Redsys Payments (Cards, Bizum, Spain)

What it does

Redsys for stores that sell in Spain on CS-Cart and Multi-Vendor. Redsys is the virtual POS (TPV Virtual) most Spanish banks offer. The customer is sent to the Redsys payment page and pays with the methods your bank enabled, for example cards with 3-D Secure and Bizum; a second payment method opens Bizum directly. Card data never reaches your server. Any currency your terminal accepts.

You need a TPV Virtual from your bank; the bank charges its own fees. Made by Kavio Labs, not affiliated with or endorsed by Redsys or Bizum; both are trademarks of their owners.

What it changes for your store

• Requests are signed with HMAC_SHA512_V2, or HMAC_SHA256_V1 for older terminals, and the signature, amount and currency of every notification are checked before an order is paid.
• Repeated or late notifications change an order one time and never undo a paid order.
• A customer who returns before the result arrives sees the order, not a second checkout.
• Every attempt gets its own 12-character Redsys order number.
• Refunds from the order page, full or partial; a refund with a lost answer is never repeated by itself.
• Failed jobs retry by themselves and are listed in the log.

How it works

Features

• Redsys redirection with the signed form fields Ds_SignatureVersion, Ds_MerchantParameters and Ds_Signature
• Signature versions HMAC_SHA512_V2 and HMAC_SHA256_V1, checked against the examples printed in the Redsys guides
• Bizum through the documented Ds_Merchant_PayMethods value z, as its own payment method
• Notification checked with the terminal key, answer code, amount and currency before an order is paid
• Repeated, late and out-of-order notifications handled safely
• Cart stays empty after a return while the payment is pending, also for signed-in customers
• Unique 12-character order numbers for every attempt, so retries never meet SIS0051
• Full and partial refunds through the Redsys REST interface, with an "unconfirmed" state and your confirmation when the answer is lost
• Test and live environments, terminal key stored encrypted, Test connection
• Orders in 140 ISO 4217 currencies, each charged in its correct minor unit (0 decimals for XOF or JPY, 3 for JOD or KWD)
• Job queue with retries, log with CSV export
• Multi-Vendor: one marketplace account or one account per vendor

What you get

Compatibility

We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.

Requirements