VibeFox Xendit for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later.

Store currency: IDR, PHP, VND, THB, MYR, USD or SGD. For other checkout currencies the payment method is not shown. Which payment channels and currencies are really available depends on your Xendit account.

Xendit account: you need a secret API key with write permission for Money-in (invoices) for test mode and another one for live mode, and the webhook verification token of each mode (see Configuration). Only the secret keys and the verification tokens are used. No public key is needed, because the customer pays on the Xendit hosted invoice page.

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_xendit_payment_gateway-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_xendit_payment_gateway.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_xendit_payment_gateway-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of this package into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Xendit Payment Gateway and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Paste your Xendit secret keys, set the webhook URL in the Xendit Dashboard and paste the verification tokens (see Configuration).

5. Turn on Enable/Disable and click Save. Place a test order in test mode, then turn off Test Mode to take real payments.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_xendit_payment_gateway.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Xendit Payment Gateway, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key, the Xendit keys and the webhook as in steps 3 to 5 for OpenCart 3. The settings page and its fields are the same in both versions. Only the webhook URL is different (see Webhooks).

A new install starts with the payment method turned off and test mode on.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox Xendit Payment Gateway > Edit. The sections are listed on the left; the Save button under the list saves the whole page. Without the right to modify the extension the page shows the settings but cannot save them.

Above the settings a box shows the active mode: TEST MODE (invoices are created with the Test secret key; no real money is charged) or LIVE MODE (invoices are created with the Live secret key and customers are charged). The page warns you when the secret key of the active mode is missing or has the wrong prefix (the payment method is then hidden at checkout), and when the webhook verification token of the active mode is empty (Xendit notifications are then rejected, so orders are only updated when the customer returns to your store).

When you save, Title must not be empty (at most 128 characters), Sort Order must be a whole number (negative numbers are allowed), Total must be a number, 0 or greater, and the geo zone and order statuses must exist. Otherwise nothing is saved and the page names the field.

Xendit

Enable/Disable: Enable Xendit turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. It is also the payment method name stored in the order. Default: Xendit. Required, up to 128 characters.

Description: the text shown to the customer at the Confirm Order step, above the confirm button. Default: Pay with virtual accounts, e-wallets, QR codes, retail outlets or cards via Xendit.

Sort Order: the position of Xendit among the payment methods at checkout. Leave it empty or enter a whole number.

Geo Zone: offer Xendit only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones.

Total: the checkout total, in the default currency of the store, that an order must reach before Xendit is offered. Leave it empty to offer Xendit for any total.

API keys

Create a secret API key with write permission for Money-in (invoices) in Xendit Dashboard > Settings > Developers > API keys (the section links there), once in Test mode and once in Live mode. The key decides where the invoice is created. When you save, a key that does not start with the prefix of its field is not saved, and the page shows, for example, Test secret key was not saved: it must start with xnd_development_. The other settings are saved.

Test Mode: creates invoices with the Test secret key, so no real money is charged. Default: on. Turn it off to accept real payments with the Live secret key. While it is on, customers see Test mode: no real money is charged. at the Confirm Order step.

Test Secret Key: the secret key of the Xendit Test mode. It starts with xnd_development_.

Live Secret Key: the secret key of the Xendit Live mode. It starts with xnd_production_.

Saved keys and tokens are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove a saved value, tick Clear the saved value under the field and click Save.

Webhooks

The webhook tells your store that an invoice has been paid. In Xendit Dashboard > Settings > Developers > Webhooks (the section links there) set the URL shown in Webhook URL for Invoices > Invoice paid, in Test mode and in Live mode. Optionally set it for Invoice expired too. On OpenCart 3 the URL looks like https://your-store/index.php?route=extension/payment/wcp_xendit_payment_gateway/webhook, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_xendit_payment_gateway/payment/wcp_xendit_payment_gateway.webhook. It is built from the storefront address of your OpenCart installation. Copy it exactly as the settings show it. It must be reachable from the internet.

Then copy the Webhook verification token of each mode from the Xendit Dashboard into the matching field. Xendit sends it in the x-callback-token header. Notifications without the token of the mode the invoice was created in are rejected. The token only proves that the notification comes from Xendit: the invoice status, amount and currency are always read again from the Xendit API with the secret key of that mode. Without the webhook, an order is confirmed only when the customer comes back to the store after paying.

Test Webhook Verification Token: the webhook verification token of the Xendit Test mode.

Live Webhook Verification Token: the webhook verification token of the Xendit Live mode.

Payment

Invoice Description: the description shown on the Xendit invoice. You can use the placeholders {order_id} and {order_number} (both are the OpenCart order number) and {site_name} (the store name). HTML is removed and the text is cut to 255 characters. Default: Order #{order_id}.

Order Status After Payment: which status a confirmed payment sets, in one status change.

OpenCart creates the order at the Confirm Order step without a status (a missing order). The order gets a status only after Xendit has confirmed the payment through the API. Each field below lists your OpenCart order statuses.

