VibeFox Worldline for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later.

Worldline account: a Worldline Direct (formerly Ingenico Direct) merchant account. Test and live accounts are separate and have different credentials. For each account you need the Merchant ID (your PSPID), an API Key ID with its Secret API Key, and a webhook key with its secret. All of them are created in the Worldline Merchant Portal (see Configuration).

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_worldline_gateway-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_worldline_gateway.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_worldline_gateway-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of this package into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Worldline Gateway and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Enter the test credentials, click Save and then Test credentials.

5. Add the webhook URL in the Merchant Portal of the test account and enter the webhook key and secret (see Configuration).

6. Turn on Enable/Disable, save and make a test payment. Then enter the live credentials, repeat the webhook setup in your live account, click Live credentials and turn off Test Mode.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_worldline_gateway.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Worldline Gateway, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key, the credentials and the webhook as in steps 3 to 6 for OpenCart 3. The settings page and its fields are the same in both versions. Only the webhook URL is different (see Webhooks).

A new install starts with the payment method turned off and test mode on.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox Worldline Gateway > Edit. The sections are listed on the left; the Save button under the list saves the whole page. Above the settings the page warns you when the credentials of the current mode (Merchant ID, API Key ID, Secret API Key) are incomplete, because the payment method is then hidden at checkout. While test mode is on it shows Test mode is on (pre-production environment): no real money is charged. Without the right to modify the extension the page shows the settings but cannot save them.

When you save, Title must not be empty (at most 128 characters), Sort Order must be a whole number (negative numbers are allowed), Total must be a number, 0 or greater, and the geo zone and order statuses must exist. Otherwise nothing is saved and the page names the field. Incomplete credentials do not block saving.

Worldline (Ingenico)

Enable/Disable: Enable Worldline Gateway turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. It is also the payment method name stored in the order. Default: Worldline. Required, up to 128 characters.

Description: the text shown to the customer at the Confirm Order step, above the confirm button. Default: Pay securely via Worldline.

Sort Order: the position of Worldline among the payment methods at checkout. Leave it empty or enter a whole number.

Geo Zone: offer Worldline only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones.

Total: the checkout total, in the default currency of the store, that an order must reach before Worldline is offered. Leave it empty to offer Worldline for any total.

Worldline Direct API

Get the credentials in the Worldline Merchant Portal of the test account and of the live account. Your PSPID is the Merchant ID. Developer > Payment API creates the API Key ID and the Secret API Key, Developer > Webhooks the webhook key and secret. The section has links to both portals and to the Worldline documentation.

Test Mode: switches both the API endpoint and the credentials. Test mode uses the pre-production environment and the test credentials, live mode the production environment and the live credentials. Default: on. Turn it off to take real payments. While test mode is on, customers see Test mode — no real money is charged. at the Confirm Order step.

Test account (pre-production)

Test Merchant ID (PSPID): the PSPID of your test account.

Test API Key ID: the API Key ID created in Developer > Payment API of the test account.

Test Secret API Key: the Secret API Key that belongs to that API Key ID.

Test Webhook Key ID: optional. When set, only webhooks sent with this key are accepted.

Test Webhook Secret: the webhook secret of the test account. It is used to check the signature of every webhook.

Live account (production)

Live Merchant ID (PSPID): the PSPID of your live account.

Live API Key ID: the API Key ID created in Developer > Payment API of the live account.

Live Secret API Key: the Secret API Key that belongs to that API Key ID.

Live Webhook Key ID: optional. When set, only webhooks sent with this key are accepted.

Live Webhook Secret: the webhook secret of the live account.

Saved secret keys and webhook secrets are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove a saved value, tick Clear the saved value under the field and click Save.

Check credentials: the buttons Test credentials and Live credentials check the saved credentials of each account with a test call to Worldline. Save your changes first. The answer appears under the buttons, for example Test credentials: connection successful., API credentials are not configured. or the error returned by Worldline.

