VibeFox HyperPay for PrestaShop — Help

Requirements

PrestaShop: 8.0 to 9.x.

PHP: 8.0 or later with the OpenSSL extension (it decrypts the webhooks). The module refuses to install without them.

HyperPay account: HyperPay issues the Access Token and Entity ID when your merchant account is set up. Test and live credentials are different. You also need a payment webhook in the HyperPay dashboard and its decryption key (webhook key), shown under Administration > Webhooks (see Configuration).

Card data: the card is entered only in the HyperPay widget, so card data never touches your server (PCI DSS SAQ A).

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

1. In the back office go to Modules > Module Manager and click Upload a module. Choose the module ZIP file.

2. When the upload finishes, click Configure, or find VibeFox HyperPay Payment Gateway in the module list later and click Configure.

3. Paste your VibeFox license key into License key in the license block at the top of the Configure page and click Activate (see License key).

4. Enter the test Access Token, Entity ID and webhook key issued by HyperPay and keep Test Mode on.

5. In the HyperPay dashboard (Administration > Webhooks) add a payment webhook with the URL shown in the Webhook section and copy its decryption key into the webhook key field of the same mode.

6. Turn on Enable/Disable, click Save and make a test payment with a HyperPay test card. Then enter the live credentials and turn Test Mode off.

On install the module creates three order statuses: Awaiting HyperPay payment, HyperPay payment authorized and HyperPay payment on hold. PrestaShop links a new payment module to the currencies, countries and customer groups active at that moment. Countries you activate later must be allowed in Payment > Preferences.

Configuration

All settings are on the module page: Modules > Module Manager > VibeFox HyperPay Payment Gateway > Configure. Each section has its own Save button, which saves the whole page. Above the fields the page shows Test mode is on: payments go to the HyperPay test system and no real money is charged. while test mode is on. It warns you when the Access Token or Entity ID of the current mode is missing (the payment method is then not shown at checkout), and when the current mode has no valid webhook key (payments are then confirmed only when the customer returns to the shop). When you save, spaces are removed from the credentials, and the page warns you if a webhook key is not a 64-character hexadecimal key.

HyperPay

Enable/Disable: Enable HyperPay Payment turns the payment method on or off. Default: off.

Title: the title the customer sees during checkout. It is also the payment method name stored in the order. Default: Credit/Debit Card (HyperPay). Required.

Description: the description the customer sees during checkout. Default: Pay securely using your credit or debit card.

API credentials

The Access Token, Entity ID and webhook key are issued by HyperPay when your merchant account is set up. Test and live credentials are different. The webhook key is shown in the HyperPay dashboard under Administration > Webhooks.

Test Mode: uses the HyperPay test system (eu-test.oppwa.com) and the test credentials. No real money is charged. Turn it off to accept real payments with the live credentials (eu-prod.oppwa.com). Default: on. While it is on, customers see Test mode: no real payment will be made. under the payment method.

Test Access Token: the bearer token of your HyperPay test account.

Test Entity ID: the Entity ID of the test payment channel.

Test Webhook Key: the 64-character hexadecimal key used to decrypt webhook notifications of the test system.

Live Access Token: the bearer token of your HyperPay live account.

Live Entity ID: the Entity ID of the live payment channel.

Live Webhook Key: the 64-character hexadecimal key used to decrypt webhook notifications of the live system.

Saved access tokens and webhook keys are never shown again. The field stays empty and shows Saved — leave empty to keep it. Type a new value only to change it.

Clear saved secrets: tick a token or key and click Save to remove it. An empty field keeps the saved value.

Webhook

The webhook tells your shop about payments even when the customer closes the browser before returning to the shop. In the HyperPay dashboard (Administration > Webhooks) add a webhook for payments with the URL shown in Webhook URL in this section. With friendly URLs it looks like https://your-shop/module/wcp_hyperpay_payment_gateway/webhook, possibly with a language code such as /en/. Copy the URL exactly as the settings show it. Then copy the webhook decryption key into Test Webhook Key or Live Webhook Key, for the same mode.

HyperPay webhooks are encrypted (AES-256-GCM). A webhook that cannot be decrypted with your keys is rejected. Only payment notifications are processed, and the payment must belong to a checkout of one of your carts, created in the same mode as the key that decrypted it. HyperPay test notifications are acknowledged. The webhook also reports captures, reversals, refunds and chargebacks made in the HyperPay dashboard (see Orders and refunds). Without the webhook, a payment is confirmed only when the customer returns to the shop after paying.