Paid Order Status: the status after a confirmed payment with Processing. Default: Processing.

Complete Order Status: the status after a confirmed payment with Completed. Default: Complete.

On Hold (Review) Status: an invoice was paid with another amount or currency than the order (the cart was changed after the invoice was created, or a partial payment). A note explains why. Default: Pending, because OpenCart has no On hold status. You can create your own status in System > Localisation > Order Statuses and select it here.

Advanced

Debug Log: writes API requests and webhooks to xendit_p_debug.log.php in the OpenCart logs folder (storage/logs). The file cannot be opened from the web, and at 5 MB it is moved to xendit_p_debug.old.log.php. Errors and warnings are always logged, even when this is off. API keys, tokens and customer data are not logged. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete Data on Uninstall: when on, uninstalling the extension removes the gateway settings and the log. Order data (the invoice IDs of orders) is always kept. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. Secret keys and tokens are not exported.

Import: paste previously exported JSON and click Import to restore the settings. The saved secret keys and tokens are kept.

Checkout

The payment method is shown when the checkout currency is IDR, PHP, VND, THB, MYR, USD or SGD. The customer chooses it at the Payment Method step (by default Xendit). At the Confirm Order step the customer sees your description. OpenCart creates the order at this step, still without a status. When the customer clicks Confirm Order, the extension creates a Xendit invoice for the order total in the order currency and sends the customer to the Xendit invoice page. IDR and VND amounts are rounded to whole numbers, because Xendit does not accept decimals for them. The customer's e-mail is passed to Xendit. On the invoice page the customer pays with one of the payment channels activated in your Xendit account for this currency, for example a virtual account, an e-wallet, a QR code, a retail outlet or a card. On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options, and clicks Confirm Order at the bottom of the checkout page.

After paying, the customer returns to your store. The order is marked paid only after Xendit confirms it: by the webhook, or by a server-side request to the Xendit API when the customer comes back. The order then gets its status the standard OpenCart way, with the usual order e-mails and stock update, and the customer sees the OpenCart order success page. If Xendit has not confirmed the payment yet, a Payment confirmation page shows Your payment has not been confirmed by Xendit yet. Your order will be confirmed as soon as Xendit confirms it — please do not pay again. with the buttons Check again and Back to checkout. The webhook sets the order status as soon as it arrives.

If the invoice fails or expires, Xendit sends the customer back. The extension first checks the invoice (it may have been paid in another tab), then expires it, so it can no longer be paid. The customer is back at checkout with The Xendit payment was not completed. You can try again or choose another payment method. The cart is kept.

OpenCart 3 creates a new order every time the Confirm Order step is shown. OpenCart 4 keeps one order for the checkout and updates it, so after a failed or expired invoice the next Confirm Order creates a new invoice for the same order. If another order of the same cart is already paid, the customer goes straight to the success page and is not charged twice. If the order total, currency and mode are unchanged and the open invoice of this order is still valid for at least five more minutes, the customer is sent to the same invoice. Otherwise the old invoice is expired first and a new one is created, so there are never two open invoices for one cart. If the old invoice was already paid, that payment is confirmed instead of a new one.

On OpenCart 4, if the order of the checkout was closed by the store meanwhile (for example cancelled or refunded), or is already paid but the cart has changed since, including a new quantity, the customer is sent back to the checkout with Your previous order is already closed or paid. Please confirm the order again: the cart will be paid with a new order., and the next Confirm Order pays a new order. On OpenCart 4 this message, the message about the payment that was not completed and We could not match this payment to an order. If you were charged, please contact us. are shown above the checkout page.

If Xendit cannot start the payment, the customer stays at the Confirm Order step with a short message above the button, for example Xendit is temporarily unavailable. Please try again in a few minutes or choose another payment method., a message that the currency is not accepted for your account or that the order total is outside the Xendit amount limits. The technical reason is written to the log. An order with a zero total cannot be paid with Xendit.

The webhook and the return of the customer also work while the store is in maintenance mode: OpenCart 3 lets payment extension requests through, and on OpenCart 4 the extension adds a startup action for them.

The payment always happens on the Xendit page. The extension has no refunds from the admin, no saved cards, subscriptions or recurring payments, no card or e-wallet fields on the checkout page, no separate authorize and capture, and no xenPlatform sub-accounts.

Orders

Order statuses

No status (missing order): the customer was sent to Xendit and has not paid, or Xendit has not confirmed the payment yet. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders.

Paid Order Status or Complete Order Status (default Processing or Complete): the payment was confirmed. The status follows Order Status After Payment. A note shows the invoice ID, the paid amount, the payment channel and the mode.

On Hold (Review) Status (default Pending): the paid invoice did not match the order total or currency, or less than the total was paid (for example, the cart was changed after the invoice was created). The note explains it. Check the payment in the Xendit Dashboard, then fulfil the order or refund the payment. If another invoice of the same order is later paid with the right amount, the order moves to the paid status.

