What it does

Braintree card and PayPal payments for CS-Cart, CS-Cart Ultimate, Multi-Vendor and Multi-Vendor Ultimate. You use your own Braintree merchant account. Card numbers are typed into fields hosted by Braintree and never reach your server; cards go through 3D Secure 2. Built on the Braintree JavaScript SDK (Hosted Fields) and the GraphQL API, not on the Drop-in UI that Braintree deprecated in October 2026. Braintree charges its own fees; the add-on has none per transaction.

What it changes for your store

An order is paid only after Braintree confirmed the transaction with the right amount and order total.
A timeout never loses a payment or charges twice. The payment is looked up and booked when it lands.
A card that skipped 3D Secure is refused before it is charged.
Capture when you ship, partial refunds, void in one click.
Disputes arrive by signed webhook on the order tab.
Multi-Vendor. One payment per cart with refunds per vendor order, or direct payments to vendors.

How it works

Admin: enter the merchant ID and API keys of your Braintree sandbox, run Save and test (it lists your merchant accounts and currencies), add a payment method with the Braintree processor, paste the webhook URL into the Control Panel, then switch to production keys. The order page has a Braintree tab with capture, void, refund and read back.

Shopper: places the order, pays by card or PayPal on the pay page and lands on the order confirmation.

Tested against a stand-in built from the published API docs, not yet against the real Braintree sandbox.

Features

Braintree Hosted Fields for cards, 3D Secure 2 with a server-side liability check, PayPal through the same Braintree account
Card or PayPal is read from Braintree before the charge, never taken from the browser
Charge at once, or authorize and capture at an order status or by hand; void at the cancel status
Full and partial refunds, several times, up to the captured amount
Idempotency key stored before every charge, capture, void and refund; unclear answers are looked up and read back, never sent twice
Amount mismatch, second payments and payments of cancelled orders are voided or refunded, never booked as paid
Merchant accounts per currency, other currencies charged in your default account at the store rate
Exact amounts for zero and three decimal currencies (JPY, KRW, BHD)
Signed webhooks for disputes and settlement, applied once; cron recovery
API keys stored encrypted, never shown again; keys and personal data masked in the log
Built for the 4.21 full page cache: the pay page, payment return and webhook are never cached
Multi-Vendor: owner payments with per-vendor refunds and one capture for every vendor order, or direct payments to each vendor's own Braintree account

What you get

Package	kv_braintree-1.0.0.zip, installed through Add-ons → Manage add-ons
Updates & support	12 months included. Download new versions from your account and install them in Add-ons → Manage add-ons or the Upgrade Center.
License	1 production installation. Staging, dev and localhost are free and unlimited. The add-on keeps working after the update period ends. How licensing works

Compatibility

We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.

CS-Cart version and edition compatibility
CS-Cart version	CS-Cart	CS-Cart Ultimate	Multi-Vendor	Multi-Vendor Ultimate
4.22 and later	Testing next	Testing next	Testing next	Testing next
4.21.2	Supported	Supported	Supported	Supported
4.20.x	Supported	Supported	Supported	Supported
4.19.x	Supported	Supported	Supported	Supported
4.18.x	Supported	Supported	Supported	Supported
4.17.2	Supported	Supported	Supported	Supported
Before 4.17.2	Not supported	Not supported	Not supported	Not supported

Requirements

Core changes	None. Hooks and template overrides only

1.0.0

Nov 8, 2026

Latest

Added 12

Initial release for CS-Cart, CS-Cart Ultimate, Multi-Vendor and Multi-Vendor Ultimate 4.17.2 to 4.21.x (PHP 7.4 to 8.3).
Braintree GraphQL API (no SDK bundled) and the Braintree JavaScript SDK 3.147.0: Hosted Fields for cards, 3D Secure 2, PayPal Checkout, Data Collector, on a pay page of the store after the order is placed.
Charge at once or authorize; capture at an order status or by hand (a lower amount leaves the rest uncollected); void at the void status or Declined; full and partial refunds; refund at an order status.
The nonce is read from Braintree before the charge: its real type decides card or PayPal (a card posted as PayPal is refused), the cards / PayPal switches and the 3D Secure liability rule apply to that type.
Charges without a clear answer are never closed as failed: kept pending (cart and saved cart emptied), looked up by their unique orderId and booked by the cron when they land, for 24 hours; a second try with the same apiRequestKey only after a finished retryable answer.
Captures, voids and refunds stored with their own apiRequestKey before the call; an unclear answer, and an error answer to a resend, stay "unconfirmed" until a read-back decides.
An order is booked as paid only when amount, currency, merchant account, orderId and the current order total match; otherwise the payment is voided or refunded and flagged. Second payments and payments of cancelled orders are given back too.
Merchant accounts per currency (read by Test connection); other currencies charged in the default merchant account at the store rate; exact ISO 4217 amounts.
Signed webhooks (bt_signature / bt_payload, the official SDK's algorithm), applied once; disputes recorded with an optional order status.
Multi-Vendor: owner mode with one payment per cart, refunds per vendor order share and one capture for every vendor order that is not cancelled; owner mode off with each vendor's own Braintree account (direct payments).
Connection page with sandbox and production keys (private key encrypted), job queue, cron, log with CSV export, payments list, order tab.
Payment records are kept on uninstall unless "Delete payment records on uninstall" is ticked; Upgrade Synchronizer for in-place updates.

Why a pay page after the order, and not card fields on the checkout page?

The order (and its total) exists before anything is charged, so the amount that 3D Secure authenticates and the amount that is charged are the same, the CS-Cart checkout keeps working with every theme and one-step checkout add-on, and a repay of an unpaid order uses the same page.

Why Hosted Fields and not the Drop-in UI?

Braintree's Drop-in overview says: "Starting October 1, 2026, the Drop-in SDK will be deprecated", and asks merchants to migrate to the Braintree JavaScript SDK. Hosted Fields is part of that SDK.

Do card numbers touch my server?

No. They are typed into iframes hosted by Braintree; your store only receives a single-use token (nonce).

Which currencies?

Those your Braintree merchant accounts settle in. Each account has one currency. Orders in another currency can be charged in your default merchant account, converted with your store rate. Currencies Braintree does not list, or whose decimals Braintree and ISO 4217 disagree on (LAK), are not offered.

Can I refund right after the order?

Braintree refunds only payments that are settling or settled. Before that, use Void (the customer is not charged at all).

Can I capture in several parts?

1.0 captures an authorization once (full or a lower amount). Multiple partial captures are a PayPal-only Braintree feature.

Apple Pay, Google Pay, Venmo, saved cards?

Not in 1.0.

Do I need webhooks?

They are recommended for disputes and settlement results. Payments work without them: card answers are synchronous, and the cron reads unclear payments and settlements back.

Does it work with the full page cache of CS-Cart 4.21?

Yes. The pay page, the payment return and the webhook are not cacheable pages, and the pay page is sent with "Cache-Control: no-store".

Does it change core files?

No. Hooks, its own controllers and templates only.