iyzico Checkout for OpenCart — card payments in Turkey with instalments

iyzico Checkout for OpenCart is a payment module for OpenCart 4 and OpenCart 3 stores that sell in Turkey through iyzico. The customer pays by card on iyzico’s secure page with 3D Secure and instalments (taksit), and the order becomes paid only after your server has asked iyzico for the result itself and checked the signature, amount, currency and basket ID.

Why another iyzico module. The official iyzico module for OpenCart is developed alongside the WooCommerce plugin, which is rated 1.7 out of 5 with complaints about orders left without a status and broken updates. We built a module where payment is confirmed by the server, a webhook rescues the order when the customer closed the tab, and disputed payments (fraud review, underpayment) never turn “paid” on their own.

What the admin gets

• Five statuses to fit your process: awaiting payment, paid, needs review (fraud review or amount mismatch), declined, refunded.
• “Check keys” — one signed request to iyzico without creating a payment.
• Pro refunds from the journal: a full refund on the day of payment goes through as a cancellation, partial ones are spread across basket items with the remaining balance tracked. An empty amount field refunds the whole remaining balance; negative and non-numeric amounts are rejected.
• Pro instalments: choose which payment options the iyzico payment page offers.

How it works, step by step

1. The customer places the order and clicks “Pay by card” at the payment step.
2. The module creates a Checkout Form in iyzico with the customer, addresses and basket. Basket items always equal the order total (shipping, discounts, taxes and rounding are balanced). The request is signed with IYZWSv2, and iyzico’s response is verified by its signature.
3. The customer pays on the iyzico page: 3D Secure, instalments, iyzico wallet.
4. iyzico sends the customer back to an address carrying the order number and an HMAC signature — nobody can swap in someone else’s order. The module asks for the result with the stored token and checks the signature, basket, currency and amount.
5. The customer’s session is not lost: OpenCart 4 sets its session cookie with SameSite=Strict, so after payment the module routes the customer through a page on your own site — the cart is emptied and the success page renders correctly.
6. If the customer closed the tab, iyzico sends a webhook signed with X-IYZ-SIGNATURE-V3, and the module confirms the order with the same server-side request.
7. Repeated responses are safe: a paid order is never rolled back, and the “payment received” line is written to the history once, even when a callback and a webhook arrive together.

Under the hood

• Its own transactions table cc_iyzico_order: token, conversationId, environment, iyzico verdict, item transactions for refunds.
• One decision point: the callback, the webhook and the re-check from the journal apply the result through the same code, so they never contradict each other.
• Repeat-payment guard: the Back button after payment won’t send a paid order to iyzico again, and a stale order in the session won’t go to the bank with an old amount.
• Settings survive saving: the licence and trial are not reset by the Save button.
• T.C. Kimlik No and keys are never written to the log, and secret keys are encrypted in the database.
• Languages: Turkish, Ukrainian, English — admin and storefront.

How to install

1. OpenCart 4: Extensions → Installer → upload cc_iyzico.ocmod.zip and click Install. OpenCart 3: Extensions → Installer → cc_iyzico-oc3-1.0.1.ocmod.zip.
2. Extensions → Extensions → Payments → iyzico Checkout (CatCode) → Install, then Edit.
3. Paste the API key and secret key from the iyzico dashboard, click “Check keys”, enable the module and save.
4. Copy the webhook URL from the settings into the iyzico dashboard → Merchant Notifications.
5. For Pro: “Try Pro” → your email for the trial, or the key after purchase.