Webhooks

The webhook tells your store about payments even when the customer does not come back to the store, for example after closing the browser or when a payment is confirmed later. In the Merchant Portal open Developer > Webhooks of the test account and add the URL shown in Endpoint URL in this section. On OpenCart 3 it looks like https://your-store/index.php?route=extension/payment/wcp_worldline_gateway/webhook, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_worldline_gateway/payment/wcp_worldline_gateway.webhook. It is built from the storefront address of your OpenCart installation. Copy the URL exactly as the settings show it: it must answer without redirects and be reachable from the internet. Then enter the webhook key ID and secret in Test Webhook Key ID and Test Webhook Secret. Do the same in the live account with the live fields.

The extension answers the endpoint verification request of Worldline automatically. It handles payment events (payment status changes) and refund events (refund status changes). Other events are accepted and ignored. Webhooks without a valid signature are rejected. An event must be signed with the secret of the account the payment was made in, so a test webhook never confirms a live payment. A webhook is also ignored when it comes from another Merchant ID than the one of the account whose secret signed it. Without the webhook, an order is confirmed only when the customer comes back to the store after paying.

Payment page and orders

Payment page template: optional name of a hosted checkout template (variant) uploaded in the Merchant Portal, for example SimplifiedCustomPaymentPage. Leave it empty for the default Worldline page.

Order Status After Payment: which status a captured payment sets. Payments are always requested as a direct sale (authorization and capture).

OpenCart creates the order at the Confirm Order step without a status (a missing order). The order gets a status only after Worldline has confirmed the payment. Each field below lists your OpenCart order statuses.

Paid Order Status: the status after a captured payment with Payment accepted (processing). Default: Processing.

Complete Order Status: the status after a captured payment with Delivered (completed). Default: Complete.

Awaiting Capture Status: the payment is authorized or the capture was requested; the capture webhook marks the order paid. Default: Pending.

On Hold (Review) Status: the paid amount or currency does not match the order. A note explains why. Default: Pending, because OpenCart has no On hold status. You can create your own statuses in System > Localisation > Order Statuses and select them here.

Payment Error Status: Worldline rejected or cancelled the payment of an order that was waiting for the capture. Default: Failed.

Refunded Status: the payment was fully refunded from the order page. Default: Refunded.

Advanced

Logging: writes all API requests and webhooks to wlg_debug.log.php in the OpenCart logs folder (storage/logs). The file cannot be opened from the web, and at 5 MB it is moved to wlg_debug.old.log.php. Errors and warnings are always logged, also when this is off. Keys, card data and personal data are masked. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete Data: when on, uninstalling the extension removes the gateway settings and the log. The Worldline transactions and refunds always stay, because existing orders need them for refunds. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. Secret keys and webhook secrets are not exported.

Import: paste previously exported JSON and click Import to restore the settings. The saved secrets are kept.

Checkout

At the Payment Method step the customer chooses the payment method (by default Worldline). At the Confirm Order step the customer sees your description. OpenCart creates the order at this step, still without a status. When the customer clicks Confirm Order, the extension creates a Worldline hosted checkout for the order total in the order currency and sends the customer to the Worldline payment page. There the customer pays with a card, a wallet or another payment method enabled in your Worldline account. The billing name, address, e-mail and phone are passed to Worldline, and the payment page opens in the customer's language when Worldline supports it. Each payment attempt gets its own reference made of the order number and a random part. On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options, and clicks Confirm Order at the bottom of the checkout page.

After paying, the customer returns to your store. The extension checks the return against the stored attempt and reads the payment status from Worldline on the server. The order is marked paid only after Worldline confirms it: by this status check or by a signed webhook. The order then gets its status the standard OpenCart way, with the usual order e-mails and stock update, and the customer sees the OpenCart order success page with Your payment with Worldline has been received. If the payment is authorized but not captured yet, the page shows Your payment is authorized. The order is confirmed as soon as Worldline confirms the capture. If the payment of such an order fails, the page shows Your Worldline payment was not completed. Please contact us about this order.

If the payment was not completed, the order keeps no status, the cart is kept and the customer is back at checkout with a message:

If the status could not be checked yet, a Payment confirmation page shows We could not confirm your payment yet. If you completed the payment, please do not pay again — you will receive a confirmation as soon as Worldline confirms it. with the buttons Check again and Back to checkout. The webhook sets the order status as soon as it arrives.

