VibeFox Yoco for OpenCart — Help

Requirements

OpenCart: 3.0.x (tested on 3.0.5.0) or 4.0.2 and later (tested on 4.1.0.3).

PHP: 8.0 or later.

Store currency: South African rand (ZAR) must be an enabled currency in System > Localisation > Currencies. Yoco accepts ZAR only. When the customer pays in any other currency, the payment method is hidden at checkout. The order total must be at least R2.00.

Yoco account: a Yoco account with online payments. You need its secret keys, which you find in the Yoco Business Portal under Selling Online > Payment Gateway. Only the secret keys are entered. The webhook is registered by the extension, and its signing secret is filled in for you.

Public site: Yoco sends webhooks to your store, so it must be reachable from the internet.

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The download is one zip file with the packages for both OpenCart versions. Unpack it on your computer. It contains README.txt, the OpenCart 3 package wcp_yoco_pay-oc3-(version).ocmod.zip and the OpenCart 4 package wcp_yoco_pay.ocmod.zip. Install only the package for your OpenCart version. The license key is the same for both versions.

OpenCart 3

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_yoco_pay-oc3-(version).ocmod.zip. The extension has no OCMOD modifications, so Extensions > Modifications does not need a refresh. Instead of the installer you can copy the contents of the upload folder of this package into the root folder of your store.

2. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Yoco Pay Gateway and click Install (the green + button). Your admin user needs the right to modify the payment extensions list.

3. Click Edit (the pencil button) to open the settings page. Paste your VibeFox license key into License key in the license block at the top of the page and click Activate (see License key).

4. Paste the test secret key (sk_test_...) and, when you are ready, the live secret key (sk_live_...). Click Save. The webhook is registered for each mode that has a key.

5. Turn on Enable/Disable and click Save. Make a test payment with a Yoco test card while Test mode is on, then turn off Test mode to take real payments.

OpenCart 4

1. In the admin go to Extensions > Installer, click Upload and choose the file wcp_yoco_pay.ocmod.zip. Do not rename the file: OpenCart 4 takes the extension code from the file name, and a renamed package does not work.

2. The package appears in the list of installed extensions on the same page. Click Install (the green + button) next to it.

3. Go to Extensions > Extensions and choose the type Payments. Find VibeFox Yoco Pay Gateway, click Install (the green + button), then Edit (the pencil button).

4. Enter the license key and the Yoco keys as in steps 3 to 5 for OpenCart 3. The settings page and its fields are the same in both versions. Only the webhook URL is different (see Webhook); it is registered at Yoco on save in the same way.

A new install starts with the payment method turned off and test mode on.

Configuration

All settings are on the extension page: Extensions > Extensions > Payments > VibeFox Yoco Pay Gateway > Edit. The sections are listed on the left; the Save button under the list saves the whole page. Without the right to modify the extension the page shows the settings but cannot save them.

Above the settings the page shows the active mode (Test mode: the test secret key is used, no real money is charged. or Live mode: real payments are accepted.). It warns you when the default currency of the store is not ZAR (Yoco is then offered only when the customer pays in ZAR, or not at all when no ZAR currency is enabled) and when the current mode has no secret key, for example Enter the test secret key to offer Yoco at checkout (test mode).

When you save, Title may have at most 128 characters, Sort Order must be a whole number (negative numbers are allowed), Total must be a number, 0 or greater, and the geo zone and order statuses must exist. Otherwise nothing is saved and the page names the field. Then the extension checks the keys and the webhook secrets and registers the webhooks. Messages about this appear above the settings.

Yoco

Enable/Disable: Enable Yoco turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. It is also the payment method name stored in the order. Default: Card or Instant EFT (Yoco). Up to 128 characters; when it is empty, customers see Card or Instant EFT (Yoco).

Description: the text shown to the customer at the Confirm Order step, above the confirm button. Default: You will be redirected to the secure Yoco page to pay by card or Instant EFT.

Sort Order: the position of Yoco among the payment methods at checkout. Leave it empty or enter a whole number.

Geo Zone: offer Yoco only for payment addresses in the selected geo zone. Default: All zones. Geo zones are set up in System > Localisation > Geo Zones.

Total: the checkout total, in the default currency of the store, that an order must reach before Yoco is offered. Leave it empty to offer Yoco for any total. Yoco itself always needs at least R2.00.

API keys

Copy the secret keys from the Yoco Business Portal under Selling Online > Payment Gateway (the section links there). Yoco has one API for both modes: the key decides whether a payment is a test or a real one. Test mode uses only the test key, live mode only the live key.

Test mode: uses the test secret key. No real money is charged; pay with Yoco test cards. Default: on. Turn it off to take real payments. While it is on, customers see Test mode — use a Yoco test card; no real money is charged. at the Confirm Order step.

