VibeFox Authorize.Net for PrestaShop — Help

Requirements

PrestaShop: 8.0 to 9.x.

PHP: 8.0 or later. The module refuses to install on older PHP versions.

HTTPS: your checkout must use HTTPS. Accept.js refuses to run on plain HTTP pages.

Authorize.Net account: you need the API Login ID, Transaction Key and Public Client Key of your Authorize.Net account, and a Signature Key if you use webhooks. Production (account.authorize.net) and sandbox (sandbox.authorize.net) accounts have different credentials. Authorize.Net accounts are available to merchants in the US, Canada, the UK, Europe, Australia and New Zealand.

Currency: the cart currency must be USD, CAD, CHF, DKK, EUR, GBP, NOK, PLN, SEK, AUD or NZD, and your Authorize.Net account must settle in it. For other currencies the payment method is hidden at checkout.

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

1. In the back office go to Modules > Module Manager and click Upload a module. Choose the module ZIP file.

2. When the upload finishes, click Configure, or find VibeFox Authorize.Net Gateway in the module list later and click Configure.

3. Paste your VibeFox license key into License key in the license block at the top of the Configure page and click Activate (see License key).

4. Enter the credentials of the sandbox and production accounts (see Configuration). Optionally set up the webhook.

5. Turn on Enable/Disable, choose the Transaction type and click Save. Test a payment in sandbox mode with the card 4111 1111 1111 1111, any future expiry date and any CVV, then turn off Sandbox mode.

On install the module creates two order statuses, Authorize.Net payment authorized and Authorize.Net payment on hold. PrestaShop offers a new payment module for all currencies, countries and customer groups. You can limit them in Payment > Preferences.

Configuration

All settings are on the module page: Modules > Module Manager > VibeFox Authorize.Net Gateway > Configure. Each section has its own Save button, which saves the whole page. Above the fields the page warns you when SSL is not enabled for the shop (Accept.js works only on HTTPS pages), when the default shop currency is not supported by Authorize.Net, when the current mode has no API Login ID, Transaction Key or Public Client Key (the payment method is then hidden at checkout) and when the current mode has no Signature Key (webhooks are then disabled). While sandbox mode is on, it shows Sandbox mode is on: test transactions, no real charges.

Authorize.Net

Enable/Disable: Enable Authorize.Net turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. It is also the payment method name stored in the order. Default: Credit Card. Required.

Description: the text shown under the payment method at checkout. Default: Pay securely with your credit card via Authorize.Net.

API credentials

In the Authorize.Net Merchant Interface open Account > Settings > Security Settings. Under API Credentials & Keys copy the API Login ID and create a Transaction Key and a Signature Key. Under Manage Public Client Key copy the Public Client Key. Sandbox and production use different credentials. The page shows the fields of both modes, so you can keep both sets.

Sandbox mode: uses the Authorize.Net sandbox (test transactions, no real charges). It switches the API endpoint, Accept.js and the set of credentials used for new payments. Default: on. Turn it off to take real payments. While it is on, customers see a hint with the test card 4111 1111 1111 1111 under the payment method.

Sandbox API Login ID and Live API Login ID: the API Login ID of the sandbox or production account.

Sandbox Transaction Key and Live Transaction Key: the Transaction Key of that account.

Sandbox Public Client Key and Live Public Client Key: the public key used by Accept.js in the browser.

Sandbox Signature Key and Live Signature Key: needed only for webhooks. It verifies the X-ANET-Signature header of each notification.

Saved Transaction Keys and Signature Keys are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it.

Clear saved secrets: tick a key and click Save to remove it. An empty field keeps the saved value.

Payment

Transaction type: how the card is charged. An authorization expires after 30 days.

Webhooks (recommended)

Without webhooks, orders held by the Fraud Detection Suite or captured or voided in the Authorize.Net panel must be updated by hand. In the Merchant Interface go to Account > Settings > Business Settings > Webhooks and click Add Endpoint, in the sandbox and in the production account. Use the URL shown in Endpoint URL in this section. With friendly URLs it looks like https://your-shop/module/wcp_authorizenet_gateway/webhook, possibly with a language code such as /en/. Copy the URL exactly as the settings show it. Select these events (they are also listed in this section):

Enter the Signature Key of each account in Sandbox Signature Key or Live Signature Key. Webhooks without a valid signature are rejected. A notification must be signed with the key of the mode the payment was made in; a notification of the other mode changes nothing. For each notification the module also asks Authorize.Net for the current status and amount of the transaction before the order changes, so repeated notifications change nothing.

