Przelewy24 & BLIK Payments for WooCommerce — bank transfer, card and BLIK payments in Poland

Przelewy24 & BLIK Payments for WooCommerce is a payment plugin for the Polish market. The buyer pays by bank transfer, card or BLIK through Przelewy24, and the order in your shop is confirmed by itself. The plugin runs on the Przelewy24 REST API v1 and takes neither the buyer’s return nor a notification at its word: a payment counts only after the signature check and a transaction/verify request, as Przelewy24 requires.

What you need. A Przelewy24 merchant account — Przelewy24 issues the merchant ID, CRC key and API key once your shop is registered. The BLIK code right at checkout (Pro) works only if Przelewy24 has enabled that service (BLIK level 0) for your account; otherwise the code field hides itself and BLIK goes through the Przelewy24 page.

What the buyer sees

Without Pro, after “Place order” the buyer lands on the Przelewy24 page, picks a bank, a card or BLIK and comes back to the shop. Card and bank details never pass through your site. If the buyer closes the tab and never returns, the order still becomes paid — from the Przelewy24 notification.

What the admin gets

• Merchant ID, POS ID, CRC key and API key — everything you need to start. Where to find them in the Przelewy24 panel is explained right in the plugin settings.
• Sandbox and live side by side. Both sets of keys are stored at once, with one switch. An order remembers the environment it was paid in.
• “Check connection” — the plugin calls Przelewy24 with your keys and tells you whether they were accepted. You see a wrong key in the admin, not from a buyer.
• The notification address is sent to Przelewy24 with every payment — nothing to set up in the Przelewy24 panel.
• Przelewy24 page language, time to pay, order status after payment — your choice.
• Order notes: payment method, Przelewy24 transaction number, amount, and what confirmed the payment.
• Debug log in the WooCommerce log: buyer contacts are masked, keys are never written.

How it works — step by step

1. At checkout the buyer picks Przelewy24 or BLIK. With Pro, also a specific bank from your account’s methods, or types a BLIK code. Works on both the classic and the block checkout.
2. The plugin registers a transaction with Przelewy24 (transaction/register) with a unique session number, the order amount and currency and a SHA-384 signature on the CRC key.
3. The buyer pays on the Przelewy24 page. For the BLIK code at checkout (Pro) the plugin passes the code to Przelewy24 (chargeByCode) and the buyer confirms in the banking app.
4. A notification arrives at the shop. The plugin checks the SHA-384 signature, merchant ID, POS ID, amount and currency. Faking a payment by POSTing to the site does not work.
5. Confirmation. The plugin calls transaction/verify — without it Przelewy24 does not settle the money to the merchant. Only after a successful verify does the order become paid.
6. The buyer’s return is not proof of payment. The plugin asks Przelewy24 for the status itself (transaction/by/sessionId). The order page waits for the confirmation and refreshes on its own.
7. Amount check. If less was paid than the order costs, it does not become paid but goes “On hold” with a note.
8. The order moves to “Processing” (or the status you chose), stock is reduced, the buyer gets the WooCommerce email.
9. A repeat attempt (the buyer cancelled and pressed “Pay again”): the plugin checks the earlier sessions first and only then creates a new one.
10. With Pro you can refund from the order screen (transaction/refund) — in full or in part; the refund result from Przelewy24 is written to the notes.

Under the hood

• The signature is really checked. SHA-384 over the JSON of the notification fields and your CRC key, plus merchant ID, POS ID, amount and currency matching the order session. An unsigned or foreign notification is not applied — it only prompts the plugin to ask Przelewy24 for the status itself.
• transaction/verify is mandatory. An order does not become paid until Przelewy24 confirms the verify.
• No double confirmation: the notification and the buyer’s return often arrive at the same moment. A database lock and re-reading the order (HPOS cache included) give one “payment received” note and one stock reduction.
• A second payment for an already paid order is not confirmed automatically — the manager sees a note and decides in the Przelewy24 panel.
• A swapped payment method does not get through: if a method that is not active on the account is injected at checkout, the server refuses it.
• Own gateway ids (cc_przelewy24, cc_przelewy24_blik) and own settings: no conflict with the official Przelewy24 module.
• The CRC key and API key are stored encrypted (AES-256) and never reach the logs.
• A Pro gate that never bricks the shop: when the trial ends, only the Pro features stop, while accepting payments carries on.

How to install

1. Plugins → Add New → Upload Plugin: choose przelewy24-blik-woocommerce-1.0.0.zip and activate it.
2. WooCommerce → Settings → Payments → Przelewy24.
3. Enter the merchant ID, POS ID (if different), CRC key and API key of the sandbox account, save and press “Check connection”.
4. Place a test order in the sandbox.
5. Enter the live keys and switch the test mode off.
6. If you want, enable the separate “BLIK (Przelewy24)” method in the payments list.
7. For Pro: paste the licence key from the email you get after payment, or start the 7-day trial.