Payment

Transaction Type: how the card is charged.

Payment Brands: the brands shown in the payment widget: VISA, Mastercard, mada, American Express, STC Pay, Apple Pay. Default: VISA and Mastercard. If no brand is ticked, the page warns you and the widget shows VISA and Mastercard. Select only brands that HyperPay enabled for your Entity ID; mada, STC Pay and Apple Pay often use their own entity, which this module does not support.

Advanced

Enable Logging: logs API requests and responses to logs/hyperpay_p_debug.log.php in the module folder. The file cannot be opened from the web. Errors and warnings are always logged. Logs contain no card data, keys or customer data. Default: off.

Log: shows the size and the latest entries of the log. Click Clear log to empty it.

Delete Data on Uninstall: when on, uninstalling the module removes the settings, the table of HyperPay payment attempts and the log files. Orders and the module's order statuses are kept. Default: off.

Checkout

At the payment step the customer chooses the payment method (by default Credit/Debit Card (HyperPay)) and confirms the order. The module prepares a HyperPay checkout for the cart total in the cart currency and opens the HyperPay payment page of your shop with the HyperPay widget and Please complete your payment below:. The widget uses the customer's language when HyperPay supports it. In test mode the page shows Test mode: use a HyperPay test card, no real payment will be made. The customer enters the card details in the widget, or follows Choose another payment method back to checkout. No order exists yet at this point. Reloading the page reuses the same checkout for up to 25 minutes while the cart does not change.

After paying, the customer returns to your shop. The module checks that the payment belongs to one of this cart's checkouts and asks HyperPay for the result with a server-to-server request, in the mode the checkout was created in. The order is marked paid only after HyperPay confirms it: by that request or by the webhook. The amount and currency must match the cart. A return and a webhook arriving at the same moment are handled one after the other, so the order is never created twice. When the payment is confirmed, the order is created and the customer sees the standard order confirmation page.

If the payment did not go through, the customer is back at checkout with a message: Payment failed: and the reason from HyperPay, Payment was not completed. Please try again., or We could not confirm your payment yet. If you were charged, the order will be updated automatically; otherwise please try again. The cart is kept, and the customer can pay again; each new attempt gets a new HyperPay checkout. If the payment form cannot be prepared, the customer stays at checkout with a short message, for example that some billing details were not accepted by the payment provider, or that the payment form is not available because of a payment configuration error. The technical reason is written to the log.

Amounts are sent with two decimals, as the HyperPay API requires. In 3-decimal currencies (KWD, BHD, JOD, OMR) the cart total is rounded to two decimals.

The webhook works while the shop is in maintenance mode and is not blocked by the country restriction of your shop.

The module has no refunds or voids from PrestaShop, no saved cards or tokenization, no subscriptions, no Apple Pay domain verification, no separate entity per brand and no Tabby, Tamara or other buy-now-pay-later methods.

Orders and refunds

Order statuses

No order yet: the customer was sent to the payment page and has not paid, the payment was declined, or HyperPay has not confirmed the payment yet. Only the cart exists.

Payment accepted: a debit payment was confirmed, or a pre-authorization was captured. The payment is recorded with the HyperPay payment ID as the transaction ID, and a private note shows the HyperPay result code, description and payment ID. If HyperPay flagged the payment for manual review, the note says so; check it in the HyperPay dashboard before shipping.

HyperPay payment authorized: the amount was reserved by a pre-authorization. Capture it in the HyperPay block of the order or in the HyperPay dashboard; the capture webhook then moves the order to Payment accepted.

Awaiting HyperPay payment: HyperPay reported the payment as pending. The order moves to Payment accepted when HyperPay confirms it.

HyperPay payment on hold: HyperPay reported a different amount or currency than the cart or order (for example, the cart was changed after the payment page was opened), or the payment arrived after the order had been cancelled. The note explains it. Check the payment in the HyperPay dashboard, then fulfil the order or refund the payment.

Canceled: a pre-authorization was reversed in the HyperPay dashboard, and the reversal webhook cancels the authorized order.

A declined result never changes an existing order. If another successful payment arrives for an order that is already paid, the order is not changed. A note asks you to refund the duplicate in the HyperPay dashboard. A successful payment for a refunded order only adds a note.

HyperPay payment block

The order page shows a HyperPay payment block with the payment ID (and the capture ID after a capture), the transaction type, the checkout ID, the merchant transaction ID, the amount sent to HyperPay, the result and a Test mode badge for test payments. The module's notes are in the private messages of the order.

