VibeFox Authorize.Net for Adobe Commerce — Aide

Requirements

Magento: Magento Open Source or Adobe Commerce 2.4.6 to 2.4.9, on your own server or hosting, on premises or on Adobe Commerce on cloud infrastructure. The module does not work with Adobe Commerce as a Cloud Service (the SaaS edition), which does not accept PHP modules.

PHP: 8.1 to 8.4, with the cURL extension.

HTTPS: your checkout must use HTTPS for real payments. Accept.js, the Authorize.Net card library, works only on HTTPS pages.

Authorize.Net account: you need the API Login ID, Transaction Key and Public Client Key of your Authorize.Net account, and a Signature Key if you use webhooks. Production (account.authorize.net) and sandbox (sandbox.authorize.net) accounts have different credentials. Authorize.Net accounts are available to merchants in the US, Canada, the UK, Europe, Australia and New Zealand.

Currency: the currency of the store must be USD, CAD, CHF, DKK, EUR, GBP, NOK, PLN, SEK, AUD or NZD, and your Authorize.Net account must settle in it. For other currencies the payment method is hidden at checkout.

VibeFox license key: bought on vibefox.net. One key works on one domain.

Installation

The module is one ZIP file. It is a Composer package and can also be copied into app/code. Run the commands in the Magento root folder as the user that owns the Magento files.

1. With Composer: put the ZIP file into a folder that your project uses as a Composer "artifact" repository and run composer require vibefox/module-authorizenet-payment. Without Composer: unpack the ZIP file into app/code/Vibefox/AuthorizenetPayment/, so that registration.php is directly in that folder.

2. Run bin/magento module:enable Vibefox_AuthorizenetPayment and bin/magento setup:upgrade. In production mode also run bin/magento setup:di:compile and bin/magento setup:static-content:deploy, then bin/magento cache:flush.

3. In the Admin go to Stores > Configuration > Sales > Payment Methods and open VibeFox Authorize.Net Gateway. When the Magento PayPal module is enabled, the group is listed under Other Payment Methods. Paste your VibeFox license key into License key in the license block, the first row of the group, and click Activate (see License key).

4. Enter the credentials of the sandbox and production accounts and optionally set up the webhook (see Configuration). Set Enable to Yes, choose the Transaction type and click Save Config. Test a payment with Sandbox mode = Yes, then set Sandbox mode to No to take real payments.

The module adds the Credit Card payment method (the default title) with a card form to the Magento checkout. It is off after installation (Enable = No). The module uses the standard Magento order states and creates no order statuses of its own. It creates two tables for the Authorize.Net transactions and for captures, voids and refunds.

Configuration

All settings are in Stores > Configuration > Sales > Payment Methods > VibeFox Authorize.Net Gateway, in the standard Magento configuration form. Like other Magento settings, they can be changed for a website with the Scope switcher at the top of the page; Title and Description also for a store view. Save Config saves the whole page. Amounts accept "9.99" and "9,99".

If a value is wrong, Magento shows an error and nothing on the page is saved: an empty Title or a title longer than 128 characters (Authorize.Net: enter a title of 1 to 128 characters.); a Transaction type that is not one of the options; a Sort Order that is not a whole number; a Minimum Order Total or Maximum Order Total that is not a number of 0 or greater.

While Enable is Yes, the Advanced section warns you when the store address does not use HTTPS (Accept.js requires HTTPS at checkout.), when the current environment has no API Login ID, Transaction Key or Public Client Key (Authorize.Net is hidden at checkout: configure API Login ID, Transaction Key and Public Client Key for the selected environment.) and when it has no Signature Key (The Signature Key is required for webhooks.).

General

Enable: shows or hides the card payment at checkout. It is shown only when the API Login ID, Transaction Key and Public Client Key of the current environment are set and the store currency is supported. Default: No.

Title: the payment method name customers see at checkout. It is also stored in the order. Default: Credit Card. Required, at most 128 characters.