Advanced

Debug log: writes API requests and responses to logs/wc_ang_debug.log.php in the module folder. The file cannot be opened from the web. Keys, card tokens and personal data are masked. Default: off. Errors, such as declined or failed payments, API errors and failed refunds, are always logged, even when this is off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete data on uninstall: when on, uninstalling the module removes the settings and the log. The Authorize.Net transactions, refunds and the module's order statuses always stay, so orders paid before can still be captured and refunded after a re-install. Default: off.

Checkout

At the payment step the customer chooses the payment method (by default Credit Card) and enters the card number, expiry date (MM/YY) and card code (CVV) in the form under it. Accept.js is loaded only on the checkout page. When the customer places the order, Accept.js exchanges the card data for a one-time token in the browser. The card fields have no form names, so the card number and CVV are never sent to your server.

The module charges the token through the Authorize.Net API for the cart total in the cart currency. The billing address, e-mail and IP address are sent with the transaction for address verification and fraud filters. The cart number is sent as the invoice number, because no order exists before the payment. The order is marked paid only after Authorize.Net confirms it: if the transaction is approved, the order is created at once and the customer sees the standard order confirmation page with Your card payment has been received. With Authorize only the page shows Your card payment has been authorized. The amount will be charged when your order is processed. If the Fraud Detection Suite holds the transaction, it shows Your payment is being reviewed. We will update your order as soon as the review is complete.

If the card is declined, the customer stays at the payment step and sees Payment failed: followed by the reason, for example a declined card, a wrong card code or an expired card. No order is created and the cart is kept. Configuration and API errors are not shown to customers: they see a general message, and the details go to the log. If the shop cannot reach Authorize.Net, the customer sees Payment error: unable to connect to the payment gateway. Please try again. If the card fields are empty, the form asks Please enter the card number, expiry date and card code.

A double click, a second tab or a repeated submit never charges a cart twice. A second attempt while the first one is still running shows Your payment is already being processed. Please wait a moment and check your order history before trying again. If a payment was approved but the order could not be created, the customer sees Your payment was received, but the order could not be completed automatically. Please contact us — do not pay again. The order is then created from the approved payment on the next attempt or by the webhook, without charging the card again.

If the cart changes while the payment is running, the amount charged no longer matches the cart. The order then goes to Authorize.Net payment on hold with a note, and the payment is recorded for the amount actually charged.

The webhook works while the shop is in maintenance mode and is not blocked by the country restriction of your shop.

The module has no saved cards or customer profiles, no subscriptions or recurring payments, no eCheck/ACH, Apple Pay, Google Pay, PayPal or 3-D Secure, no partial capture of an authorization and no automatic currency conversion.

Orders and refunds

Order statuses

No order: the card was declined or the payment failed. Only the cart exists.

Payment accepted: the card was charged (Authorize and capture), or an authorization was captured. The payment is recorded with the Authorize.Net Trans ID as the transaction ID, and a note shows the amount, Trans ID, auth code, card type and last four digits.

Authorize.Net payment authorized: the funds are only authorized (Authorize only). Capture them before fulfilment.

Authorize.Net payment on hold: the Fraud Detection Suite held the transaction for review, the amount charged does not match the order total, or a capture reported by webhook does not match the order amount. The note explains it. Approve or decline a held transaction in the Authorize.Net panel; with webhooks the order is updated automatically.

Canceled: a webhook reported that the transaction was declined, voided or expired before the order was paid, or you voided an authorization that was not captured. If a paid order's transaction is voided in the Authorize.Net panel, its status is not changed and a warning note is added.

Refunded: the payment was fully refunded or voided through the module.

If a second transaction is approved for a cart that already has an order, the order is not changed. A note asks you to check it and void or refund the duplicate in the Authorize.Net panel.

Authorize.Net payment block

The order page shows an Authorize.Net payment block with the Trans ID, the transaction type, the transaction status, the card and auth code, the amount charged, the order total and the amount refunded, a Sandbox badge for sandbox payments, the refund history and the Authorize.Net notes of the order. Capture and refunds need only the right to edit orders, not access to the Modules pages.

Capture

For an order in Authorize.Net payment authorized, click Capture payment in the block and confirm Capture the authorized amount through Authorize.Net? The authorized amount is captured, the payment is recorded with the Trans ID and the order becomes Payment accepted. If the capture fails, the error is shown and added to the notes. You can also capture in the Authorize.Net panel; with webhooks the order is updated automatically.