On OpenCart 4 these messages are shown above the checkout page.

OpenCart 3 creates a new order every time the Confirm Order step is shown. OpenCart 4 keeps one order for the checkout and updates it, so after a cancel or a decline the customer pays the same order on a new Worldline payment page. Before a new payment the extension checks the cart: if another order of the same cart is already paid, or the previous attempt has been paid in the meantime, the customer goes straight to the success page and is not charged twice. If the previous payment page of the same order is still open for the same amount and mode and was created less than 30 minutes ago, the customer is sent back to it.

On OpenCart 4, if the payment of the order of the checkout was rejected or cancelled after the authorization, the next Confirm Order sends the customer back to the checkout with the message about the declined payment instead of the success page. If the store closed that order (for example cancelled or refunded it), the message is Your previous order was closed by the shop (cancelled / refunded). Please confirm the order again to pay with a new order. In both cases the next Confirm Order pays a new order. If the order of the checkout is already paid but the cart has changed since, including a new quantity, the customer is sent back to the checkout and the new cart is paid with a new order.

If Worldline cannot start the payment, the customer stays at the Confirm Order step with Payment error: Could not create checkout session. Please try again. above the button. The reason is written to the log. If the credentials of the current mode are missing, the customer sees This payment method is not available at the moment. Please choose another payment method.

The webhook and the return of the customer also work while the store is in maintenance mode: OpenCart 3 lets payment extension requests through, and on OpenCart 4 the extension adds a startup action for them.

The extension takes one-time payments as a direct sale on the Worldline page. It has no saved cards or tokenization, no subscriptions, no embedded card form, no authorize-only mode with capture or cancel from OpenCart, no surcharging and no automatic webhook registration.

Orders and refunds

Order statuses

No status (missing order): the customer was sent to Worldline and has not paid, or Worldline has not confirmed the payment yet. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders.

Paid Order Status or Complete Order Status (default Processing or Complete): the payment was captured. The status follows Order Status After Payment. A note shows the amount, the Worldline payment ID and how it was confirmed (signed webhook or status check).

Awaiting Capture Status (default Pending): Worldline reports the payment as authorized or the capture as requested, but not yet captured. The order moves to the paid status when the webhook confirms the capture. If the note says the payment is not captured, capture it in the Worldline Merchant Portal.

On Hold (Review) Status (default Pending): the payment does not match the order, for example the amount or currency differ or the payment belongs to another attempt. The note shows the paid amount, the order total and the reference. Check the order and fulfil it or refund the payment.

Payment Error Status (default Failed): Worldline rejected or cancelled the payment of an order that was waiting for the capture.

Refunded Status (default Refunded): the payment was fully refunded through the extension.

If a payment arrives for a cancelled or refunded order, the order is not reopened. A note asks you to refund or cancel the payment in the Worldline Merchant Portal or to restore the order manually. The returning customer sees Your payment was received after this order had been cancelled. Please contact us — we will restore the order or refund the payment. If a second payment arrives for an order that is already paid, or for another order of a cart that is already paid, the order is not changed. A note on the paid order asks you to refund the second payment in the Worldline Merchant Portal.

Notes are entries in the order History that the customer does not see. They start with the word Worldline.

VibeFox Worldline Gateway tab

In Sales > Orders open an order paid with Worldline. At the bottom of the order page, next to History and Additional, the VibeFox Worldline Gateway tab shows the Worldline payment block: the Payment ID, the Merchant reference, the Hosted checkout, the attempt Status, the Amount charged / refunded, a Test environment label for test payments, the refund form, the refund history and the Payment notes of the order. The tab is shown to users who have access to the extension.

Refunds

In the VibeFox Worldline Gateway tab enter the amount (the amount not refunded yet is filled in), optionally a Reason (optional), and click Refund via Worldline. Confirm the question Refund this amount through Worldline? This cannot be undone. Full and partial refunds are supported. The payment must be captured. You need the right to modify the extension (set in System > Users > User Groups). Refunds are made in the amount and currency Worldline charged, so after an amount or currency mismatch you can refund up to what the customer actually paid, not the order total. The refund is always sent to the environment of the original payment (test or live) with that account's credentials, so they must be set. A refund retried after a timeout is not executed twice, and only one refund of an order runs at a time. If Worldline refuses the refund, the tab shows the error and no refund is recorded. An accepted refund is added to the refund history and the notes with the Worldline refund ID and status. A full refund sets the order to Refunded Status without notifying the customer and without returning products to stock, like a manual status change. A partial refund does not change the status.