Description: shown in the payment method list at checkout, above the card form. Default: Pay securely with your credit card via Authorize.Net.

Sandbox mode: uses the Authorize.Net sandbox (test transactions, no real charges). It switches the API endpoint, Accept.js and the set of credentials used for new payments. Default: Yes. Set it to No to take real payments.

Transaction type: how the card is charged.

API credentials

In the Authorize.Net Merchant Interface open Account > Settings > Security Settings. Under API Credentials & Keys copy the API Login ID and create a Transaction Key and a Signature Key. Under Manage Public Client Key copy the Public Client Key. Sandbox and production use different credentials. The page has fields for both environments, so you can keep both sets.

Sandbox API Login ID and Live API Login ID: the API Login ID of the sandbox or production account.

Sandbox Transaction Key and Live Transaction Key: the Transaction Key of that account.

Sandbox Public Client Key and Live Public Client Key: the public key used by Accept.js in the customer's browser. The API Login ID and the Public Client Key are sent to the checkout page for Accept.js; the Transaction Key and the Signature Key never are.

Sandbox Signature Key and Live Signature Key: needed only for webhooks. It verifies the X-ANET-Signature header of each notification.

Magento stores the Transaction Keys and Signature Keys encrypted and shows only a mask (******) after saving. Leave the mask as it is to keep the saved value, type a new value to change it. To delete a saved key, clear the field and click Save Config.

Conditions

Payment from Applicable Countries: All Allowed Countries offers the card payment for every country your store allows, Specific Countries only for the countries below.

Payment from Specific Countries: offer the card payment only for billing addresses in these countries.

Minimum Order Total: offer the card payment only from this order total, in the base currency of your store. Empty means no minimum.

Maximum Order Total: offer the card payment only up to this order total, in the base currency. Empty means no maximum.

Sort Order: the position among the payment methods at checkout. A whole number.

Advanced

The first row shows Webhook URL: and the webhook events to select in Authorize.Net (see Webhooks below), and the warnings described above.

Debug log: writes API requests and responses to var/log/wc_ang_debug.log.php in the Magento folder. The file cannot be opened from the web and is rotated at 5 MB. Keys, card tokens and personal data are masked. Default: No. Errors, such as declined or failed payments and operations with an unknown outcome, are always logged, even when this is off.

Delete data on uninstall: when Yes, uninstalling the module with its data removes the settings and the log (see Uninstall). The financial history is always preserved. The value of the default store view is used, so set it in the Default Config. Default: No.

Log (only in the Default Config): shows the size and the latest entries of the log, or The log is empty. Click Clear log to empty it.

Webhooks (recommended)

Without webhooks, orders held by the Fraud Detection Suite and authorizations captured or voided in the Merchant Interface must be updated by hand. In the Merchant Interface go to Account > Settings > Business Settings > Webhooks and click Add Endpoint, in the sandbox and in the production account. Use the URL shown after Webhook URL: in the Advanced section. It looks like https://your-store/wcpauthorizenetgateway/webhook/index. Copy the URL exactly as the settings show it. Select these events (they are also listed in the section):

Enter the Signature Key of each account in Sandbox Signature Key or Live Signature Key. Webhooks without a valid signature are rejected. The keys are read for the store the order was placed in. A notification must be signed with the key of the environment the payment was made in; a notification of the other environment changes nothing. The body of a notification is never taken as a payment confirmation: for each notification the module asks Authorize.Net for the current status and amount of the transaction and checks the transaction ID and the cart number before the order changes, so repeated notifications change nothing. Webhooks work also when Enable is No or the license is not active.

Checkout

At the payment step the customer chooses the payment method (by default Credit Card), sees the description and enters Card number, Expiration month, Expiration year and Card security code in the form under it. When the customer clicks Place Order, Accept.js is loaded from Authorize.Net and exchanges the card data for a one-time token in the browser. The card fields have no form names, so the card number and card code are never sent to your server. If Accept.js rejects the card data or cannot be loaded, the error is shown above the card fields and no order is placed.

