from the internet, without a login or a firewall block, to deliver the payment notifications.

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_redsys_gateway-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_redsys_gateway.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_redsys_gateway-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of this package into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Redsys Gateway and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Enter your merchant code, terminal and the secret key of each environment (see Configuration).

5. Turn on Enable/Disable and click Save. Test a payment with Test Mode on, then turn off Test Mode to accept real payments.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_redsys_gateway.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Redsys Gateway, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key and the Redsys data as in steps 3 to 5 for OpenCart 3. The settings page and its fields are the same in both versions. Only the notification URL is different (see Payment notifications).

A new install starts with the payment method turned off and test mode on.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox Redsys Gateway > Edit. The sections are listed on the left; the Save button under the list saves the whole page. Without the right to modify the extension the page shows the settings but cannot save them.

Above the settings the page warns you when the merchant code is missing or not made of digits, when a secret key is not a valid Redsys SHA-256 key, when the key of the current mode is empty (the payment method is then hidden at checkout) and when the default currency of the store is not supported. While test mode is on it shows Test mode is active: payments go to the Redsys test environment (SIS-T), no real money is charged.

When you save, Title must be 1 to 128 characters long (Enter a title for the payment method (1 to 128 characters).), Sort Order must be a whole number (negative numbers are allowed), Total must be a number, 0 or greater, and the geo zone and every order status must exist. Otherwise nothing is saved.

Redsys

Enable/Disable: Enable Redsys Gateway turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. It is also the payment method name stored in the order. Default: Credit/Debit Card (Redsys). Required, up to 128 characters.

Description: the text shown to the customer at the Confirm Order step, above the confirm button. Default: Pay securely with your credit or debit card via Redsys.

Sort Order: the position of Redsys among the payment methods at checkout. Leave it empty or enter a whole number.

Geo Zone: offer Redsys only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones.

Total: the checkout total, in the default currency of the store, that an order must reach before Redsys is offered: a number, 0 or greater. Leave it empty to offer Redsys for any total.

Redsys account

Your bank gives you the merchant code (FUC), the terminal and access to the Redsys administration panel, where the SHA-256 secret key of each environment is shown. The section links to the Redsys administration panel.

Merchant Code (FUC): your Redsys merchant code, up to 9 digits. Anything that is not a digit is removed when you save.

Terminal Number: the terminal number assigned by your bank, up to 3 digits. Default: 1. An empty field is saved as 1.

Secret Key (SHA-256) — live: the Base64 SHA-256 key of the real (production) environment, usually 32 characters. It is used when test mode is off.

Test mode (SIS-T)

The Redsys test environment has its own secret key. The section shows the public Redsys test data: merchant code 999008881, terminal 1, key sq7HjrUOBfKmC576ILgskD5srU870gJ7, card 4548 8100 0000 0003, expiry 12/49, CVV 123. No real money is charged in test mode.

Test Mode: payments and refunds go to the Redsys test environment (SIS-T) and are signed with the test key. Default: on. Turn it off to take real payments. While it is on, customers see TEST MODE: Redsys test environment, no real money is charged. at the Confirm Order step.

Secret Key (SHA-256) — test: the Base64 SHA-256 key of the test environment. Use your own test key or the public test key above.

Saved keys are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove a saved key, tick Clear saved secret on save under the field and click Save.

Payment page and orders

Commerce Name: the store name shown on the Redsys payment page, at most 25 characters. Default: the name of your store, cut to 25 characters.

Order Status After Payment: which status a paid order gets.

Amount or currency mismatches, test payments while the gateway is in live mode and payments of cancelled attempts always get the On hold (review) status.

OpenCart creates the order at the Confirm Order step without a status (a missing order). It gets a status only after the signed Redsys notification. A refused or cancelled payment leaves the order without a status; the customer goes back to the checkout with the cart kept. Each field below lists your OpenCart order statuses.

Processing status: used when Order Status After Payment is Processing. Default: Processing.

Completed status: used when Order Status After Payment is Completed. Default: Complete.

On hold (review) status: payments that need your review (see above), or every paid order when Order Status After Payment is On hold (review). Default: Pending, because OpenCart has no On hold status; a note on the order explains why. You can create your own status in System > Localisation > Order Statuses and select it here.

Refunded status: set when the Redsys payment is fully refunded from the order page. Default: Refunded.

Payment notifications

Notification URL: Redsys reports every payment to this address of your store. It is shown in this section. On OpenCart 3 it looks like https://your-store/index.php?route=extension/payment/wcp_redsys_gateway/notify, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_redsys_gateway/payment/wcp_redsys_gateway.notify. It is built from the storefront address of your OpenCart installation. The extension sends it to Redsys with every payment, so there is nothing to copy into the Redsys panel. The online notification (HTTP) must be active for your terminal. Ask your bank if no order is confirmed after a successful payment. Notifications without a valid signature are rejected. Without the notification, the order never gets a status.