Product returns in Sales > Returns do not send money back through Worldline.

Refund status changes from Worldline arrive by webhook, update the refund history and are added to the notes. Refunds made in the Merchant Portal do not change the order status. Update it manually if needed.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox Worldline Gateway is the first block on Extensions > Extensions > Payments > VibeFox Worldline Gateway > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-worldline and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain: the store address from the OpenCart configuration. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, Worldline is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed, and refunds work.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

Worldline does not appear at checkout: check that the license is active, Enable/Disable is on and the current mode has a Merchant ID, an API Key ID and a Secret API Key: the test fields in test mode, the live fields in live mode. The settings page shows a warning when they are missing. Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings.

The payment went through, but the order stays without a status: the webhook is not working. In the Merchant Portal of the account you use (test or live) check that the endpoint exists and that its URL is exactly the one shown in Endpoint URL, without redirects. Check that the webhook secret of that account is in the matching field (Test Webhook Secret or Live Webhook Secret) and that the webhook key ID field is empty or matches the key. The order also gets its status when the customer returns to the store after paying.

Webhook answers Webhook secret not configured: neither webhook secret is set. Enter the webhook secret in the settings. Worldline retries the webhook.

Webhook answers Invalid signature: the webhook secret belongs to another account or another key, or the webhook key ID does not match the key that sent the webhook. Check that the test and live secrets are not swapped.

Webhook answers Missing signature, Empty body or Invalid JSON: the request did not come from Worldline in the expected form, or a proxy or redirect changed it. Check that the URL answers without redirects.

Webhook answers Ignored: the webhook came from another Merchant ID than the one in the settings of that mode. Check Test Merchant ID (PSPID) or Live Merchant ID (PSPID).

Webhook answers Retry later: the order was being confirmed by another request at the same moment, or the order status could not be set. Worldline retries the webhook. Look at the Log field for the reason.

The webhook URL shows Method not allowed in the browser: this is normal. The URL accepts only requests from Worldline.

Test credentials or Live credentials shows an error: save the settings first, then check that the Merchant ID, API Key ID and Secret API Key come from the same account and that the test values are in the test fields and the live values in the live fields.

The customer sees an error after Confirm Order: look at the Log field on the extension page. Errors are logged even when Logging is off. For full details of the requests, turn on Logging and try again.

Test payments do not confirm a live payment: test and live are kept apart. Switch Test Mode to the mode you want and use that account's credentials and webhook.

Order is in the review or awaiting capture status after payment: read the notes in the VibeFox Worldline Gateway tab (see Order statuses). Either Worldline has not confirmed the capture yet (the webhook completes the order), or the paid amount or currency differed from the order.

No refund form in the tab: the tab says why: no captured Worldline payment, the payment is fully refunded, your user group has no right to modify the extension, or the credentials of the payment's environment are not set.

Refund fails with a message about the environment: the payment was made in the test or live environment, and the credentials of that environment are not set. Enter them and try again.

For developers: before the hosted checkout is created, the extension triggers the OpenCart event wlg_hosted_checkout_data with the request data and the order, for example to limit the payment methods shown.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox Worldline Gateway. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable/Disable, Sort Order, Geo Zone, Total and the order statuses of the Payment page and orders section, which return to their defaults on a re-install. The OpenCart event of the extension is removed too (on OpenCart 4 its events and its startup action, which lets the webhook and the return of the customer through in maintenance mode). If Delete Data is on, the other gateway settings (title, description, test mode, credentials, webhook secrets, page template, logging) and the log are removed. If it is off, they are kept for a later re-install. The Worldline transactions and refunds are always kept, so orders paid before can still be refunded after a re-install. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox Worldline Gateway in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

Worldline is a trademark of its respective owner. This extension is not affiliated with or endorsed by Worldline.