Magento then places the order in Pending Payment. No invoice is created and no order e-mail is sent yet. The module charges the token through the Authorize.Net API for the order total in the order currency. The billing address, the e-mail, the customer ID and the IP address are sent with the transaction for address verification and fraud filters, the cart number as the invoice number and "Magento order" with the order number as the description. The order is marked paid only after Authorize.Net confirms it:

If the card is declined, the customer goes to the Card payment page with Payment failed: followed by the reason, for example a declined card, a wrong card code or an expired card. The page asks Re-enter your card details to complete the pending payment. The customer can enter the same or another card and click Pay to pay the same order, or click Back to checkout: then the order is cancelled (the stock goes back), the cart is restored and the customer is in the cart. Configuration and API errors are not shown to customers: they see a general message, and the details go to the log. An order that is not paid stays in Pending Payment until it is paid, the customer goes back to checkout or Magento cancels it after the Pending Payment Order Lifetime (Stores > Configuration > Sales > Sales > Orders Cron Settings).

A cart is never charged twice: a second attempt while the first one is running is refused, and a cart that is already paid with another order is not charged again (Authorize.Net: this cart is already paid or reserved. Do not pay again.). If the store cannot get an answer from Authorize.Net, the outcome of the payment is unknown and the customer sees Payment outcome is unknown. Contact the store before trying to pay again. Such a payment is never repeated automatically: check the transaction in the Merchant Interface. If a payment was approved but the order could not be updated, the customer sees Payment approved but could not be finalized. Do not pay again; contact the store.

The module works with the standard Magento (Luma) checkout. It has no saved cards or customer profiles, no subscriptions or recurring payments, no eCheck/ACH, Apple Pay, Google Pay or 3-D Secure, no partial capture of an authorization and no automatic currency conversion. The card payment is not offered for orders created in the Admin.

Orders and refunds

Order statuses

Pending Payment: the order was placed, but the card has not been charged yet: the card was declined and the customer can still pay, the customer left before paying, or the outcome of the payment is unknown. There is no invoice.

Processing: the card was charged (Authorize and capture): the invoice is created with the Authorize.Net Trans ID as the transaction ID and a note shows it. With Authorize only the order is also Processing, but without an invoice; the note says Authorize.Net funds authorized. Use Invoice with Capture Online before fulfilment.

On Hold: the Fraud Detection Suite held the transaction for review (approve or decline it in the Merchant Interface; with webhooks the order is updated automatically); the amount or currency charged does not match the order (no invoice is created; review the actual payment); or a webhook reported that the transaction of a paid order is no longer valid (the invoice is kept; reconcile the payment).

Canceled: the customer clicked Back to checkout after a failed payment, a webhook reported that the transaction was declined, voided or expired before the order was paid, you cancelled or voided an authorization, or Magento cancelled an unpaid order. If money arrives for a cancelled order, the order stays Canceled and a note asks you to review the stock and refund the payment in the Merchant Interface.

Closed: the payment was fully refunded with a credit memo.

If a second payment is approved for a cart that already has a paid order, no second invoice is created and a note asks you to review the transaction. The notes are order comments that the customer does not see.

Authorize.Net payment information

On the admin order page (Sales > Orders > View) the payment information shows the payment method title and Authorize.Net transaction (the Trans ID), Authorize.Net environment (sandbox or live), Card type, Card last four, Authorization code, Payment currency and Payment amount (minor units). Below it the Authorize.Net operation history table lists captures, voids and refunds with their state, amount, environment and transaction. The customer sees only the payment method title.

Capture and void

For an authorized order, click Invoice, choose Capture Online and submit the invoice. Only the full authorized amount can be captured. The capture is recorded with the Trans ID and the invoice is paid. If Authorize.Net does not accept it, Magento shows the error and the invoice is not created. To release an authorization that was not captured, use Void or Cancel of the order: the transaction is voided in Authorize.Net.

