Take PayU payments in CS-Cart and Multi-Vendor: hosted PayU page, signed notifications, every order read back before it counts as paid, and refunds from the order page.
Tested on 3 buildsUpdated Nov 7, 2026Version 1.0.0CS-Cart, Multi-Vendor 4.17.2 – 4.21.x No core file edits
Built for
PayU Payments (Cards, BLIK, Pay-by-link): Take card, BLIK and bank transfer payments through PayU with signed notifications, read-back before an order is paid and refunds from the order page1 of 7
What it does
PayU for stores in Poland and Central and Eastern Europe on CS-Cart and Multi-Vendor. The customer is sent to the PayU payment page and pays with the methods enabled on your PayU point of sale, for example cards, BLIK and bank transfers. Card and bank data never reach your server. Currencies PLN, EUR, CZK, GBP, USD, HUF, RON, CHF, DKK, NOK and SEK.
You need a PayU merchant account with a REST API point of sale; PayU charges its own fees. This add-on is made by Kavio Labs and is not affiliated with or endorsed by PayU; PayU and BLIK are trademarks of their owners.
What it changes for your store
Every notification is checked with the OpenPayu-Signature header and your second key.
An order counts as paid only after it was read back from PayU and its order id, external id, POS id, amount and currency match.
Repeated notifications change an order one time.
A lost notification is recovered when the customer returns or by the recurring check.
Refunds from the order page, full or partial, with the result read back from PayU.
Failed calls retry by themselves and are listed in the log.
How it works
Admin
Enter the POS ID, OAuth client secret and second key of your test point of sale, run Test connection, then add a payment method with the PayU processor. Refund from the order's PayU tab.
Shopper
Picks PayU at checkout, pays on the PayU page and returns to the order.
Marketplace
The owner takes the payments on one PayU account and alone refunds them, or each vendor connects their own account (PayU is then offered for carts with one vendor). Requires auto-receive on in PayU.
Features
PayU hosted payment page, no card or bank data on your server
Methods enabled on your PayU point of sale, such as cards, BLIK and bank transfers
OAuth access token, order created with the PayU REST API 2.1
Notification signature check (MD5, SHA-256 and longer SHA-2 digests) with your second key
Order read back from PayU and compared before it counts as paid
Idempotent notifications and lost-notification recovery by return and cron
Waiting page for pending payments (BLIK, pay-by-link): no "cancelled" message, no double payment
Full and partial refunds, safe to retry (one PayU refund id), result read back
Eleven currencies, amounts in minor units, other store currencies converted to PLN
Order status for paid, failed and canceled payments, never moved backwards
Test (sandbox) and live credentials stored encrypted, Test connection
Job queue with retries, log with CSV export
Multi-Vendor: one marketplace account or one account per vendor
What you get
Package
kv_payu-1.0.0.zip, installed through Add-ons → Manage add-ons
Updates & support
12 months included. Download new versions from your account and install them in Add-ons → Manage add-ons or the Upgrade Center.
License
1 production installation. Staging, dev and localhost are free and unlimited. The add-on keeps working after the update period ends. How licensing works
Compatibility
We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.
