Take BLIK, online bank transfers and cards through Tpay, with JWS-verified notifications, a read-back before an order counts as paid, and refunds from the order page.
Tested on 2 buildsUpdated Nov 7, 2026Version 1.0.0CS-Cart, Multi-Vendor 4.17.2 – 4.21.x No core file edits
Built for
Tpay Payments (BLIK, Pay-by-link, cards): Take BLIK, bank transfer and card payments through Tpay with JWS-verified notifications, a read-back before an order is paid and refunds from the order page1 of 8
What it does
Tpay for Polish stores on CS-Cart and Multi-Vendor. Customers pay on the Tpay payment page with the methods of your account: BLIK, online bank transfers, cards and more. Card and bank data never reach your server. Amounts in PLN; other store currencies are converted to PLN.
Built on the public Tpay OpenAPI. You need a Tpay merchant account; Tpay charges its own fees. This add-on is made by Kavio Labs and is not affiliated with or endorsed by Tpay; Tpay and BLIK are trademarks of their owners.
What it changes for your store
Every notification is checked with its JWS signature and checksum before anything happens.
An order counts as paid only when the transaction read back from Tpay matches amount, currency and reference.
Repeated notifications change an order one time.
A lost notification is recovered when the customer returns or by the recurring check.
Refunds from the order page, full or partial, followed until Tpay reports them done.
Failed calls retry by themselves and are listed in the log.
How it works
Admin
Enter the client ID, secret, security code and merchant ID of your sandbox account, run Test connection, then add a payment method with the Tpay processor. Choose all methods, BLIK only or one payment group per payment method. Refund from the order's Tpay tab.
Shopper
Picks Tpay at checkout, pays on the Tpay page and returns to the order.
Marketplace
The owner receives the payments on one Tpay account, or each vendor connects their own.
Features
Tpay payment page, no card or bank data on your server
BLIK, online bank transfers, cards and the other methods enabled on your account
One payment method per choice: all methods, BLIK only or one payment group
OAuth 2.0 access with an encrypted, cached token
Notifications verified by JWS signature (Tpay certificate chain) and md5sum, answered with TRUE
Read-back of the transaction and an amount, currency and reference check before an order counts as paid
Idempotent notifications and lost-notification recovery
Full and partial refunds, reconciled with the Tpay refund list
Order status for paid, failed and canceled payments, never moved backwards
Sandbox and live keys stored encrypted, Test connection
Job queue with retries, log with CSV export
Multi-Vendor: one marketplace account or one account per vendor
What you get
Package
kv_tpay-1.0.0.zip, installed through Add-ons → Manage add-ons
Updates & support
12 months included. Download new versions from your account and install them in Add-ons → Manage add-ons or the Upgrade Center.
License
1 production installation. Staging, dev and localhost are free and unlimited. The add-on keeps working after the update period ends. How licensing works
Compatibility
We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.
CS-Cart version and edition compatibility
CS-Cart version
CS-Cart
CS-Cart Ultimate
Multi-Vendor
Multi-Vendor Ultimate
4.22 and later
Testing next
Testing next
Testing next
Testing next
4.21.2
Supported
Supported
Supported
Supported
4.20.x
Supported
Supported
Supported
Supported
4.19.x
Supported
Supported
Supported
Supported
4.18.x
Supported
Supported
Supported
Supported
4.17.2
Supported
Supported
Tested
Supported
Before 4.17.2
Not supported
Not supported
Not supported
Not supported
Last tested build: Multi-Vendor 4.17.2, Nov 7, 2026Tested on: Multi-Vendor 4.17.2
Requirements
Platform
CS-Cart and Multi-Vendor 4.17.2 or later
Requirement
Administrator access to the store's admin panel
Requirement
A Tpay merchant account with API access. In the Tpay merchant panel create an Open API key (Integration > API > Open API Keys > Add new key) and copy the client ID and secret; the merchant ID and the security code are in the panel too (Notifications > Security). Test with a sandbox account (register.sandbox.tpay.com)
Requirement
A cron job on your server (see step 6)
Core changes
None. Hooks and template overrides only
1.0.0
Nov 7, 2026
Latest
Added 9
Initial release.
Tpay payment method: OAuth 2.0 access (/oauth/auth), POST /transactions with payer, callbacks and optional BLIK / bank group, redirect to the Tpay payment page.
Notification verification as documented: JWS signature (X-JWS-Signature, certificate chain of Tpay), md5sum and merchant id; answer TRUE; idempotent events.
An order is marked paid only after GET /transactions/{id} confirms amount, currency and reference; lost-notification recovery by the payer's return and a recurring check.
Refunds from the order page (full as the documented empty request, partial with an amount) and by order status; reconciliation with the Tpay refund list after an unclear answer; refunds cancelled by Tpay give the amount back.
Per payment method choice of all methods, BLIK only (group 150) or one payment group.
Connection page with encrypted client ID / secret / security code, merchant ID, sandbox and live mode, connection test.
Job queue with retries and back-off, cron (command line and secret address), log viewer with CSV export.
Multi-Vendor: marketplace owner mode or one Tpay account per vendor.
Tested on Multi-Vendor 4.17.2. First release.
Does it work with CS-Cart and Multi-Vendor?
Yes. The add-on supports CS-Cart and Multi-Vendor. In Multi-Vendor the marketplace owner can use one Tpay account for everyone or let each vendor connect their own.
Which CS-Cart versions are supported?
4.17.2 to 4.21.x.
Where are my credentials stored?
In your own database, encrypted. The key is derived from your store's secret in config.php, so a database dump alone does not reveal them. They are never shown again after saving.
Does it send data to Kavio Labs?
No. The add-on talks to Tpay only. The license check sends your domain name to the Kavio Labs license server once a day (Kavio Labs downloads).
What happens when Tpay is down?
Jobs fail, wait and are retried automatically (5 minutes up to 12 hours). Nothing is lost and nothing is sent twice.
What happens when the license expires?
New work stops (no new documents, rates, syncs or payments). Work already under way is still finished.
How do I get updates?
Install the new package over the old one. See Installation.
How do I get support?
Contact us through https://cs-cart.kaviolabs.com.
Which currencies and methods?
PLN (the documented currency of the transaction request); an order in another currency is converted with the store's rate when the store has an active PLN currency. Methods (BLIK, bank transfers, cards, wallets) are those enabled on your Tpay account; you can restrict a CS-Cart payment method to BLIK or to one payment group. BLIK level 0 (entering the BLIK code in your own checkout) is not part of version 1.0: the customer enters the code on the Tpay page.
Is the notification verified?
Yes, twice, as the Tpay documentation requires: the JWS signature (certificate chain of Tpay) and the md5sum; plus the merchant ID. A notification is only a trigger: the order is paid after the transaction is read back and amount, currency and reference match.
Do I need a Tpay account?
Yes. Tpay charges its own fees. Kavio Labs is not affiliated with Tpay; the add-on only uses the public Tpay OpenAPI.
One Step CheckoutOne page checkout in 1, 2 or 3 columns with a sticky summary, one screen for every field and a safe fallback to the standard checkout.
Abandoned Cart Recovery Pro
