NovaPay for OpenCart — card payment via online acquiring

NovaPay Acquiring is a NovaPay online acquiring module for OpenCart 2.3, 3.x and 4.x. The customer pays by card on a secure NovaPay page, and the store receives a signed notification (postback) and moves the order to paid automatically — no manual statement reconciliation needed.

How it works

At the payment step the customer clicks “Pay by card” — the module opens a NovaPay payment session and takes them to the payment page with the order amount and cart. After payment, NovaPay sends a postback signed with its key; the module verifies the signature, checks the amount against the order and sets the status to “Paid”. If the postback doesn’t arrive (firewall, maintenance) the status is pulled as soon as the customer returns to the store, or via the “Reconcile” button in the journal.

What you need to get running

An online acquiring agreement with NovaPay: they issue a merchant ID and accept your public key part, and give you their public key for verifying postbacks. Live and test keys are different. The module only accepts payment in UAH: if the cart is in another currency, the payment method simply isn’t shown, so the wrong amount is never charged.

Installation

OpenCart 4.x — Extensions → Installer → upload the zip, then Extensions → Payments → NovaPay → “Install” and “Edit”. OpenCart 3.x — the same way, via Extensions → Installer. OpenCart 2.3 — the built-in installer requires FTP to be enabled, so it’s simpler to unpack the contents of upload/ into the store root, then Extensions → Payments → NovaPay → “Install”.

Why the store needs this

NovaPay is Nova Poshta’s acquiring service, and for a store that already ships with Nova Poshta this is the shortest path: one counterparty for both delivery and payment, one reconciliation, one manager on the other end.

Technically it’s still a regular payment gateway, and it carries the usual risks: the postback may not arrive, the customer may close the tab on the bank’s page, and the order has to close correctly either way.

Under the hood

The postback signature is verified before the module does anything with the order — that’s not optional: without the NovaPay public key, postbacks are rejected. Next the module checks the amount: a smaller amount is not recorded as payment.

When the shopper returns to the shop, the module requests the status from NovaPay separately, so the order still closes when the postback gets lost along the way, and a repeated postback doesn’t create a duplicate.

The OpenCart core isn’t patched — everything runs through standard events, so store updates never overwrite the module.