CS-Cart version and edition compatibility
CS-Cart version
CS-Cart
CS-Cart Ultimate
Multi-Vendor
Multi-Vendor Ultimate
4.22 and later
Testing next
Testing next
Testing next
Testing next
4.21.2
Supported
Supported
Supported
Supported
4.20.x
Supported
Supported
Supported
Supported
4.19.x
Supported
Supported
Supported
Supported
4.18.x
Supported
Supported
Supported
Supported
4.17.2
Supported
Supported
Tested
Supported
Before 4.17.2
Not supported
Not supported
Not supported
Not supported
Last tested build: Multi-Vendor 4.17.2, Nov 7, 2026Tested on: Multi-Vendor 4.17.2
Requirements
Platform
CS-Cart and Multi-Vendor 4.17.2 or later
Requirement
Administrator access to the store's admin panel
Requirement
A PayU account with a point of sale (POS) of the type "REST API (Checkout)". You need its POS ID, the OAuth client secret and the second key (MD5), all shown in the PayU merchant panel under the POS configuration. For tests, PayU publishes public sandbox POS credentials (see Developer notes) or you can register a sandbox merchant account at secure.snd.payu.com. A POS settles one currency (for example PLN); open a POS per currency you sell in
Requirement
Auto-receive must be switched on for the POS in the PayU panel (automatic collection of payments). With it off, PayU keeps paid orders in the status WAITING_FOR_CONFIRMATION until you accept them there; the add-on does not accept payments by itself, so such orders stay open in your store
Requirement
A cron job on your server (see step 6)
Core changes
None. Hooks and template overrides only
1.0.0
Nov 7, 2026
Latest
Added 9
Initial release.
PayU payment method (PayU REST API 2.1, PayU GPO Europe): OAuth client credentials, order created with POST /api/v2_1/orders, customer redirected to the redirectUri of PayU, continueUrl and notifyUrl sent with every order.
Notifications verified with the OpenPayu-Signature header and the second key of the POS (MD5, SHA-256, SHA-384, SHA-512), stored first and processed by the job queue, idempotent by order id and status.
An order counts as paid only after GET /api/v2_1/orders/{orderId} returned COMPLETED and order id, external order id, POS id, amount and currency match; lost notifications are recovered by the customer's return and by the recurring check.
Full and partial refunds from the order page or automatically at an order status (POST .../refunds with a unique extRefundId), refund result read back.
Currencies PLN, EUR, CZK, GBP, USD, HUF, RON, CHF, DKK, NOK, SEK; amounts in minor units; other store currencies converted to PLN.
Connection page with encrypted credentials (POS ID, OAuth client secret, second key), test and live mode, a connection test.
Marketplace owner mode or one PayU account per vendor (Multi-Vendor).
Job queue with retries and back-off, cron (command line and secret address), log viewer with CSV export.
Tested on Multi-Vendor 4.17.2. First release.
Does it work with CS-Cart and Multi-Vendor?
Yes. The add-on supports CS-Cart and Multi-Vendor. In Multi-Vendor the marketplace owner can use one PayU account for everyone (and refund) or let each vendor connect their own. In vendor mode PayU is offered for carts that hold products of one connected vendor; a cart with several vendors cannot use PayU.
What does the customer see if the payment is still pending when they come back?
A waiting page that checks PayU every few seconds and then shows the finished order. The order is already placed (status Open), so the store does not say "transaction cancelled" and does not offer to pay again. If the customer opens the pay link of the same order again, they are sent to the PayU order that is still open, never to a second one.
Do I need to switch anything on in PayU?
Yes: keep auto-receive on for the POS. See Installation.
Which CS-Cart versions are supported?
4.17.2 to 4.21.x.
Where are my credentials stored?
In your own database, encrypted. The key is derived from your store's secret in config.php, so a database dump alone does not reveal them. They are never shown again after saving.
Does it send data to Kavio Labs?
No. The add-on talks to PayU only. The license check sends your domain name to the Kavio Labs license server once a day (Kavio Labs downloads).
What happens when PayU is down?
Jobs fail, wait and are retried automatically (5 minutes up to 12 hours). Nothing is lost. A refund whose answer was lost is kept as "Not confirmed" and retried with the same PayU refund id, which PayU uses to recognise the request, so it is created once. If you click Refund again yourself, repeat the same amount.
What happens when the license expires?
No new payments can be started with PayU. Payments already made are still read back and refunds already under way are still finished.
How do I get updates?
Install the new package over the old one. See Installation.
One Step CheckoutOne page checkout in 1, 2 or 3 columns with a sticky summary, one screen for every field and a safe fallback to the standard checkout.
Abandoned Cart Recovery Pro
