iyzico Checkout for WooCommerce — card payments in Turkey with instalments

iyzico Checkout for WooCommerce is a payment plugin for stores that sell in Turkey through iyzico. The customer pays by card on iyzico’s secure page with 3D Secure and instalments (taksit), and the order is confirmed only after your server has asked iyzico for the result itself and checked its signature, amount, currency and basket. Not the customer’s browser, not a URL parameter, but a signed response from iyzico.

Why another iyzico plugin. The official iyzico plugin for WooCommerce runs on 10,000 sites and is rated 1.7 out of 5: reviews complain about HPOS incompatibility, a white screen after updates and orders that get stuck without a status. We built the plugin around four things that must always work: server-side payment verification, a webhook for when the tab is closed, HPOS and the block checkout.

What the admin gets

• iyzico sandbox — you test the integration on test keys before any real money moves.
• “Check keys” — one signed request to iyzico without creating a payment. You find out about wrong keys in the admin, not from a customer.
• iyzico fraud review: a payment under review puts the order On hold with a “do not ship” note. Once iyzico approves it, the webhook moves the order to paid.
• Pro refunds from the order screen: a full refund on the day of payment goes through as a cancellation (nothing shows on the customer’s statement), partial refunds are spread across basket items, keeping track of how much has already been refunded.
• Pro instalments: choose which options (tek çekim, 2, 3, 6, 9, 12 taksit) the payment page offers and, if you like, add the instalment fee to the order as a separate line.

How it works, step by step

1. At checkout the customer chooses card payment via iyzico and places the order.
2. The plugin creates a Checkout Form in iyzico: customer, addresses, basket. Basket items always add up to the order total to the cent (discounts, shipping and rounding are balanced), so iyzico never rejects the request over an amount mismatch. The request is signed with IYZWSv2 (HMAC-SHA256), and iyzico’s response is verified by its signature.
3. The customer pays on the iyzico page: 3D Secure, instalments, iyzico wallet.
4. iyzico sends the customer back with a token. The plugin does not trust that token: it finds the order by number and key, asks iyzico for the result with the stored token and checks the signature, token, basket ID, currency and amount.
5. The order moves to Processing (or Completed) with the Payment ID, instalments and card in a note.
6. If the customer closed the tab, iyzico sends a webhook signed with X-IYZ-SIGNATURE-V3. The plugin checks the signature and asks for the result the same way — the order won’t be left pending.
7. A callback and a webhook arriving together won’t record the payment twice: the result is applied under a database-level lock.

Under the hood

• Server-side result verification: the HMAC-SHA256 signature of iyzico’s response (paymentStatus, paymentId, currency, basket, conversationId, amounts, token) is checked against your secret key.
• The token from the browser is never used for confirmation — only the one stored when the payment was created.
• V3 webhook with signature verification; an unsigned or forged request gets 401 and changes nothing.
• Idempotency: a paid or refunded order is never rolled back by a late response, and double confirmation is blocked at the database level.
• Refund accounting per item transaction: iyzico never receives a request for more than the remaining balance.
• T.C. Kimlik No is not stored on the order or written to the log — it is only passed on to iyzico.
• Secret keys are encrypted in the database and never reach the log.
• Translations: Turkish, Ukrainian, English.

How to install

1. Plugins → Add New → Upload Plugin: choose catcode-iyzico-checkout-for-woocommerce-1.0.2.zip and activate it.
2. WooCommerce → Settings → Payments → iyzico Checkout (CatCode).
3. Paste the API key and secret key from the iyzico dashboard → Settings → Merchant Settings (for testing, the sandbox keys with the sandbox- prefix).
4. Click “Check keys” and save.
5. Copy the webhook URL at the bottom of the settings into the iyzico dashboard → Merchant Notifications.
6. For Pro: paste your licence key or start the 7-day trial.