LiqPay — Card Payments for OpenCart 2.3, 3.x and 4.x

LiqPay for OpenCart is a payment module that accepts card payments (Visa/Mastercard, Apple Pay and Google Pay) through the secure LiqPay payment page. Once the customer pays, LiqPay sends a signed serviceUrl webhook, the module verifies the SHA1 signature and moves the order to the correct status itself. There’s no manual “paid or not” reconciliation — the status only changes once the money has actually gone through.

How it works — step by step

1. At checkout the customer chooses “Card payment (LiqPay)” and confirms the order.
2. The module builds a signed request and redirects the customer to the secure LiqPay payment page — card, Apple Pay or Google Pay. Card details are entered on LiqPay’s side and never reach your store.
3. After payment, LiqPay sends a serviceUrl webhook to the extension/liqpay/payment/liqpay.callback route. The module verifies the SHA1 signature against the raw request body and sets the order to the chosen “paid” status.
4. When the customer returns to the store, the status is additionally reconciled via the Status API — the order is only completed if the transaction genuinely succeeded.
5. With Pro: under the two-stage scheme, funds are only held (AUTH), and captured (SETTLE) automatically once you move the order to the “paid” status. Refunds — full or partial — are issued from the payment log.

Installation

1. Admin panel → Extensions → Installer → upload liqpay.ocmod.zip and click “Install”.
2. Admin panel → Extensions → Payment → find LiqPay and click “+” (this creates the module’s table, event and permissions).
3. Click “Edit”: enable the module, enter the keys from your LiqPay account. For testing, leave “Test mode” on and enter a pair of keys with the sandbox_ prefix.
4. There’s no need to register a webhook URL in your LiqPay account — the module passes it with every payment.

Under the hood

• The signature is verified against the raw request body — OpenCart HTML-escapes POST data, so the webhook reads `php://input` directly; otherwise the signature wouldn’t match.
• Double payment verification: a signed webhook plus a Status API reconciliation when the customer returns.
• Idempotency — a repeated webhook doesn’t change the status a second time and doesn’t downgrade an already-confirmed order.
• The private key is encrypted with a key derived from the store’s path and database name — settings copied to another site won’t decrypt.

LiqPay is a trademark of JSC CB “PrivatBank”. This module is an independent integration and is not affiliated with LiqPay or PrivatBank.