Advanced

Debug log: writes the details of payments, notifications and refunds to rdsg_debug.log.php in the OpenCart logs folder (storage/logs). The file cannot be opened from the web, and at 5 MB it is moved to an old copy. Errors are always logged, also when this option is off. Keys, signatures and card data are never logged. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete Data: when on, uninstalling the extension removes the gateway settings and the log. The Redsys payment records of orders (needed for refunds) are always kept. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. The secret keys are not exported.

Import: paste previously exported JSON and click Import to restore the settings. The saved secret keys are kept.

Supported currencies

EUR, USD, GBP, JPY, CHF, CAD, AUD, NZD, NOK, SEK, DKK, PLN, CZK, HUF, BGN, RON, ILS, INR, MYR, SGD, THB, SAR, ZAR, RUB, BRL, MXN, ARS, CLP, COP, PEN, CNY, TWD. The payment method is hidden when the customer's currency is not in this list.

Checkout

At the Payment Method step the customer chooses the payment method (by default Credit/Debit Card (Redsys)). At the Confirm Order step the customer sees your description. OpenCart creates the order at this step, still without a status. When the customer clicks Confirm Order, the extension prepares a signed payment form, the customer sees Redirecting to Redsys for payment. Please wait... and goes on to the Redsys payment page of your bank. If the browser does not go on by itself, the customer clicks Pay via Redsys. On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options, and clicks Confirm Order at the bottom of the checkout page.

On the Redsys page the customer pays by card with 3-D Secure, or by Bizum or another method your bank has enabled for the terminal. The page uses the language of the customer (Spanish, English, Catalan, French, German, Italian, Portuguese and more), or English for other languages. The amount is the order total in the minor units of the order currency, for example EUR 43.45 as 4345, and JPY or CLP without decimals. The payment is described as Order with the order number and your store name.

After paying, the customer returns to your store. The return itself does not mark anything as paid. The order is marked paid only after Redsys confirms it by the signed notification. The order then gets its status the standard OpenCart way, with the usual order e-mails and stock update, and the customer sees the OpenCart order success page with Your payment with Redsys has been received. If the order got the On hold (review) status, the page shows Your payment with Redsys has been received and is being reviewed by the store. If the notification has not arrived yet, a Payment confirmation page shows Redsys is confirming your payment. If you completed the payment, your order will be confirmed in a few moments — please do not pay again. with the buttons Check again and Back to checkout.

If the customer cancels or the payment is refused, Redsys sends the customer back to the checkout with The Redsys payment was not completed. You can try again or choose another payment method. The cart is kept, and the customer can pay again. Each new attempt gets a new Redsys order number, and a payment made from any of them, for example from a second browser tab, is still recognised. OpenCart 3 creates a new order every time the Confirm Order step is shown; if another order of the same cart is already paid, the customer goes straight to the success page, and a late payment of the other order is not applied.

On OpenCart 4 the message about the payment that was not completed is shown above the checkout page. OpenCart 4 keeps one order for the checkout and updates it, so after a cancel or a refused payment the customer pays the same order with a new Redsys order number. If that order was closed meanwhile, the customer is sent back to the checkout with Your previous order was closed without a payment. Please confirm the order again to pay with a new order. or, when it had a Redsys payment, Your order was cancelled or refunded by the store. Please confirm the order again to pay with a new order. The next Confirm Order pays a new order. If the order of the checkout is already paid but the cart has changed since, including a new quantity, the customer is sent back to the checkout and the new cart is paid with a new order.

If the payment cannot be sent to Redsys, the customer stays at the Confirm Order step with a short message: Redsys payments are not configured correctly. Please choose another payment method or contact us., a message that payments in the currency are not accepted, or The order total must be greater than zero.

The notification and the return of the customer also work while the store is in maintenance mode: OpenCart 3 lets payment extension requests through, and on OpenCart 4 the extension adds a startup action for them.

The extension takes one-time payments, authorised and captured at once on the Redsys page. It has no card form on your own site (InSite or iframe), no saved cards, one-click payments or tokenisation, no subscriptions or recurring payments, no pre-authorisation with later capture and no payment links for orders created in the admin.

Orders and refunds

Order statuses

No status (missing order): the customer was sent to Redsys and has not paid, the payment was refused or cancelled, or the Redsys notification has not arrived yet. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders.

Processing, Completed or On hold (review) status: the payment was confirmed. The status follows Order Status After Payment. A note shows the Redsys order number (Ds_Order), the authorisation code and the response code, marked [TEST] for test payments.

On hold (review) status after payment: Redsys reported a different amount or currency than the order total, a test payment arrived while the gateway is in live mode (no real money was charged), or the customer paid after cancelling that payment on the Redsys page. The note explains it. Check the payment in the Redsys administration panel, then process the order or refund the payment.

Refunded status: the payment was fully refunded through the extension.