Test secret key: the secret key of the test mode. It starts with sk_test_.

Live secret key: the secret key of the live mode. It starts with sk_live_.

A key that does not start with the expected prefix is not saved: the page shows an error, for example Yoco: the test secret key must start with sk_test_ — the previous value was kept. The other settings are saved. If Yoco reports during webhook registration that a key belongs to the other mode, the page tells you so.

Saved keys and secrets are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it. To remove a saved value, tick Clear the saved value under the field and click Save.

Webhooks

Yoco confirms payments and refunds to the URL shown in Webhook URL in this section. On OpenCart 3 it looks like https://your-store/index.php?route=extension/payment/wcp_yoco_pay/webhook, on OpenCart 4 like https://your-store/index.php?route=extension/wcp_yoco_pay/payment/wcp_yoco_pay.webhook. It is built from the storefront address of your OpenCart installation. You do not need to create the webhook in the Yoco portal. When you save the settings, the extension registers the URL with Yoco for each mode that has a secret key but no webhook secret, and stores the signing secret in the field of that mode. It registers the URL again when the secret key of that mode changes or the webhook URL changes. When the URL changes, the old registration is removed.

For each mode (Test and Live) the section shows the state of the webhook:

The extension handles these events (they are also listed in this section):

Webhooks without a valid signature are rejected. An event must be signed with the secret of the mode the payment was made in, so a test secret never confirms a live payment.

Test webhook secret: filled in automatically when the webhook is registered. Paste a secret (whsec_...) only if you registered the webhook URL yourself.

Live webhook secret: filled in automatically when the webhook is registered. Clear it and save to register the webhook again.

A webhook secret must look like whsec_ followed by base64 text. Any other value is not saved, and the previous value is kept. Clearing a webhook secret and saving registers the webhook again.

Orders

OpenCart creates the order at the Confirm Order step without a status (a missing order). The order gets a status only after Yoco has confirmed the payment through the API. Each field below lists your OpenCart order statuses.

Paid Order Status: the status after a confirmed payment. Default: Processing.

On Hold Status: a payment whose amount or currency does not match the order total puts the order in this status with a note. A later payment with the right amount pays it. Default: Pending, because OpenCart has no On hold status. You can create your own status in System > Localisation > Order Statuses and select it here.

Refunded Status: set when the refunds reach the paid amount. Default: Refunded.

Advanced

Debug log: writes Yoco requests and webhooks to yoco_p_debug.log.php in the OpenCart logs folder (storage/logs, on OpenCart 4 system/storage/logs). The file cannot be opened from the web, and at 5 MB it is moved to yoco_p_debug.old.log.php. Errors and warnings, such as failed requests to Yoco and rejected webhooks, are always logged. Keys, webhook secrets and e-mail addresses are masked. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete data: when on, uninstalling the extension removes the gateway settings, the log and the webhooks the extension registered at Yoco. Order data (Yoco checkout and payment IDs, refunds) always stays, because it is needed for refunds. Default: off.

Import / Export

Export: Download JSON saves the settings as a JSON file. Secret keys and webhook secrets are not exported.

Import: paste previously exported JSON and click Import to restore the settings. The saved secrets are kept, and no webhook is registered by an import.

Checkout

The payment method is shown when the customer pays in ZAR and the order total is at least R2.00. At the Payment Method step the customer chooses it (by default Card or Instant EFT (Yoco)). At the Confirm Order step the customer sees your description. OpenCart creates the order at this step, still without a status. On OpenCart 4 the customer picks the payment method with the Choose button of the payment method block, in the window Payment method options, and clicks Confirm Order at the bottom of the checkout page. When the customer clicks Confirm Order, the extension creates a Yoco checkout for the order total in cents and sends the customer to the Yoco payment page, where the customer pays by card or Instant EFT.

After paying, the customer returns to your store. The order is marked paid only after Yoco confirms it: the extension asks Yoco for the checkout when the customer comes back and again when the signed webhook arrives. The order then gets its status the standard OpenCart way, with the usual order e-mails and stock update, and the customer sees the OpenCart order success page with Your payment with Yoco has been received. If Yoco has not confirmed the payment yet when the customer comes back, a Payment confirmation page shows We are waiting for Yoco to confirm your payment. The order will be updated automatically — please do not pay again. with the buttons Check again and Back to checkout; the webhook sets the order status as soon as it arrives. On OpenCart 4, when the customer comes back from the Yoco page, a short intermediate page opens the return address again from your store, so the cart and the customer login are kept.

If the customer cancels on the Yoco page, the customer is back at checkout with The Yoco payment was cancelled. Your cart is saved — you can pay again or choose another payment method. If the payment fails, the message is The Yoco payment was not successful. Please try again or choose another payment method., and a note is added to the order. The cart is kept. On OpenCart 4 these messages are shown above the checkout page.