If an invoice is paid for an order that has another status, for example cancelled or refunded, the order status is not changed. A note asks you to refund the payment in the Xendit Dashboard or restore the order manually. If a second invoice is paid for an order that is already paid, or for another order of a cart that is already paid, the order is not changed and a note on the paid order asks you to refund the duplicate payment in the Xendit Dashboard.

Notes are entries in the order History that the customer does not see. They start with the word Xendit.

VibeFox Xendit Payment Gateway tab

In Sales > Orders open an order paid with Xendit. At the bottom of the order page, next to History and Additional, the VibeFox Xendit Payment Gateway tab shows the Xendit invoice, the Mode (with a Test label for test payments), the payment Status, the table Invoices of this order and its cart (date, order, invoice ID, external ID, mode, amount, paid amount, status, payment channel) and the Payment notes of the order. The tab is shown to users who have access to the extension.

Refunds

Refunds are not sent to Xendit from the store. Refund the payment in the Xendit Dashboard (search for the invoice ID shown in the tab) and change the order status in OpenCart afterwards. Product returns in Sales > Returns do not send money back through Xendit.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox Xendit Payment Gateway is the first block on Extensions > Extensions > Payments > VibeFox Xendit Payment Gateway > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-xendit and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain: the store address from the OpenCart configuration. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, Xendit is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

Xendit does not appear at checkout: check that the license is active, Enable/Disable is on, the active mode has a secret key with the right prefix (Test Secret Key with xnd_development_ in test mode, Live Secret Key with xnd_production_ in live mode) and the checkout currency is IDR, PHP, VND, THB, MYR, USD or SGD. The settings page shows a warning when the key is missing or wrong. Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings.

The payment went through, but the order stays without a status: the webhook is not working. In the Xendit Dashboard of the mode you use (test or live) check that the URL shown in Webhook URL is set for Invoice paid, and that the verification token of that mode is saved in the matching field. The Xendit Dashboard shows the answer of your store for each webhook. The order also gets its status when the customer returns to the store after paying.

Webhook answers Webhook verification token is not configured: neither verification token is set. Paste the token into the settings.

Webhook answers Unauthorized: the token sent by Xendit does not match any token in the settings. Copy the token of the right mode again.

Webhook answers Token does not match the mode of this invoice: the invoice was created in the other mode. A test notification never confirms a live payment and the other way round. Set up the webhook and token in the mode the order was paid in.

Webhook answers Ignored: not an invoice of this store: the invoice was not created by this store, for example by another integration on the same Xendit account. The Test button of the Xendit Dashboard also gets this answer, which confirms that the URL and the token work. Ignored: unknown order and Ignored: unknown invoice mean that the order or the invoice is not known to this store.

Webhook answers Temporary error: the Xendit API could not be reached to check the invoice, the secret key of the invoice's mode is missing, or the cart was being updated by another request at the same moment. Xendit retries the webhook. Check that both secret keys are set if payments were started in both modes, and turn on Debug Log to see the reason.

The webhook URL shows Method not allowed in the browser: this is normal. The URL accepts only requests from Xendit.

A key is not saved: the value does not start with the prefix of its field. Test keys start with xnd_development_, live keys with xnd_production_.

The customer sees This payment method is temporarily unavailable: Xendit rejected the request, for example because the secret key is wrong or lacks write permission for Money-in (invoices). Look at the Log field on the extension page. A message about the billing details means that Xendit did not accept the request data, for example the e-mail.

The customer sees A payment for this order was already received by Xendit and is being reviewed: an earlier invoice of this cart was paid, but the order could not be confirmed yet. Check the payment in the Xendit Dashboard and the log.

The customer sees We could not match this payment to an order: the return link from Xendit does not belong to an order of this store, or the invoice could not be matched to it. Check the payment in the Xendit Dashboard and the log.

Order is in the review status after payment: read the notes in the VibeFox Xendit Payment Gateway tab. The paid amount or currency differed from the order. Fulfil the order or refund the payment in the Xendit Dashboard.

For developers, the extension triggers the OpenCart events xendit_p_invoice_request, xendit_p_supported_currencies and xendit_p_currency_decimals to change the invoice request, the list of currencies and the number of decimals per currency.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox Xendit Payment Gateway. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable/Disable, Sort Order, Geo Zone, Total and the order statuses of the Payment section, which return to their defaults on a re-install. On OpenCart 4 the event of the extension and its startup action, which lets the webhook and the return of the customer through in maintenance mode, are removed too. If Delete Data on Uninstall is on, the other gateway settings (title, description, test mode, keys, tokens, invoice description, order status after payment, logging) and the log are removed. If it is off, they are kept for a later re-install. The Xendit invoice data of orders is always kept. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox Xendit Payment Gateway in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

Xendit is a trademark of its respective owner. This extension is not affiliated with or endorsed by Xendit.