VibeFox Yoco for WooCommerce — Help

Requirements

WordPress: 6.2 or later.

WooCommerce: 8.0 or later, installed and active. The plugin refuses to activate without it.

PHP: 8.0 or later.

Store currency: South African rand (ZAR). Yoco accepts ZAR only. In any other currency the payment method is hidden at checkout. The order total must be at least R2.00.

Yoco account: a Yoco account with online payments. You need its secret keys, which you find in the Yoco Business Portal under Selling Online > Payment Gateway. Only the secret keys are entered. The webhook is registered by the plugin, and its signing secret is filled in for you.

Public site: Yoco sends webhooks to your site, so it must be reachable from the internet. The webhook URL must accept a POST without redirects.

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

1. In WordPress go to Plugins > Add New > Upload Plugin, choose the plugin ZIP file and click Install Now. You can also upload the wcp_yoco_pay folder to /wp-content/plugins/ by FTP.

2. Click Activate.

3. Open the settings: WooCommerce > Settings > Payments > Yoco > Manage.

4. Enter your VibeFox license key in the license block at the top of the page and click Activate.

5. Paste the test secret key (sk_test_...) and, when you are ready, the live secret key (sk_live_...). Save the settings. The webhook is registered for each mode that has a key.

6. Turn on Enable/Disable. Make a test payment with a Yoco test card while Test mode is on, then untick Test mode to take real payments.

Configuration

All settings are on one page: WooCommerce > Settings > Payments > Yoco. Above the fields the page warns you when the store currency is not ZAR (Yoco is then not offered at checkout) and when the current mode has no secret key. In the list of payment methods, Yoco is marked as needing setup until the current mode has a secret key. When you save, the plugin checks the keys and the webhook secrets and registers the webhooks. Messages about this appear at the top of the page.

General

Enable/Disable: Enable Yoco turns the payment method on or off. Default: off.

Title: the payment method name customers see at checkout. Default: Card or Instant EFT (Yoco).

Description: the text shown under the payment method at checkout. Default: You will be redirected to the secure Yoco page to pay by card or Instant EFT.

API keys

Copy the secret keys from the Yoco Business Portal under Selling Online > Payment Gateway. Yoco has one API for both modes: the key decides whether a payment is a test or a real one. Test mode uses only the test key, live mode only the live key.

Test mode: Use the test secret key (no real payments). No real money is charged; pay with Yoco test cards. Default: on. Untick it to take real payments.

Test secret key: the secret key of the test mode. It starts with sk_test_.

Live secret key: the secret key of the live mode. It starts with sk_live_.

A key that does not start with the expected prefix is not saved: the page shows an error and keeps the previous value. If Yoco reports during webhook registration that a key belongs to the other mode, the page tells you so.

Webhooks

Yoco confirms payments and refunds to the webhook URL shown in this section. It looks like https://your-site/wc-api/yoco_pay_webhook/. You do not need to create the webhook in the Yoco portal. When you save the settings, the plugin registers the URL with Yoco for each mode that has a secret key but no webhook secret, and stores the signing secret in the field of that mode. It registers the URL again when the secret key of that mode changes or the webhook URL changes. When the URL changes, the old registration is removed.

For each mode the section shows the state of the webhook:

The plugin handles these events:

Webhooks without a valid signature are rejected. If your site uses a language prefix in URLs, keep the URL exactly as the settings show it, because the webhook must reach your store without a redirect.

Test webhook secret: filled in automatically when the webhook is registered. Paste a secret (whsec_...) only if you registered the webhook URL yourself.

Live webhook secret: filled in automatically when the webhook is registered. Clear the field and save to register the webhook again.

A webhook secret must look like whsec_ followed by base64 text. Any other value is not saved, and the previous value is kept.

Advanced

Debug log: Log Yoco requests and webhooks writes requests and webhooks to WooCommerce > Status > Logs, source wcp_yoco_pay. Errors and warnings, such as failed requests to Yoco and rejected webhooks, are always logged. Keys, webhook secrets and e-mail addresses are masked. Default: off.

Delete data: Delete the settings and logs of this plugin when it is deleted. Deactivation never deletes anything. Order data (Yoco checkout and payment IDs) is always kept, because it is needed for refunds. Default: off.

Checkout

The customer chooses the payment method (by default Card or Instant EFT (Yoco)) and places the order. In test mode the checkout shows Test mode — use a Yoco test card; no real money is charged. The plugin creates a Yoco checkout for the order total in cents and sends the customer to the Yoco payment page, where the customer pays by card or Instant EFT.

After paying, the customer returns to your store. The order is marked paid only after Yoco confirms it: the plugin asks Yoco for the checkout when the customer comes back and again when the signed webhook arrives. If Yoco has not confirmed the payment yet, the order received page shows We are waiting for Yoco to confirm your payment. The order will be updated automatically — please do not pay again.

If the customer cancels on the Yoco page, the order stays unpaid and the customer comes to the Pay for order page with the message The Yoco payment was cancelled. Your order is saved — you can pay again below or choose another payment method. If the payment fails, the message is The Yoco payment was not successful. Please try again or choose another payment method. and a note is added to the order.

A customer can pay an unpaid order again from the Pay for order page. Before a new attempt the plugin checks the previous one with Yoco. If it was already paid, the order is completed without a new payment page. If it is still open for the same amount and was created less than 30 minutes ago, the customer gets the same Yoco page again.

If Yoco cannot start the payment, the customer sees Yoco could not start the payment. Please try again in a moment or choose another payment method. and the reason is added to the order notes. An order below R2.00 gets Yoco requires an order total of at least R2.00.

The payment method works on the classic checkout, on the Checkout block and on the Pay for order page. It is compatible with WooCommerce High-Performance Order Storage (HPOS).