OpenCart 3 creates a new order every time the Confirm Order step is shown, OpenCart 4 updates the order of the checkout. Before a new payment the extension checks the cart: if another order of the same cart is already paid, the customer goes straight to the success page. Unpaid Yoco checkouts of the order and the cart from the last 24 hours are checked with Yoco first; if one was paid in the meantime, that payment is confirmed instead of a new one. If the open checkout of the same order is for the same amount and mode and was created less than 30 minutes ago, the customer gets the same Yoco page again. Otherwise a new Yoco checkout is created. A change of the cart, including a new quantity, counts as a new cart that needs its own payment.

OpenCart 4 keeps the order in the checkout until the success page is shown, so after a cancelled or failed payment the customer pays the same order again. If that order was closed without a payment meanwhile (for example you cancelled it), the customer is sent back to the checkout with Your previous order was cancelled without a payment. Please confirm the order again to pay with a new order., and the next Confirm Order pays a new order.

If Yoco cannot start the payment, the customer stays at the Confirm Order step with Yoco could not start the payment. Please try again in a moment or choose another payment method. above the button, and the reason is written to the log and the order notes. An order below R2.00 gets Yoco requires an order total of at least R2.00.

The webhook also works while the store is in maintenance mode, because OpenCart lets payment extension requests through. On OpenCart 4 a startup action of the extension lets the webhook and the customer return through.

Payments are charged immediately on the Yoco page. The extension has no saved cards, subscriptions or recurring payments, no on-site card form and no separate authorize and capture, and it does not work in currencies other than ZAR.

Orders and refunds

Order statuses

No status (missing order): the customer was sent to Yoco and has not paid, cancelled on the Yoco page, or Yoco has not confirmed the payment yet. In Sales > Orders such orders are shown only with the filter Order Status set to Missing Orders. On OpenCart 4.1 such an order can also have the status Voided, which OpenCart sets when the confirm step is shown again; the extension counts it as an order without a status.

Paid Order Status (default Processing): the payment was confirmed. A note shows the amount, the Yoco payment and checkout IDs, the mode and how the payment was confirmed (the customer's return, the webhook or a check before a new payment attempt).

On Hold Status (default Pending): Yoco reported a different amount or currency than the order total, for example because the cart was changed in another tab after the payment started. The note explains it, and the customer sees We received your payment and are reviewing it. We will contact you if anything else is needed. Check the payment before shipping. If the customer then pays the right amount with another attempt, the order moves to Paid Order Status.

Refunded Status (default Refunded): the refunds reached the amount paid.

If a payment arrives for an order that has another status, for example cancelled or refunded, the order is not changed. A note asks you to refund the payment in the Yoco portal or restore the order manually. The customer sees Your payment was received after the order had been cancelled. Please contact us — do not pay again.

If a second payment arrives for an order that is already paid, or for another order of a cart that is already paid, the order is not changed. A note on the paid order asks you to refund it in the Yoco portal.

Notes are entries in the order History that the customer does not see. They start with the word Yoco.

VibeFox Yoco Pay Gateway tab

In Sales > Orders open an order paid with Yoco. At the bottom of the order page, next to History and Additional, the VibeFox Yoco Pay Gateway tab shows the Checkout ID, the Payment ID, the Mode (with a Test label for test payments), the Status, the amounts Paid / refunded, the refund form, the table Yoco checkouts of this order, the Refunds history and the Yoco notes of the order. The tab is shown to users who have access to the extension.

Refunds

In the VibeFox Yoco Pay Gateway tab enter the Amount (the amount not refunded yet is filled in), optionally a Reason (optional), and click Refund via Yoco. Confirm the question Refund this amount through Yoco? This cannot be undone. Full and partial refunds are supported. You need the right to modify the extension (set in System > Users > User Groups). Refunds are made from the amount Yoco charged, so you can refund at most what the customer actually paid, even if the order was edited later. The refund is sent in the mode the payment was made in (test or live), so that mode's secret key must be set. A refund repeated after a lost answer is not paid out twice.

A successful refund is added to the refund history and the notes with the Yoco refund ID. When the refunds reach the amount paid, the order gets Refunded Status without notifying the customer and without returning products to stock; a partial refund does not change the status. If Yoco refuses the refund, the tab shows Yoco refused the refund: with the reason, and no refund is recorded. If Yoco reports the refund as pending, the tab says it is still pending. Do not repeat it: it is recorded when Yoco confirms it by webhook. Refunds are available for orders paid by a Yoco checkout. An order in On Hold Status has no paid checkout to refund; refund it in the Yoco portal.

Product returns in Sales > Returns do not send money back through Yoco.

