=== CatCode Afterpay, Clearpay and Zip Payments for WooCommerce ===
Contributors: catcodestudio
Tags: afterpay, clearpay, zip, buy now pay later, payment gateway
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Afterpay, Clearpay (UK) and Zip (Australia) for WooCommerce: pay in instalments, captured through the API, on-site messaging, block checkout, HPOS.

== Description ==

Two buy now, pay later methods in one plugin, for shops in Australia, New Zealand and the UK (Afterpay also serves the US and Canada):

* **Afterpay / Clearpay** — the buyer pays in 4 interest-free instalments; Clearpay is the name Afterpay trades under in the UK, and the plugin shows the right brand by itself (GBP = Clearpay).
* **Zip** — Zip Pay and Zip Money for buyers in Australia.

You receive the full amount from the service; the buyer pays it off. The plugin is built around one rule: an order is marked paid only when the payment service itself has captured the payment.

* **Captured through the API, not trusted from the browser** — after the buyer approves, the plugin captures the payment on the server (Afterpay `payments/capture`, a Zip charge) and marks the order paid only from that answer. The query string the buyer comes back with only picks which attempt to look at.
* **Nothing charged by mistake** — both services charge nothing until the shop captures. If the order was cancelled meanwhile, another attempt already paid it, the buyer moved to another payment method, or the total changed after the checkout was opened, the plugin simply does not capture.
* **No double e-mails, no double stock reduction** — the buyer's return, the thank-you page and the re-check can arrive in the same second; a database lock and a fresh read of the order apply each payment exactly once (HPOS order cache included). Captures are idempotent, so a retry after a lost answer cannot charge twice.
* **Retries that just work** — every attempt is its own checkout. When the buyer places the order again, the previous attempt is looked at first: if it was approved meanwhile, the order is settled with it instead of opening a second payment.
* **A buyer who cancels keeps the cart** — they land on the order page with a clear message and can try again or choose another method; the order shows "Failed" with a note.
* **Zip applications under review** — a buyer whose application Zip refers for review sees that their order is saved; "Re-check the Zip payment" charges it once Zip approves.
* **On-site messaging** — Afterpay's own On-Site Messaging ("4 payments of …") and Zip's own widget on the product page (following the chosen variation) and on the classic and block cart.
* **Shown only when it can work** — each method hides for currencies its account does not take, for billing countries outside its region, and for totals outside the limits (Afterpay limits are read from your account and cached; Zip limits are set in the settings).
* **"Re-check the payment"** in the order actions — one click asks the service and settles the order.
* **"Check connection"** — shows your Afterpay order limits and MPID, or that Zip accepted the key, without creating a payment.
* Classic and block checkout, block themes, HPOS compatible, "Processing" or "Completed" after payment, debug log without secrets. Secret keys are stored encrypted.

// @pro-begin
= Pro =

The Pro version is sold on [catcode.com.ua](https://catcode.com.ua/modules/catcode-afterpay-zip-payments-for-woocommerce/), with a 7-day trial that never starts by itself. One licence covers both methods:

* **Refunds from the order screen** — full or partial, through the Afterpay refund API or Zip refunds; partial refunds are counted, so the service is never asked for more than the payment still holds.
* **Delayed capture** — authorise at checkout and charge when the order ships: automatically when the order reaches the status you choose, or from the order actions. Cancelling the order releases the authorisation. Afterpay keeps an authorisation for 13 days.
* **Payment watchdog** — every 15 minutes the plugin re-checks unpaid orders of the last 48 hours, so a payment the buyer approved before closing the tab still gets captured (Afterpay allows that for 3 hours after the checkout opened), and a Zip application approved after review gets charged. Held payments are followed too: you get a warning a day before an authorisation ends.
* **Exclude categories** — no Afterpay or Zip and no messaging for the products you choose.
* **Payment journal** — every payment of both methods with payment id, amount, refunds, held payments and when they run out, and a one-click re-check.

The licence runs for 1-5 years and includes updates and support for that term; a purchased licence keeps its Pro features after the term ends.
// @pro-end

Afterpay, Clearpay and Zip are trademarks of their owners. This plugin is an independent integration made by CatCode; it is not an official Afterpay, Clearpay or Zip plugin and is not affiliated with or endorsed by them.

== Installation ==

1. Upload the plugin and activate it.
2. WooCommerce → Settings → Payments → **Afterpay / Clearpay (CatCode)** and/or **Zip (CatCode)**.
3. Afterpay: enter the Merchant ID and Secret Key (sandbox ones in test mode). Zip: enter the private key (and, optionally, the public key for the widget). Press "Check connection".
4. Enable the method and place a test order.
5. To go live, switch test mode off, enter the live credentials and save.