Capture

For an order in HyperPay payment authorized the block shows Capture payment with the amount. Click it and confirm Capture the pre-authorized amount through HyperPay?. The current order total is captured, in the mode the pre-authorization was made in, so that mode's Access Token and Entity ID must be set. You need the right to edit orders; access to the module pages is not needed. After a successful capture the order becomes Payment accepted and the capture ID is added to the payment and the notes. If HyperPay refuses the capture, the result code and description are shown and added to the notes, and the order stays authorized. A double click does not capture twice. Reversing (voiding) a pre-authorization is done in the HyperPay dashboard.

Refunds

Refunds from PrestaShop are not supported, and the standard PrestaShop refund buttons do not send money back through HyperPay. Refund the payment in the HyperPay dashboard and record it in PrestaShop with a partial refund or credit slip if needed. Refunds and chargebacks made in HyperPay are added to the order as a note by the webhook; the order status is not changed.

License key

The module works with a VibeFox license key from vibefox.net. The license block License — VibeFox HyperPay Payment Gateway is the first block on Modules > Module Manager > VibeFox HyperPay Payment Gateway > Configure, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this shop. Below them are the line Product: presta-payment-hyperpay and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only employees with the Configure permission for the module can change the key. The texts of the block follow the back office language (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the shop address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the module keeps working on the last known status.

One key works on one domain: the domain of the main shop, also in a multistore setup. Removing the key from the shop does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, HyperPay is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. The PrestaShop storefront does not know that you are logged in to the back office, so the payment method is hidden for you too: you can set up the module before you buy a key, but not test it at checkout. A reminder appears in Modules > Module Manager on the Alerts tab. Existing orders are not affected: payments already started are still confirmed, and captures and refunds work.

When a license expires, the module keeps working, but updates and support need a renewal. The status is checked again automatically while you work in the back office: once a day for the first 14 days after the key is entered, then once a week. No cron job is needed. Uninstalling or resetting the module always removes the license key and license status.

Troubleshooting

HyperPay does not appear at checkout: check that the license is active, Enable/Disable is on and the current mode has its Access Token and Entity ID: the test ones in test mode, the live ones in live mode. The settings page shows a warning when they are missing. In Payment > Preferences check that the module is allowed for the cart currency, the customer's country and the customer's group.

The payment went through, but no order was created: the webhook is not working and the customer did not return to the shop. In the HyperPay dashboard check that the payment webhook exists for the mode you use, that its URL is exactly the one shown in Webhook URL, and that its decryption key is in the webhook key field of the same mode. Turn on Enable Logging and look at the Log field on the module page.

Webhook answers Decryption failed: the webhook key belongs to another webhook or another mode. Copy the key again from the HyperPay dashboard.

Webhook answers Webhook key not configured: no valid webhook key is set. Paste the 64-character key into the settings. HyperPay retries the webhook.

Webhook answers Busy, retry later: the order was being processed by another request at the same moment, or the order could not be created (for example, the module is disabled). HyperPay retries the webhook. The reason is in the log.

Log shows Webhook ignored: the payment does not belong to a cart of this shop, or it was made in the other mode. Test and live payments are kept apart.

The webhook URL shows Method not allowed in the browser: this is normal. The URL accepts only POST requests from HyperPay.

The payment form does not load: look at the log. A configuration error usually means a wrong Access Token or Entity ID for the current mode. A message about billing details means HyperPay did not accept some customer data. Make sure the selected Payment Brands are enabled for your Entity ID.

Order is HyperPay payment on hold: read the notes of the order (see Order statuses), check the payment in the HyperPay dashboard, then fulfil the order or refund the payment.

Capture fails: read the result code and description in the block and the notes. The capture is sent in the mode of the pre-authorization, so that mode's credentials must be set; otherwise the block says that the Access Token / Entity ID of that mode are empty.

Uninstall

Go to Modules > Module Manager, open the menu next to VibeFox HyperPay Payment Gateway and choose Uninstall. The license key and license status of this module are always removed. If Delete Data on Uninstall is on, the settings, the table of HyperPay payment attempts and the log files are removed. If it is off, all of them are kept for a later re-install. The order statuses Awaiting HyperPay payment, HyperPay payment authorized and HyperPay payment on hold are always kept. Existing orders keep their payment notes and transaction IDs.

HyperPay is a trademark of its respective owner. This module is not affiliated with or endorsed by HyperPay.