Refunds

Open the order, go to the Invoices tab, open the invoice and click Credit Memo. Choose the items and amounts to refund and click Refund. A refund of the full amount first voids the transaction if it is not settled yet. Settled transactions, usually after 24 hours, can be refunded fully or partially. Before settlement a partial refund is not possible: Magento shows Authorize.Net: partial refund is unavailable before settlement. Refund the full amount to void it or retry after settlement. A credit memo started from the order page instead of the invoice offers only Refund Offline, which does not send money back through Authorize.Net.

The refund is made in the order currency, up to the amount Authorize.Net charged minus the amounts already refunded online. If Authorize.Net does not accept the refund, Magento shows the error and the credit memo is not created. A full refund closes the order. After a credit memo with Refund Offline, online refunds of the order are refused (Authorize.Net: invalid refund amount or unreconciled previous Credit Memo.): refund the rest in the Merchant Interface. Refunds made in the Merchant Interface are not reported to the store: create a credit memo with Refund Offline or update the order manually.

Captures, voids, refunds and webhook checks of an order use the credentials of the environment and store the order was paid in, so orders of the other environment can still be captured and refunded after you switch Sandbox mode. Keep the credentials of that environment in their fields until those orders are done. If the answer of Authorize.Net to a capture, void or refund is lost, the module shows Authorize.Net operation has no confirmed response. Reconcile the payment before retrying. and does not repeat the same operation automatically: check it in the Merchant Interface. An order without an invoice, for example after an amount mismatch, cannot be refunded online; refund it in the Merchant Interface.

License key

The module works with a VibeFox license key from vibefox.net. The license block License — VibeFox Authorize.Net Gateway is the first row of the VibeFox Authorize.Net Gateway group in Stores > Configuration > Sales > Payment Methods, above the settings. Paste the key into License key and click Activate. After that the block shows the key masked, the status (for example the date the license is active until and your domain) and the buttons Check now to check the status again, Change key to enter another key and Remove key to remove the key from this store. Below them are the line Product: magento-payment-authorizenet and the link Manage licenses and domains in your account, which opens your vibefox.net account. Only Admin users whose role allows the Payment Methods configuration section can change the key. The texts of the block follow the Admin interface locale (English and Russian are included).

If the key is not accepted, the block says why, for example Key not found, This key belongs to another product, Domain limit reached or License expired on a date. After the store address changes, or after you free a domain slot in your account, click Check now. If the license server cannot be reached, the module keeps working on the last known status.

One key works on one domain: the domain of the default store view, also when the installation has several websites or stores. Removing the key from the store does not free its domain slot. Free the slot in your vibefox.net account.

Without an active key, the card payment is not shown to customers at checkout. If a payment is started anyway, the card is not charged, the customer sees This payment method is not available. and can go back to the cart with Back to checkout, which cancels the order and restores the cart. The Magento storefront does not know that you are logged in to the Admin, so the payment method is hidden for you too: you can set up the module before you buy a key, but not test it at checkout. A reminder appears in the System Messages of the Admin, with the links Enter the license key and Dismiss, which hides it for 7 days. Existing orders are not affected: payments already started are still confirmed by webhooks, and captures, voids and refunds work.

When a license expires, the module keeps working, but updates and support need a renewal. The status is checked again automatically: once a day for the first 14 days after the key is entered, then once a week, by the Magento cron and while you work in the Admin. Uninstalling the module with its data always removes the license key and license status.

Troubleshooting

The card payment does not appear at checkout: check that the license is active and Enable is Yes for the website of the store, and that the current environment has an API Login ID, Transaction Key and Public Client Key. The Advanced section shows a warning when one is missing. Check that the store currency is supported, Payment from Applicable Countries and Payment from Specific Countries against the customer's billing address, and Minimum Order Total and Maximum Order Total.

