VibeFox Wompi for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later.

Currency: Colombian peso (COP). Wompi Colombia charges COP. Add COP in System > Localisation > Currencies if your store does not have it yet; the payment method is offered only when the customer checks out in COP. The settings page warns you when the default currency of the store is not COP.

Wompi account: a Wompi Colombia merchant account. Each environment (sandbox and production) has four keys: public key, private key, events secret and integrity secret. You find them in the Wompi merchant dashboard (comercios.wompi.co) in the developers section. Wompi El Salvador and Panama use different APIs and are not supported.

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_wompi_payment-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_wompi_payment.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_wompi_payment-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of this package into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Wompi Payment and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Paste the sandbox and production keys from the Wompi merchant dashboard and set the Events URL in Wompi (see Configuration).

5. Turn on Enable/Disable and click Save. Test a payment in sandbox mode, then turn off Sandbox mode to accept real payments.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_wompi_payment.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Wompi Payment, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key, the Wompi keys and the Events URL as in steps 3 to 5 for OpenCart 3. The settings page and its fields are the same in both versions. Only the Events URL is different (see Events URL).

A new install starts with the payment method turned off and sandbox mode on.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox Wompi Payment > Edit. The sections are listed on the left; the Save button under the list saves the whole page. Above the settings a status box shows the current mode, SANDBOX or PRODUCTION. When a key of this mode is missing, the box lists it and says that the payment method is hidden at checkout until all keys of this environment are set. When all keys are set, it says whether real payments are charged. When you save, the extension warns you if a key does not start with the prefix of its section, and if Wompi is enabled but hidden at checkout because keys are missing. Title must be at most 128 characters long (Title must be at most 128 characters.), Sort Order must be a whole number (Sort Order must be a whole number.), Total must be a number, 0 or greater (Total: enter a number, 0 or greater.), and the selected geo zone and order statuses must exist; otherwise nothing is saved and the page shows the error. Without the right to modify the extension the page shows the settings but cannot save them.

Wompi

Enable/Disable: Enable Wompi turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. It is also the payment method name stored in the order. Default: Wompi. At most 128 characters. If you leave it empty, the extension name is used.

Description: the text shown to the customer at the Confirm Order step, above the confirm button. Default: Pay securely with Wompi: cards, PSE, Nequi, Bancolombia and more.

Sort Order: the position of Wompi among the payment methods at checkout. Leave it empty or enter a whole number; negative numbers are allowed.

Geo Zone: offer Wompi only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones. On OpenCart 4, when the checkout has no payment address, the shipping address is checked.

Total: the checkout total, in the default currency of the store, that an order must reach before Wompi is offered: a number, 0 or greater. Leave it empty to offer it for any total. Wompi itself needs at least COP 1,500.

Wompi account

Copy the keys from the Wompi merchant dashboard (comercios.wompi.co), developers section. Each environment has its own public key, private key, events secret and integrity secret.

Sandbox mode: uses the Wompi sandbox (sandbox keys, no real money). It switches both the keys and the Wompi API (sandbox.wompi.co or production.wompi.co). Payment attempts keep the environment they were made in. Default: on. Turn it off to accept real payments. While it is on, customers see Sandbox mode: no real payment is made. at the Confirm Order step.

Sandbox keys

The four keys of the Wompi sandbox. They start with pub_test_, prv_test_, test_events_ and test_integrity_.

Public key: the sandbox public key (pub_test_...). It identifies your account on the Wompi Web Checkout.

Private key: the sandbox private key (prv_test_...). It is used to read transactions from the Wompi API.

Events secret: the sandbox events secret (test_events_...). It verifies the signature of Wompi events.

Integrity secret: the sandbox integrity secret (test_integrity_...). It signs the payment request sent to the Web Checkout.

Production keys

The four keys of the Wompi production environment. They start with pub_prod_, prv_prod_, prod_events_ and prod_integrity_.

Public key: the production public key (pub_prod_...).

Private key: the production private key (prv_prod_...).

Events secret: the production events secret (prod_events_...).

Integrity secret: the production integrity secret (prod_integrity_...).

Public keys are shown in their fields. Saved private keys and secrets are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove a saved value, tick Clear saved secret on save under the field and click Save.

Events URL (webhook)

Wompi events tell your store that a transaction has changed. In the Wompi merchant dashboard, developers section, set the Events URL shown in this section, for the sandbox and for production. It is built from the storefront address of your OpenCart installation. On OpenCart 3 it looks like https://your-store/index.php?route=extension/payment/wcp_wompi_payment/webhook, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_wompi_payment/payment/wcp_wompi_payment.webhook. Copy the URL exactly as the settings show it.

The extension uses this event:

Other events are answered with Ignored. Each event is checked with the events secret of its environment (sandbox or production). Webhooks without a valid signature are rejected. After the check, the transaction is read from the Wompi API with the private key of that environment, and only that data is used. Without the Events URL, an order gets its status only when the customer comes back to the store after paying.

