iPay.ua for WooCommerce — card payments via internet acquiring

iPay.ua for WooCommerce is a payment plugin that accepts card payments through iPay.ua internet acquiring (Checkout API). The customer goes to the secure iPay.ua page, pays with a Visa or Mastercard card, and the order in your store confirms itself. The plugin doesn’t take a notification at its word: for every one it separately asks iPay.ua for the payment status and checks the amount, so nobody can “pay” an order with a forged request.

What the customer sees

If the payment fails, the customer clicks “Return to the site” and lands on the order payment page with an explanation and the option to try again or pick another method. The order isn’t lost.

What the admin gets

• “Check credentials” — the plugin sends a signed status request for a non-existent payment. iPay.ua confirms valid credentials and rejects invalid ones, and no payment is created.
• Sandbox at sandbox-checkout.ipay.ua with the test cards from the iPay.ua documentation — you test the integration before real money moves.
• Notification URL is shown at the bottom of the settings — send it once to your iPay.ua manager, because iPay.ua configures the notification address on its side.
• Order status after payment is your choice: “Processing” or straight to “Completed”.

How it works, step by step

1. At checkout the customer picks “Card payment (iPay.ua)” and places the order.
2. The plugin creates a payment in iPay.ua (PaymentCreate) with the amount in kopecks, the description “Order No. …”, a unique ext_id and return links. The request is signed with your key using HMAC-SHA512.
3. The customer pays on the secure iPay.ua page. Card data never passes through your site.
4. iPay.ua sends a notification. The plugin checks the signature and then makes a separate Status request to iPay.ua for the real payment state — and only then updates the order. The amount from iPay.ua is compared with the order total: if less was paid, the order goes “On hold” with a note.
5. The customer returns to the store — the status is checked once more, so “Order received” only appears when the money has actually arrived.
6. Background reconciliation every 10 minutes picks up payments whose notification never arrived: for example, while iPay.ua hasn’t yet connected your notification URL.
7. With Pro refunds are made right from the order screen: on the payment day as a cancellation (Reversal), on later days as a refund (Refund), full or partial.

Under the hood

• A notification is only a trigger. The Checkout API signature covers only the “salt”, not the notification body, so the plugin never takes the status from the request body: the order changes only on iPay.ua’s answer to a Status request. An intercepted and altered notification pays for nothing.
• Double-payment protection. The notification, the customer’s return and the background reconciliation can arrive in the same second — an atomic lock guarantees a single “payment received” note and a single stock reduction. The “Back” button after paying doesn’t create a second payment.
• Final statuses never roll back: a late “failed” response won’t turn a paid order into an unpaid one.
• The signing key is stored encrypted in the database, and re-saving the settings doesn’t corrupt it, even when the key contains special characters.
• The fiscal receipt adds up to the kopeck: lines are built from order line totals with discounts, shipping and fees, and the rounding difference is accounted for explicitly.
• Safe XML parsing with no external entities and no network requests.
• A Pro gate that doesn’t brick the store: when the trial ends, only the Pro features stop and accepting payments keeps working; after a paid license term ends, Pro keeps working and only updates and support stop.

How to install

1. Plugins → Add New → Upload Plugin: choose ipay-ua-for-woocommerce-1.0.2.zip and activate it.
2. Open WooCommerce → Settings → Payments → iPay.ua.
3. For testing, enable “Sandbox” and enter the test Merchant ID and signing key from iPay.ua. Save and click “Check credentials”.
4. Copy the notification URL from the bottom of the settings page and send it to your iPay.ua manager.
5. For real payments, disable the sandbox, enter the live Merchant ID and signing key, save and check the credentials again.
6. For Pro: paste the license key from the email you get after payment into the license field, or start the 7-day trial.