The payment went through, but the order stays On Hold or is only authorized: the transaction type is Authorize only (capture it with Invoice and Capture Online), or Authorize.Net held the transaction for review. Approve or decline it in the Merchant Interface. To have such orders updated automatically, set up the webhook: check that the endpoint exists in the account of the environment you use, that its URL is exactly the one shown after Webhook URL:, that the four events are selected and that the Signature Key of that account is entered for the store of the order.

The order stays Pending Payment: the customer did not pay, the card was declined or the outcome of the payment is unknown. Read the log and check the transaction in the Merchant Interface before you cancel the order. An order with an unknown payment outcome cannot be cancelled until it is reconciled (Authorize.Net payment outcome is unknown. Reconcile it before cancelling or modifying this order.).

Webhook answers webhooks are not configured: no Signature Key is entered for either environment.

Webhook answers invalid signature: the Signature Key belongs to another account, or a key was changed in Authorize.Net. Create or copy the Signature Key again and paste it into the field of its environment.

Webhook answers mode mismatch: the notification was signed with the key of one environment, but the payment was made in the other one. Check that the sandbox and live Signature Keys are not swapped.

Webhook answers no matching order: the transaction does not belong to an order of this store, for example a payment made elsewhere with the same account. Nothing is changed.

Webhook answers verification unavailable or busy, retry later: the store could not read the transaction from the Authorize.Net API, the credentials of the payment's environment are missing, or the order was being updated by another request at the same moment. Authorize.Net retries the delivery. Look at the Log field for the reason.

The webhook URL shows method not allowed in the browser: this is normal. The URL accepts only requests from Authorize.Net.

Webhooks fail while the store is in maintenance mode: Magento maintenance mode closes the whole site, the webhook URL too. Authorize.Net retries the delivery later.

The card form shows Unable to load secure card tokenization. Please try again.: Accept.js could not be loaded. The checkout must use HTTPS, and the Public Client Key and API Login ID of the current environment must be correct.

The customer sees a general error: look at the Log field in the Advanced section; errors are always written there. A currency the account does not support is rejected by Authorize.Net.

A partial refund fails because the transaction is not settled yet: refund the full amount to void the transaction, or retry after settlement, usually within 24 hours.

Capture, void or refund fails with Authorize.Net credentials for this payment environment are missing.: the payment was made in sandbox or live mode, and the API Login ID and Transaction Key of that environment are not set. Enter them and try again.

The Refund button is missing on the credit memo: start the credit memo from the invoice (Invoices tab), not from the order page. An order without an invoice (for example On Hold after a mismatch) cannot be refunded online; refund it in the Merchant Interface.

The settings page or the checkout looks unchanged after installing or updating: run bin/magento setup:upgrade and bin/magento cache:flush; in production mode also setup:di:compile and setup:static-content:deploy.

Uninstall

Deleting the module code alone removes nothing from the database: the license key, the settings and the payment history stay. To remove the data, uninstall the module with the Magento command:

Installed with Composer: run bin/magento module:uninstall --remove-data Vibefox_AuthorizenetPayment. It removes the data and the code.

Installed in app/code: run bin/magento module:uninstall --non-composer Vibefox_AuthorizenetPayment to remove the data, then bin/magento module:disable Vibefox_AuthorizenetPayment, delete the folder app/code/Vibefox/AuthorizenetPayment and run bin/magento setup:upgrade.

The license key and license status are always removed. If Delete data on uninstall is Yes, the settings and the log are removed too. If it is No, the settings are kept for a re-install. The Authorize.Net transactions, captures, voids and refunds are always kept, so orders paid before can still be captured and refunded after a re-install. Existing orders keep their invoices, payment notes and transaction IDs.

Authorize.Net is a trademark of its respective owner. This module is not affiliated with or endorsed by Authorize.Net.