Refunds made in the Yoco portal arrive by the refund.succeeded webhook and are recorded in the refund history and the notes. When they reach the amount paid, the order gets Refunded Status. A refund larger than the amount left to refund is not recorded, and a note asks you to check the order. A failed refund adds a note that the money was not returned to the customer.

License key

The extension works with a VibeFox license key from vibefox.net. The license block License — VibeFox Yoco Pay Gateway is the first block on Extensions > Extensions > Payments > VibeFox Yoco Pay Gateway > Edit, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: opencart-payment-yoco and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only admin users with the Modify permission for the extension can change the key. The texts of the block follow the admin language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the extension keeps working on the last known status.

One key works on one domain: the store address from the OpenCart configuration. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, Yoco is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. An admin user who is logged in to the admin in the same browser still sees the payment method in the store, marked (unlicensed — visible to admins only), so you can set up and test the extension before you buy a key. On OpenCart 4 this preview is not available: the store does not see the admin login, so without an active key the payment method is hidden for everybody. After you have opened the Edit page once, a reminder appears on the admin Dashboard. Close it with × to hide it for 7 days. Existing orders are not affected: payments already started are still confirmed, and refunds work.

When a license expires, the extension keeps working, but updates and support need a renewal. The status is checked again automatically when you open the admin Dashboard or the Edit page: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling the extension always removes the license key and license status.

Troubleshooting

Yoco does not appear at checkout: check that the license is active, Enable/Disable is on and the current mode has a secret key: Test secret key in test mode, Live secret key in live mode. The customer must pay in ZAR, and the order total must be at least R2.00. The settings page shows a warning when the key is missing or the store currency is not ZAR. Also check that the payment address is in the selected Geo Zone and that the order reaches the Total set in the settings.

The payment went through, but the order stays without a status: the webhook is not working. Open the Webhooks section of the settings and check the state of the mode you use. If it is not registered, or registered for another URL, save the settings. If the registration fails, the page shows the reason. If you entered the secret yourself, check that it belongs to the webhook of this URL and mode. The order also gets its status when the customer returns to the store after paying, and when the customer tries to pay again.

Could not register the webhook: payments are still confirmed when customers return to the store. Fix the reason shown in the message, for example the store must be reachable from the internet, and save again. You can also register the URL yourself and paste the signing secret.

Webhooks are rejected: rejected webhooks are written to the log. webhook secret not configured means neither webhook secret is set. invalid signature means the secret belongs to another registration or mode. timestamp outside the tolerance means the server clock is wrong: signatures are accepted within 5 minutes of the server time. checkout not completed yet — retry and could not confirm the checkout with Yoco — retry are temporary; Yoco sends the webhook again.

The webhook URL shows POST only in the browser: this is normal. The URL accepts only requests from Yoco.

The secret key must start with sk_test_ / sk_live_ error on save: a key was pasted into the wrong field. The test key starts with sk_test_, the live key with sk_live_. The previous value was kept.

The customer sees an error after Confirm Order: look at the Log field on the extension page. Yoco is not available at the moment. Please choose another payment method. means the current mode has no secret key.

The customer is told a payment needs to be reviewed: an attempt was paid with a different amount, or after the order was cancelled. Read the notes in the VibeFox Yoco Pay Gateway tab and fulfil the order or refund the payment in the Yoco portal.

Refund fails with a message about the mode: the payment was made in test or live mode, and the secret key of that mode is not set. Enter it and try again.

Refund fails with No answer from Yoco: nothing was recorded in OpenCart. If Yoco did process the refund, repeat the same refund: it is not refunded twice.

For developers: before the Yoco checkout is created, the extension triggers the OpenCart event yoco_p_checkout_payload with the request data and the order, so another extension can add to the request.

Uninstall

Go to Extensions > Extensions, choose the type Payments and click Uninstall (the red − button) next to VibeFox Yoco Pay Gateway. The license key and license status of this extension are always removed. OpenCart always removes its own settings of the extension: Enable/Disable, Sort Order, Geo Zone, Total and the order statuses of the Orders section, which return to their defaults on a re-install. The OpenCart event of the extension is removed too (on OpenCart 4 its events and its startup action, which lets the webhook and the customer return through in maintenance mode). If Delete data is on, the other gateway settings (title, description, test mode, keys, webhook secrets, logging), the log and the webhooks the extension registered at Yoco are removed. If it is off, they are kept for a later re-install. The Yoco checkouts and refunds are always kept, so orders paid before can still be refunded after a re-install. Existing orders keep their payment notes.

On OpenCart 4, to remove the files of the extension as well, go to Extensions > Installer after the uninstall and click Uninstall (the orange − button) next to VibeFox Yoco Pay Gateway in the list of installed extensions, then Delete (the red bin button) to remove the uploaded package.

Yoco is a trademark of its respective owner. This extension is not affiliated with or endorsed by Yoco.