Refunds

In the block enter the amount (the amount not refunded yet is filled in), optionally a reason, click Refund via Authorize.Net and confirm Refund this amount through Authorize.Net? This cannot be undone. A refund of the full amount first voids the transaction if it is not settled yet, or an authorization that was not captured. Settled transactions, usually after 24 hours, can be refunded fully or partially. Before settlement a partial refund is not possible: refund the full amount to void the transaction, or try again after settlement. Refunds are made in the amount and currency Authorize.Net charged, so after an amount mismatch you can refund up to what the customer actually paid, not the order total. If Authorize.Net does not accept the refund, the block shows the error and no refund is recorded. A successful refund or void is added to the refund history and the notes. A full refund sets the order to Refunded (Canceled when only an authorization was voided). A partial refund does not change the status. While a transaction is held for review, refunds are not offered.

Captures, refunds and webhook checks of an order use the credentials of the mode the order was paid in, so orders of the other mode can still be captured and refunded after you switch Sandbox mode. Keep the credentials of that mode in their fields until those orders are done.

The module does not create credit slips. The standard PrestaShop refund buttons of the order page do not send money back through Authorize.Net. Refunds made in the Authorize.Net panel are not reported to the shop: update the order manually.

License key

The module works with a VibeFox license key from vibefox.net. The license block License — VibeFox Authorize.Net Gateway is the first block on Modules > Module Manager > VibeFox Authorize.Net Gateway > Configure, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this shop. Below them are the line Product: presta-payment-authorizenet and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only employees with the Configure permission for the module can change the key. The texts of the block follow the back office language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the shop address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the module keeps working on the last known status.

One key works on one domain: the domain of the main shop, also in a multistore setup. Removing the key from the shop does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, the Authorize.Net card payment is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. The PrestaShop storefront does not know that you are logged in to the back office, so the payment method is hidden for you too: you can set up the module before you buy a key, but not test it at checkout. A reminder appears in Modules > Module Manager on the Alerts tab. Existing orders are not affected: payments already started are still confirmed, and captures and refunds work.

When a license expires, the module keeps working, but updates and support need a renewal. The status is checked again automatically while you work in the back office: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling or resetting the module always removes the license key and license status.

Troubleshooting

Authorize.Net does not appear at checkout: check that the license is active, Enable/Disable is on and the current mode has an API Login ID, Transaction Key and Public Client Key. The settings page shows a warning when one is missing. Check that the cart currency is supported, and in Payment > Preferences that the module is allowed for the cart currency, the customer's country and the customer's group.

The payment went through, but the order stays Authorize.Net payment on hold or authorized: the transaction type is Authorize only (capture it in the order block), or Authorize.Net held the transaction for review. Approve or decline it in the Authorize.Net panel. To have such orders updated automatically, set up the webhook: check that the endpoint exists in the account of the mode you use, that its URL is exactly the one shown in Endpoint URL, that the four events are selected and that the Signature Key of that account is entered.

Webhook answers webhooks are not configured: no Signature Key is entered for either mode.

Webhook answers invalid signature: the Signature Key belongs to another account, or a key was changed in Authorize.Net. Create or copy the Signature Key again and paste it into the field of its mode.

Webhook answers mode mismatch: the notification was signed with the key of one mode, but the payment was made in the other mode. Check that the sandbox and live Signature Keys are not swapped.

Webhook answers verification failed, retry later: the shop could not read the transaction from the Authorize.Net API, or the credentials of the payment's mode are missing. Authorize.Net retries the delivery.

Webhook answers busy, retry later: the order was being updated by another request at the same moment, or the order could not be created. Authorize.Net retries the delivery. Look at the Log field for the reason.

The webhook URL shows method not allowed in the browser: this is normal. The URL accepts only requests from Authorize.Net.

The card form shows The secure card form (Accept.js) could not be loaded: the checkout must use HTTPS, and the Public Client Key and API Login ID of the current mode must be correct.

Payment error: the card could not be tokenized: Accept.js did not return a token. The customer should re-enter the card details and try again.

The customer sees a general error: look at the Log field on the module page; errors are always written there. A currency the account does not support is rejected by Authorize.Net.

A partial refund fails because the transaction is not settled yet: refund the full amount to void the transaction, or retry after settlement, usually within 24 hours.

Refund or capture fails with a message about the mode: the payment was made in sandbox or live mode, and the API Login ID and Transaction Key of that mode are not set. Enter them and try again.

Uninstall

Go to Modules > Module Manager, open the menu next to VibeFox Authorize.Net Gateway and choose Uninstall. The license key and license status of this module are always removed. If Delete data on uninstall is on, the settings and the log are removed. If it is off, all settings are kept for a later re-install. The Authorize.Net transactions and refunds and the order statuses Authorize.Net payment authorized and Authorize.Net payment on hold are always kept, so orders paid before can still be captured and refunded after a re-install. Existing orders keep their payment notes and transaction IDs.

Authorize.Net is a trademark of its respective owner. This module is not affiliated with or endorsed by Authorize.Net.