NETOPIA Payments for WooCommerce — card payments in Romania, Oney and PayPo

NETOPIA Payments for WooCommerce is a payment plugin for the Romanian market: the buyer pays by card on the NETOPIA page and the order in your shop confirms itself. It runs on NETOPIA API v2 — no certificate files, just the POS signature and an API key. The difference from the usual “redirect and take it on trust”: the plugin believes neither the buyer’s return nor the notification — before it marks an order paid, it verifies the notification signature and asks NETOPIA for the status itself.

What the buyer sees

The buyer then lands on the NETOPIA page, pays with Visa or Mastercard and comes back to the shop. Card details never pass through your site. If the buyer closes the tab and never returns, the order is still marked paid — from the NETOPIA notification.

What the shop owner gets

• The POS signature and an API key are all it takes to start. No certificates or key files from the old API.
• Sandbox and live side by side. Both keys are stored at once and one switch moves between them. An order remembers the environment it was paid in, so old test orders do not break once you go live.
• “Check connection” — the plugin calls NETOPIA with your key and tells you whether the key was accepted, whether it is a 401, or whether the server simply did not answer. You see a wrong key in the admin, not from a buyer.
• Order notes: payment method, NETOPIA transaction ID, masked card, authorisation code and what confirmed the payment — the notification or the status request.
• The notification (IPN) address is shown in the settings but sent to NETOPIA with every payment — there is nothing to configure in the NETOPIA admin.
• Payment page language: Romanian, English or “same as the shop”. Order status after payment is yours to choose.
• Logging into the WooCommerce log: requests and responses with the buyer’s contacts masked; the API key never reaches the log.

How it works, step by step

1. The buyer picks “Card payment (NETOPIA Payments)” at checkout, and with Pro also the method: card, Oney or PayPo. Works on both the classic and the block checkout.
2. The plugin creates the payment in NETOPIA (payment/card/start, or payment/bnpl/start for instalments) with a unique attempt number, the order amount and currency. The API key travels in the header, your POS signature in the body.
3. The buyer pays on the NETOPIA page. Oney opens through a POST form, PayPo through an ordinary redirect; both partners have to be enabled for your POS.
4. The notification (IPN) arrives at the shop with a signature. The plugin checks the Verification-token: it must be signed by NETOPIA, issued for your POS signature and match this exact message body. Faking a payment with a POST to your site does not work.
5. An unsigned or altered notification is not applied — and not silently dropped either: the plugin asks NETOPIA for the status itself. If NETOPIA does not confirm, the shop answers “try again”.
6. The buyer’s return is no proof of payment either. The plugin checks the status with an operation/status request by POS signature, transaction ID and order number.
7. Amount and currency check. If less was paid than the order costs, the order does not go to paid but to “On hold” with a note for the manager. A currency that does not match is ignored.
8. The order moves to “Processing” (or the status you chose), stock is reduced and WooCommerce emails the buyer.
9. A repeat attempt (card declined, the buyer pressed “Pay” again): the plugin first checks whether an earlier attempt was already paid and only then creates a new one — so one order is never charged twice.
10. With Pro you can refund from the order screen — in full or in parts, within the amount that was paid.

Under the hood

• The notification signature is really verified. The Verification-token is an RSA-signed JWT: the plugin demands RS256/384/512, NETOPIA as the issuer, your POS signature as the audience and the sha512 of the exact message body. Tokens with alg: none, or “symmetrically” signed with your own public key, are rejected.
• The status comes only from the NETOPIA API. The buyer’s return, the thank-you page, an unsigned notification and the “Check” button all lead to the same place: an operation/status request.
• Protection against double confirmation: the notification and the buyer’s return often arrive at the same moment. A database-level lock and a re-read of the order (HPOS cache included) guarantee one “payment received” note and one stock reduction.
• Late statuses never undo a payment: a belated “declined” from an older attempt will not fail a paid order.
• Tampering with the method does not work: switch the checkout choice to Oney for an amount outside the limits and the server refuses.
• Its own gateway id (cc_netopia) and its own settings: the plugin does not clash with NETOPIA’s official module if that one is installed too. Show only one of them at checkout.
• API keys are stored encrypted in the database and never reach the logs.
• A Pro gate that does not brick anything: when the trial ends, only the Pro features stop — card payments keep working.

How to install

1. Plugins → Add New → Upload Plugin: pick netopia-for-woocommerce-1.0.1.zip and activate it.
2. WooCommerce → Settings → Payments → NETOPIA Payments.
3. Enter the POS signature (admin.netopia-payments.com → Points of sale → ⋮ → Technical settings) and the sandbox API key (sandbox account → Profile → Security), then save.
4. Press “Check connection” and place a test order with a NETOPIA sandbox card.
5. Ask NETOPIA to validate the integration. Once the POS is activated, enter the live key and switch sandbox mode off.
6. For Pro: paste the licence key from the email you get after payment, or start the 7-day trial.