Orders

OpenCart creates the order at the Confirm Order step without a status (a missing order). It gets a status only when Wompi reports the transaction. Each field below lists your OpenCart order statuses.

Order Status After Payment: an APPROVED transaction with the expected amount in COP. Default: Processing.

Awaiting Payment Status: a PENDING transaction, for example PSE, Nequi or a cash payment waiting for confirmation. The order gets Order Status After Payment when Wompi approves it. Default: Pending.

On Hold (Review) Status: Wompi approved a different amount or currency than the order total, or approved the payment after the order had been cancelled. A note explains it; the order is not marked paid. Default: Pending, because OpenCart has no On hold status. You can create your own statuses in System > Localisation > Order Statuses and select them here.

Failed Payment Status: a pending transaction of the latest payment attempt was declined or ended with an error. Default: Failed.

Cancelled Order Status: a pending transaction of the latest payment attempt was voided in Wompi. A payment approved for an order in this status puts it on hold instead of marking it paid. Default: Canceled.

Advanced

Debug log: writes payment and webhook activity to wompi_p_debug.log.php in the OpenCart logs folder (storage/logs, on OpenCart 4 system/storage/logs). The file cannot be opened from the web. Errors and warnings are always logged, even when this option is off. Keys, secrets and customer data are never logged. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete data on uninstall: when on, uninstalling the extension removes the extension settings and the log. Orders and the Wompi payment attempts are always kept. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. Private keys and secrets are not exported.

Import: paste previously exported JSON and click Import to restore the settings. The saved private keys and secrets are kept.

Checkout

At the Payment Method step the customer chooses the payment method (by default Wompi). At the Confirm Order step the customer sees your description. OpenCart creates the order at this step, still without a status. When the customer clicks Confirm Order, the extension creates a payment attempt with its own reference (OC-, the order number and a time stamp), signs it with the integrity secret and sends the customer to the Wompi Web Checkout with the order total in COP. The customer's e-mail and the name of the payment address are passed to Wompi. On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options, and clicks Confirm Order at the bottom of the checkout page. When the checkout has no payment address, the name is taken from the order or the shipping address.

On the Wompi page the customer pays with any payment method enabled in your Wompi account. Then Wompi sends the customer back to your store. The order is marked paid only after Wompi confirms it: by a signed event or by a server-side request to the Wompi API when the customer comes back. The transaction number in the return address itself is not trusted, and only transactions created for that order in the environment of its attempt are accepted. On page reloads, the transaction is checked again at most once every 20 seconds.

When the transaction is approved, the order gets its status the standard OpenCart way, with the usual order e-mails and stock update, and the customer sees the OpenCart order success page. For a pending payment (for example PSE, Nequi or a cash payment) the page shows Your Wompi payment is pending confirmation (for example PSE, Nequi or a cash payment). We will process the order as soon as Wompi confirms the payment. For an order on hold it shows We have received your Wompi payment and are reviewing it. We will contact you if anything is needed. If a pending payment is later declined, the page shows Your Wompi payment was not approved. Please contact us. If it is voided, the page shows Your Wompi payment was voided and this order was cancelled. Please contact us.

If Wompi has not confirmed the transaction yet when the customer comes back, a page shows We are waiting for Wompi to confirm your payment. You will receive an e-mail as soon as it is confirmed. with the buttons Check again and Back to checkout. The Wompi event sets the order status as soon as it arrives.

If the payment is declined, the order stays without a status and the cart is kept. The customer is back at checkout with Your Wompi payment was not approved (...). You can try again or choose another payment method., with the reason given by Wompi. A voided payment gives Your Wompi payment was voided. You can try again or choose another payment method. If the customer leaves the Web Checkout without paying, the message is Your Wompi payment was not completed. You can try again or choose another payment method. Each new attempt gets a new reference. OpenCart creates a new order every time the Confirm Order step is shown, but one cart is paid only once: once an order of the cart is paid, awaiting its payment or on hold, the customer is taken to the success page instead of paying again.

On OpenCart 4 these messages are shown above the checkout page. OpenCart 4 keeps one order for the checkout and updates it each time the Confirm Order step is shown: after a declined or unfinished payment the customer pays the same order with a new attempt. If that order was closed without a payment meanwhile (for example its pending PSE or Nequi payment was declined or voided later, or you cancelled it), or the cart was changed after a payment had started, the order leaves the checkout and the customer sees Your previous order is already closed or paid. Please confirm the order again: the cart will be paid with a new order. The next Confirm Order pays the cart with a new order.

The payment method is shown only when the license is active, all four keys of the current mode are set, the customer checks out in COP and the total is at least COP 1,500. If the payment cannot start, the customer stays at the Confirm Order step with a short message above the button:

The Events URL also works while the store is in maintenance mode, because OpenCart lets payment extension requests through. On OpenCart 4 the startup action of the extension lets the Events URL and the return of the customer through.

The extension does not refund from OpenCart. It has no saved cards, no subscriptions and no card fields on your site: all payment data is entered on Wompi.

