WayForPay — card payments for OpenCart 2.3, 3.x and 4.x

WayForPay for OpenCart is a payment extension that connects WayForPay acquiring to a shop on OpenCart 3.x or 4.x. The customer pays by Visa or Mastercard on a secure WayForPay page, and everything after that is automatic: WayForPay sends a serviceUrl webhook, the module verifies the HMAC-MD5 signature and changes the order status itself. The manager doesn’t need to reconcile payments in the bank’s account against orders in the admin every morning.

The basic version is free. Download it from the official OpenCart marketplace: opencart.com/…/extension_id=48711. A Pro licence key unlocks a payment log with status reconciliation, two-step AUTH/SETTLE payment and partial and repeat refunds from the admin.

How it works, step by step

1. At checkout, the customer chooses “Card payment (WayForPay)” and confirms the order.
2. The module builds a signed request and redirects the customer to a secure WayForPay payment page — your server never sees the card details.
3. WayForPay processes the payment and sends the shop a signed serviceUrl webhook.
4. The module verifies the HMAC-MD5 signature and amount — the order automatically gets the right status in OpenCart.
5. When the customer returns to the site, the status is additionally checked with a CHECK_STATUS request — an order won’t close as “paid” unless the money has genuinely gone through.
6. With Pro: the payment log shows every transaction — status, amount, masked card, orderReference — and refunds are made from there.

How much it costs

1,490 UAH — one-off purchase. The licence is perpetual: you pay once, updates and technical support are included in the price. One key covers one domain and its subdomains.

Moving the shop to another domain — deactivate the licence on the old one and activate it on the new one yourself in the account.

The licence is perpetual — nothing expires or switches off. One key — one domain; moving the shop, deactivate the licence on the old domain and activate it on the new one yourself.

One key — one domain. Moving the shop, deactivate the licence on the old domain and activate it on the new one yourself, without contacting support.

Trial first, then payment. A fresh install is the free version: Pro doesn’t switch itself on, and nothing expires after a week. When you want to see Pro — click “Try Pro” in the module’s settings, enter your email and get a 7-day key (also sent by email). So you get to check the payment log, AUTH/SETTLE and refunds on your own shop before you buy — that’s exactly why refunds after purchase aren’t offered.

Technical requirements

• OpenCart 4.0.2 – 4.1.x (native build) or OpenCart 3.0.2 – 3.0.5.0 (a separate build included)
• PHP 8.0+
• Merchant login and secret key from the WayForPay account — only for live mode; test mode works right away without an agreement

Under the hood

• A native build for OpenCart 4.x — namespaces, Twig templates, the built-in installer. For OpenCart 3.x — a separate port, not “conditionally compatible” code.
• The secret key is never stored in plain text in the database — it’s kept obfuscated and tied to the specific installation, so an ordinary database dump won’t expose it.
• Every webhook is verified: an HMAC-MD5 signature plus an amount check — forging a “successful payment” with an outside request won’t work.
• Soft Pro gate: without a key, only updates and new features stop after the trial — Pro features keep working, and free payment acceptance keeps running.

How to install

1. In the OpenCart admin, open Extensions → Installer and upload wayforpay.ocmod.zip. For OpenCart 3.0.x use the wayforpay-oc3.ocmod.zip build from the product downloads.
2. Go to Extensions → Payments, find WayForPay and click “Install”.
3. Enable the module in the settings. Leave test mode on for testing — payment goes through the public test merchant, no real money is charged.
4. For live mode, enter the merchant login and secret key from the WayForPay account.
5. For Pro: paste the licence key from the email after payment — the extended features switch on with no reinstall.

Version history

1.1.1 — 14 August 2026 (OpenCart 3.x and 2.3 builds)

Admin refunds finally work as intended in these two builds. Previously “-500” in the amount field silently refunded the entire order total, and in the OpenCart 3 build a refund failed outright with the button doing nothing. Now an empty field means a full refund, any other value must be a number greater than zero and no larger than the remaining balance; partial refunds are tracked cumulatively and shown as a separate “Refunded” column in the log, and the order only moves to “Refunded” once the full amount has been returned. Also fixed the signature for the capture operation in two-step mode: the order history no longer shows an internal token instead of human-readable text.

1.0.6 — 2 August 2026

Fixed underpayment: a callback for an amount lower than the order is no longer stored as Approved — previously this permanently blocked the next full payment, since Approved is a final state. Now the order stays unpaid with an underpayment note, and the full payment goes through normally. The licence now survives catcode.com.ua being unreachable: a network error is no longer treated as an “invalid key” response, so Pro doesn’t switch off during an outage (the 14-day grace period finally works). Partial refunds in the log are tracked cumulatively. The trial only starts on your click, and a fresh install is a plain free version.

1.0.2 — 23 July 2026

Fixed a conflict at checkout on OpenCart 4.0.2.x: the geo-zone check no longer loads a catalog model missing in this version and no longer blocks choosing a payment or shipping method.

1.0.0 — July 2026

First public release: card payment via a secure WayForPay page, a serviceUrl webhook with HMAC-MD5 signature verification, CHECK_STATUS reconciliation on return, test mode on a public merchant; Pro — payment log, AUTH/SETTLE, full and partial refunds. Two builds: OpenCart 4.0.2–4.1.x and 3.0.2–3.0.5.0.