Payments are charged immediately on the Yoco page. The plugin has no saved cards, subscriptions or recurring payments, no on-site card form and no separate authorize and capture, and it does not work in currencies other than ZAR.

Orders and refunds

Order statuses

Pending payment: the customer was sent to Yoco and has not paid yet, cancelled on the Yoco page, or Yoco has not confirmed the payment yet.

Processing or Completed: the payment was confirmed. WooCommerce sets Processing, or Completed for orders with only virtual downloadable products. The order note shows the amount, the Yoco payment and checkout IDs, the mode and how the payment was confirmed (the customer's return, the webhook or a check before a new payment attempt). The transaction ID is the Yoco payment ID.

On hold: Yoco reported a different amount or currency than the order total, for example because the order was edited after the payment started. The note explains it, and the customer returning from Yoco sees We received your payment and are reviewing it. We will contact you if anything else is needed. Check the payment before shipping.

Cancelled or Refunded: a payment that arrives for such an order does not change it. A note asks you to refund the payment in the Yoco portal or restore the order manually. The customer returning from Yoco sees Your payment was received after the order had been cancelled. Please contact us — do not pay again.

If a second payment arrives for an order that is already paid, the order is not changed again. A note asks you to refund it in the Yoco portal.

Refunds

Open the order, click Refund, enter the amount and click the Refund via button with your payment method title (by default Card or Instant EFT (Yoco)). Full and partial refunds are supported. The refund is sent in the mode the payment was made in (test or live), so that mode's secret key must be set. A refund repeated after a lost answer is not paid out twice.

A successful refund is added to the order notes with the Yoco refund ID. If Yoco refuses the refund, WooCommerce shows Yoco refused the refund: with the reason, and no refund is recorded. If Yoco reports the refund as pending, WooCommerce shows that it is still pending and records nothing. Do not repeat it: it is added to the order when Yoco confirms it by webhook.

Refunds made in the Yoco portal arrive by the refund.succeeded webhook and are recorded as WooCommerce refunds automatically, without restocking items. A refund larger than the amount left to refund is not recorded, and a note asks you to check the order. A failed refund adds a note that the money was not returned to the customer.

License key

The plugin works with a VibeFox license key from vibefox.net. The license block is at the top of WooCommerce > Settings > Payments > Yoco. Paste the key into License key and click Activate. The block shows the status, for example the date the license is active until and your domain. Use Check now to check the status again, Change key to enter another key and Remove key to remove it from this site. The link Manage licenses and domains in your account opens your vibefox.net account.

One key works on one domain. Removing the key from a site does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, Yoco is not shown to customers at checkout. If a payment is started anyway, the customer sees This payment method is not available. Please choose another one. Logged-in store managers still see the payment method, marked (unlicensed — visible to admins only), so you can set up and test the plugin before you buy a key. A reminder appears on the Plugins page and on WooCommerce pages. Existing orders are not affected: payments already started are still confirmed, and refunds work.

When a license expires, the plugin keeps working, but updates and support need a renewal. The status is checked again automatically in the background.

Troubleshooting

Yoco does not appear at checkout: check that the license is active, Enable/Disable is on and the current mode has a secret key: Test secret key in test mode, Live secret key in live mode. The store or order currency must be ZAR, and the order total at least R2.00. The settings page shows a warning when the key is missing or the currency is not ZAR.

The payment went through, but the order stays Pending payment: the webhook is not working. Open the Webhooks section of the settings and check the state of the mode you use. If it is not registered, or registered for another URL, save the settings. If the registration fails, the page shows the reason. If you entered the secret yourself, check that it belongs to the webhook of this URL and mode. The order is also confirmed when the customer returns to the store after paying, and when the customer tries to pay again.

Could not register the webhook: payments are still confirmed when customers return to the store. Fix the reason shown in the message, for example the site must be reachable from the internet over HTTPS, and save again. You can also register the URL yourself and paste the signing secret.

Webhooks are rejected: rejected webhooks are written to the log, source wcp_yoco_pay. webhook secret not configured means neither webhook secret is set. invalid signature means the secret belongs to another registration or mode. timestamp outside the tolerance means the server clock is wrong: signatures are accepted within 5 minutes of the server time. checkout not completed yet — retry and could not confirm the checkout with Yoco — retry are temporary; Yoco sends the webhook again.

The secret key must start with sk_test_ / sk_live_ error on save: a key was pasted into the wrong field. The test key starts with sk_test_, the live key with sk_live_. The previous value was kept.

The customer sees an error when placing the order: read the order notes or WooCommerce > Status > Logs, source wcp_yoco_pay. Yoco is not available at the moment. Please choose another payment method. means the current mode has no secret key.

The customer is told a payment needs to be reviewed: an earlier attempt was paid with a different amount, or after the order was cancelled. Read the order note and fulfil the order or refund the payment in the Yoco portal.

Refund fails with a message about the mode: the payment was made in test or live mode, and the secret key of that mode is not set. Enter it and try again.

Refund fails with No answer from Yoco: nothing was recorded in WooCommerce. If Yoco did process the refund, repeat the same refund: it is not refunded twice.

The license block shows an error: follow the message in the block. For example, if the key is already used on another domain, free a slot in your vibefox.net account and click Check now. If the site address changed, click Check now to activate the key for the new domain. If the license server cannot be reached, the plugin keeps working on the last known status.

Uninstall

Deactivating the plugin keeps all data. To remove it, deactivate and delete it on the Plugins page. The license key and license status of this plugin are always removed. The gateway settings, the webhook registrations at Yoco and the logs, including rotated log files, are removed only if Delete data was on. Otherwise they stay for a later re-install. Existing orders keep their payment notes and transaction IDs.

Yoco is a trademark of its respective owner. This plugin is not affiliated with or endorsed by Yoco.