A refused payment never changes an order that already has a status. For frequent response codes the log and notes give a short reason, such as Insufficient funds, Card expired or Cancelled by the customer. If a second, different payment arrives for an order or a cart that is already paid, the order is not changed. A note asks you to refund the duplicate payment in the Redsys administration panel. If Redsys reports that a payment is still in progress, a note is added and the order waits for the final result.

Notes are entries in the order History that the customer does not see.

VibeFox Redsys Gateway tab

In Sales > Orders open an order paid with Redsys. At the bottom of the order page, next to History and Additional, the VibeFox Redsys Gateway tab shows the Redsys order number (Ds_Order), the Authorisation code / response, the Environment (live or test) with a Test mode label, the payment Status, Paid / refunded, a review hint for orders on hold, the refund form, the refund history, the Redsys notes of the order and the Redsys order numbers issued for this cart. The tab is shown to users who have access to the extension.

Refunds

In the tab enter the Amount (the amount not refunded yet is filled in), optionally a Reason (optional), and click Refund via Redsys. Confirm the question Refund this amount through Redsys? This cannot be undone. Full and partial refunds are supported. You need the right to modify orders (Sales > Orders, set in System > Users > User Groups). Refunds are made in the amount and currency Redsys charged, so after an amount or currency mismatch you can refund up to what the customer actually paid, not the order total. The refund is sent through the Redsys REST API to the environment the payment was made in (test or live), signed with that environment's key, and the response signature is checked. If Redsys does not accept the refund, the tab shows the error and no refund is recorded. A successful refund is added to the refund history and the notes with the Redsys order number and the reason. A full refund sets the order to Refunded status without notifying the customer and without returning products to stock, like a manual status change. A partial refund does not change the status.

Product returns in Sales > Returns do not send money back through Redsys.

Refunds made in the Redsys administration panel are not recorded as refunds of the extension. When Redsys sends a notification for them, a note is added to the order. The order status is not changed automatically.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox Redsys Gateway is the first block on Extensions > Extensions > Payments > VibeFox Redsys Gateway > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-redsys and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain: the store address from the OpenCart configuration. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, Redsys is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed, and refunds work.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

Redsys does not appear at checkout: check that the license is active, Enable/Disable is on, the merchant code and terminal are filled in and the current mode has a valid key: Secret Key (SHA-256) — test in test mode, Secret Key (SHA-256) — live in live mode. Check that the customer's currency is in the list of supported currencies. The settings page shows a warning for each of these problems. Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings.

The payment went through, but the order stays without a status: the Redsys notification did not reach your store. Ask your bank to check that the online notification (HTTP) is active for your terminal. Check that the address shown in Notification URL can be reached from the internet without a login or a firewall block. Turn on Debug log and look at the Log field on the extension page.

Notification answers Forbidden: the signature did not match the secret key of the environment the payment was started in, or the merchant code in the notification is not yours. Check that the secret keys and the merchant code in the settings are the ones of your terminal.

Notification answers Order not found: the notification was signed correctly, but no order of this store uses that Redsys order number.

Notification answers Busy: the cart was being processed by another notification at the same moment, or the order status could not be set. Redsys retries the notification. The log shows the reason.

Notification answers Bad request: the request had no or broken Redsys parameters. It did not come from Redsys in the expected format.

Order is in the on-hold status after payment: read the notes in the VibeFox Redsys Gateway tab (see Order statuses), then process the order or refund the payment.

Test payments do not confirm orders in live mode: a test payment never pays an order while Test Mode is off. The order is put on hold with a note instead. Use test mode with the test key for test payments.

Refund fails: read the error. Redsys refund: the merchant code or the TEST secret key is not configured. (or LIVE) means the key of the environment of the payment is missing. Redsys error codes are explained in the message, for example SIS0057 (the amount exceeds what is left of the payment), SIS0056 (the original payment was not found, other environment or terminal), SIS0042 (signature error, check the key of this environment), SIS0026 (unknown merchant code or terminal) and SIS0027 (currency not configured for the terminal). If Redsys cannot be reached, the refund is not made. Try again later.

No refund form in the tab: the tab says why, for example the order has no confirmed Redsys payment, it is fully refunded, or your user group has no right to modify orders.

For developers: the extension triggers the OpenCart events wcp_redsys_gateway/merchant_parameters (the payment parameters and the order) and wcp_redsys_gateway/currency_codes (the list of supported currencies). Add a currency only if your bank has enabled it for the terminal.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox Redsys Gateway. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable/Disable, Sort Order, Geo Zone, Total and the four order statuses, which return to their defaults on a re-install. The OpenCart event of the extension is removed too (on OpenCart 4 its events and its startup action, which lets the notification and the return of the customer through in maintenance mode). If Delete Data is on, the other gateway settings (title, description, merchant code, terminal, keys, test mode, commerce name, order status after payment, logging) and the log are removed. If it is off, they are kept for a later re-install. The Redsys payment records and refunds are always kept, so orders paid before can still be refunded after a re-install. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox Redsys Gateway in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

Redsys is a trademark of its respective owner. This extension is not affiliated with or endorsed by Redsys.