Orders

Order statuses

No status (missing order): the customer was sent to Wompi and has not paid, the payment was declined, or Wompi has not reported the transaction yet. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders.

Awaiting Payment Status (default Pending): Wompi reports the transaction as pending, for example PSE, Nequi or cash payments waiting for confirmation. The order waits until Wompi approves or declines it. When it is approved, the order moves to Order Status After Payment.

Order Status After Payment (default Processing): the transaction was approved for the order amount in COP. A note shows the transaction, the payment method type (for example CARD, PSE or NEQUI), the reference, the amount and the environment.

On Hold (Review) Status (default Pending): Wompi approved a different amount or currency than the order total (for example, the cart was changed after the payment started), or the payment was approved after the order had been cancelled. The order is not marked paid. The note explains it. Check the payment in the Wompi dashboard and fulfil the order or refund the payment.

Failed Payment Status (default Failed): a pending transaction of the latest payment attempt was declined or ended with an error. The Wompi message is added to the note. Results of older attempts do not change the order.

Cancelled Order Status (default Canceled): a pending transaction of the latest payment attempt was voided in Wompi.

When an order that already has a status changes (for example from awaiting to paid or failed), OpenCart notifies the customer. If a second approved payment arrives for an order that is already paid, or for another order of a cart that is already paid, the order is not changed. A note asks you to refund the duplicate in the Wompi dashboard. If the paying transaction is voided in Wompi, a note asks you to review the order. Repeated events and returns never duplicate notes or payments.

Notes are entries in the order History that the customer does not see.

VibeFox Wompi Payment tab

In Sales > Orders open an order paid with Wompi. At the bottom of the order page, next to History and Additional, the VibeFox Wompi Payment tab shows the Reference, the Transaction ID, the Status (with the Wompi status), the Requested amount, the Transaction amount, the Payment method, the Wompi message, a SANDBOX label for sandbox payments, the Payment attempts of the cart when there were several, and the Wompi notes of the order. The tab is shown to users who have access to the extension.

Refunds

Refunds are not sent from OpenCart. Refund or void the payment in the Wompi merchant dashboard, then record the refund in OpenCart manually. A void of the paying transaction made in Wompi is added to the order as a note. Product returns in Sales > Returns do not send money back through Wompi.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox Wompi Payment is the first block on Extensions > Extensions > Payments > VibeFox Wompi Payment > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-wompi and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain: the store address from the OpenCart configuration. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, Wompi is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed by Wompi events and when the customer returns.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

Wompi does not appear at checkout: check that the license is active, Enable/Disable is on and all four keys of the current mode are set (the status box on the settings page lists missing keys). Check also that the customer checks out in COP and that the total is at least COP 1,500. Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings.

The payment went through, but the order stays without a status: the Events URL is not working. In the Wompi dashboard check that the Events URL is set for the environment you use (sandbox or production) and that it is exactly the one shown in the settings. Check that the events secret of that environment is in the matching section. The order also gets its status when the customer returns to the store after paying.

Events URL answers Not configured: the events secret of the event's environment is empty. Paste it into the settings.

Events URL answers Invalid signature: the events secret belongs to another environment or another account. Copy it again from the Wompi dashboard.

Events URL answers Transaction lookup failed: the Wompi API did not return the transaction, for example because of a wrong private key or a network problem. Wompi sends the event again later.

Events URL answers Retry: the order was being confirmed by another request at the same moment, or the order status could not be set. Wompi sends the event again later. Look at the Log field for the reason.

Events URL answers Environment mismatch: a sandbox transaction came for a production payment attempt or the other way round. Sandbox payments never confirm production orders.

Events URL answers Unknown reference: the transaction reference looks like a reference of this store, but it was never issued here, for example by another OpenCart store on the same Wompi account. References of other systems are answered with Ignored: not an OpenCart reference.

The Events URL shows Method not allowed in the browser: this is normal. The URL accepts only requests from Wompi.

The key does not start with ... warning on save: a key was pasted into the wrong section. Sandbox keys start with pub_test_, prv_test_, test_events_ and test_integrity_, production keys with pub_prod_, prv_prod_, prod_events_ and prod_integrity_.

Order is in the review status: read the notes in the VibeFox Wompi Payment tab (see Order statuses), then fulfil the order or refund the payment in the Wompi dashboard.

Other errors: look at the Log field on the extension page and at the Wompi notes of the order. Errors are always logged. Turn on Debug log for more detail.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox Wompi Payment. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable/Disable, Sort Order, Geo Zone, Total and the order statuses of the Orders section, which return to their defaults on a re-install. The OpenCart event of the extension is removed too (on OpenCart 4 its events and its startup action, which lets the Events URL through in maintenance mode). If Delete data on uninstall is on, the other settings (title, description, sandbox mode, keys, logging) and the log are removed. If it is off, they are kept for a later re-install. The Wompi payment attempts are always kept, so a late event of an old payment is still recognised after a re-install. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox Wompi Payment in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

Wompi is a trademark of its respective owner. This extension is not affiliated with or endorsed by Wompi.