iyzico Checkout for OpenCart — card payments in Turkey with instalments

iyzico Checkout for OpenCart is a payment module for OpenCart 4 and OpenCart 3 stores that sell in Turkey through iyzico. The customer pays by card on iyzico’s secure page with 3D Secure and instalments (taksit), and the order becomes paid only after your server has asked iyzico for the result itself and checked the signature, amount, currency and basket ID.

Why another iyzico module. The official iyzico module for OpenCart is developed alongside the WooCommerce plugin, which is rated 1.7 out of 5 with complaints about orders left without a status and broken updates. We built a module where payment is confirmed by the server, a webhook rescues the order when the customer closed the tab, and disputed payments (fraud review, underpayment) never turn “paid” on their own.

The base version is free. Taking payments, signature verification, webhooks and a separate status for payments under review work without a licence. Pro adds a payment journal with refunds and same-day cancellation, plus instalment control.

Live demo

Our OpenCart 4.1 and OpenCart 3.0.5 demo stores show the module in test mode: iyzico’s responses are simulated there and no money is taken from the card. In this mode we ran installing the archive with the standard installer, guest checkout, payment, a bank decline, a fraud review, a forged signature, a webhook without the customer returning, and a refund from the journal. The screenshots below are from OpenCart 4.1. Real iyzico payments are verified once you connect your own merchant account: first with iyzico sandbox keys, then with live ones.

What the buyer sees

What the admin gets

• Five statuses to fit your process: awaiting payment, paid, needs review (fraud review or amount mismatch), declined, refunded.
• “Check keys” — one signed request to iyzico without creating a payment.
• Pro refunds from the journal: a full refund on the day of payment goes through as a cancellation, partial ones are spread across basket items with the remaining balance tracked. An empty amount field refunds the whole remaining balance; negative and non-numeric amounts are rejected.
• Pro instalments: choose which payment options the iyzico payment page offers.

How it works, step by step

1. The customer places the order and clicks “Pay by card” at the payment step.
2. The module creates a Checkout Form in iyzico with the customer, addresses and basket. Basket items always equal the order total (shipping, discounts, taxes and rounding are balanced). The request is signed with IYZWSv2, and iyzico’s response is verified by its signature.
3. The customer pays on the iyzico page: 3D Secure, instalments, iyzico wallet.
4. iyzico sends the customer back to an address carrying the order number and an HMAC signature — nobody can swap in someone else’s order. The module asks for the result with the stored token and checks the signature, basket, currency and amount.
5. The customer’s session is not lost: OpenCart 4 sets its session cookie with SameSite=Strict, so after payment the module routes the customer through a page on your own site — the cart is emptied and the success page renders correctly.
6. If the customer closed the tab, iyzico sends a webhook signed with X-IYZ-SIGNATURE-V3, and the module confirms the order with the same server-side request.
7. Repeated responses are safe: a paid order is never rolled back, and the “payment received” line is written to the history once, even when a callback and a webhook arrive together.

Pricing

990 UAH — one payment, a perpetual licence. No annual fees: the module and its Pro features stay yours. One licence covers the builds for OpenCart 4.x and OpenCart 3.x.

Trial first, payment later. A free 7-day Pro trial is switched on in the module settings with your email, no card required. A fresh install is the clean Free version; nothing switches on by itself.

Technical requirements

• OpenCart 4.x (tested on 4.1.0.3) or 3.0.x (tested on 3.0.5.0)
• PHP 8.0+ for OpenCart 4, 7.3+ for OpenCart 3 (tested on PHP 8.2); the cURL extension
• Order currency: TRY, USD, EUR, GBP, NOK, CHF, RUB or IRR — for other currencies the payment method is not shown.
• An iyzico merchant account for real payments; for testing, the free sandbox at sandbox-merchant.iyzipay.com.

Under the hood

• Its own transactions table cc_iyzico_order: token, conversationId, environment, iyzico verdict, item transactions for refunds.
• One decision point: the callback, the webhook and the re-check from the journal apply the result through the same code, so they never contradict each other.
• Repeat-payment guard: the Back button after payment won’t send a paid order to iyzico again, and a stale order in the session won’t go to the bank with an old amount.
• Settings survive saving: the licence and trial are not reset by the Save button.
• T.C. Kimlik No and keys are never written to the log, and secret keys are encrypted in the database.
• Languages: Turkish, Ukrainian, English — admin and storefront.

How to install

1. OpenCart 4: Extensions → Installer → upload cc_iyzico.ocmod.zip and click Install. OpenCart 3: Extensions → Installer → cc_iyzico-oc3.ocmod.zip.
2. Extensions → Extensions → Payments → iyzico Checkout (CatCode) → Install, then Edit.
3. Paste the API key and secret key from the iyzico dashboard, click “Check keys”, enable the module and save.
4. Copy the webhook URL from the settings into the iyzico dashboard → Merchant Notifications.
5. For Pro: “Try Pro” → your email for the trial, or the key after purchase.

Version history

1.0.0 — September 2026

First release for OpenCart 4.x and 3.x: iyzico Checkout Form with server-side signature verification, V3 webhooks, a “needs review” status for fraud review and mismatches, balanced basket, T.C. Kimlik No field, tr/uk/en languages. Pro: payment journal, refunds and same-day cancellation, instalment control.