== Frequently Asked Questions ==

= Do I need an Afterpay or Zip account? =
Yes. Afterpay gives each merchant a Merchant ID and Secret Key per region, and sandbox credentials through your Afterpay account manager. Zip gives each merchant a private key; sandbox keys are issued by Zip on request.

= Which countries and currencies? =
Afterpay: the account currency — AUD (Australia), NZD (New Zealand), GBP (UK, shown as Clearpay), USD (US) or CAD (Canada) — has to be the shop currency, and the method shows for billing addresses in that country. Zip: AUD and Australian billing addresses. Developers can change the countries with the `catcode_apz_countries` filter.

= How do I test Afterpay? =
With sandbox credentials and test mode on, create a test account during the Afterpay checkout (unique e-mail and phone; the SMS code in the sandbox is 111111) and pay with Afterpay's test card Visa 4111 1111 1111 1111, expiry 01/28, CVV 000 (CVV 051 tests a declined payment).

= I use the official Afterpay, Clearpay or Zip plugin. =
Deactivate it before enabling the same method here, so the checkout does not show it twice. Orders it started stay with it.

= An order stayed "Pending payment" although the buyer paid. =
Open the order and pick "Re-check the … payment" in Order actions. Afterpay accepts the capture of an approved checkout for 3 hours after it was opened.
// @pro-begin
The Pro watchdog re-checks such orders by itself.
// @pro-end

= Why is the method missing at checkout? =
The shop currency is not the account currency, the billing country is outside the account's region, the total is outside the limits, or no credentials are saved for the current mode. "Check connection" shows the Afterpay limits.

= The messaging does not appear. =
Afterpay messaging needs your MPID, which "Check connection" reads from Afterpay; you can also enter it by hand. Both scripts load from the services (js.squarecdn.com, static.zip.co), so a strict Content-Security-Policy has to allow them.

= How do refunds work? =
// @pro-begin
With a Pro licence, Refund → the refund button of the method on the order screen. Without it, and for refunds made in the portal:
// @pro-end
Refund the payment in the Afterpay Business Hub or the Zip merchant portal, then record the refund on the order in WooCommerce.

== External services ==

This plugin connects to the payment services the shop owner chooses:

* Afterpay / Clearpay Online API (global-api.afterpay.com, in test mode global-api-sandbox.afterpay.com) — when a buyer chooses Afterpay or Clearpay, to open the checkout: the order total, tax, shipping, discounts and items (name, SKU, quantity, price, product and image address), the buyer's name, e-mail, phone, billing and shipping address, the order number and the shop's return addresses. Afterwards to capture the payment and read it back, and to read the account's order limits and public id (also when you press "Check connection").
* Afterpay On-Site Messaging (js.squarecdn.com, in test mode js-sandbox.squarecdn.com) — loaded on product and cart pages unless switched off in the settings; it receives the amount, the currency, the SKUs and category names of the product or cart, and your merchant public id.
* Zip Merchant API (merchant-api.com, in test mode sand.merchant-api.com) — when a buyer chooses Zip, to open the checkout with the same order and buyer data as above, then to create and read the charge, and when you press "Check connection".
* Zip widget (static.zip.co) — loaded on product and cart pages unless switched off in the settings; it receives the amount and your Zip public key.
// @pro-begin
* CatCode licence server (catcode.com.ua) — only when the owner activates a key or starts the trial, and periodically while a key is stored: the key and the site address are sent (plus the e-mail typed for a trial). Updates are checked there with the same key. Privacy policy: https://catcode.com.ua/privacy/
// @pro-end

The terms of use and privacy policies of the services are published on their websites: afterpay.com, clearpay.co.uk and zip.co.

== Changelog ==

= 1.0.0 =
* First release: Afterpay / Clearpay and Zip gateways, a checkout per attempt with redirect to the payment page, capture through the API on the buyer's return or the thank-you page, amount, currency, cancelled order, paid order and changed method checked before the capture, payment lock, idempotent captures, Afterpay limits and MPID from the account, Zip limits in the settings, Zip referred applications, on-site messaging on product and cart pages, "Re-check the payment" order action, connection check, test mode, block checkout, HPOS, encrypted secrets.
// @pro-begin
* Pro: refunds from the order screen, delayed capture, payment watchdog, excluded categories, payment journal, updates from catcode.com.ua.
// @pro-end
