Name: Vipps MobilePay Payments
Brand: Kavio Labs
SKU: KV-VIPPS_MOBILEPAY
Price: 79 USD
Availability: InStock

What it does

Vipps MobilePay for stores that sell in Norway, Denmark and Finland, on CS-Cart, CS-Cart Ultimate, Multi-Vendor and Multi-Vendor Ultimate. Customers pay in the Vipps or MobilePay app: on a phone the app opens, on a computer they enter their mobile number. You use your own merchant agreement and sales unit; currencies NOK, DKK and EUR. Card data never reaches your server. Vipps MobilePay charges its own fees; the add-on has none per transaction.

What it changes for your store

The money is reserved at approval and taken when the order reaches the status you choose, so you charge only what you ship.
Partial captures and refunds without leaving the order page.
An order counts as approved only after a read-back with the right amount and order total.
A lost webhook is recovered by the customer's return or the cron.
Every capture, refund and release has an idempotency key and is never sent twice.
The deadline for capturing a reservation is shown and warned about.

How it works

Admin: enter the MSN, keys and subscription key of your test sales unit, run Save and test, register the webhook with one button, add a payment method with the Vipps MobilePay processor, then repeat with live keys. The order page has a Vipps MobilePay tab with capture, refund, release and read back.

Shopper: chooses Vipps or MobilePay, approves in the app and returns to the shop.

Tested against a stand-in built from the published API specifications, not yet against the real Vipps MobilePay test environment.

Features

Vipps MobilePay ePayment API, wallet payments with app switch on phones and landing page on computers
Order approved only after a read-back: amount created and order total must match
Webhooks registered with one button and verified by their HMAC signature, with return and cron recovery
Capture when the order reaches a status, at once after approval, or by hand; partial captures
Full and partial refunds of captured money, release of the reservation, from the order page or by order status
Idempotency key stored before every create, capture, refund and release; unanswered operations are read back first
Amount mismatch, duplicate and late approvals are flagged and released, never booked
Capture deadline on the order tab, a banner and a log warning 3 days ahead
NOK, DKK and EUR sales units, other shop currencies converted once at payment start
Local brand name and paymark at checkout; MobilePay switches to Vipps in Denmark and Finland on 12 January 2027 by itself
Test and live keys stored encrypted and never shown again; Test connection
Built for the 4.21 full page cache: checkout, return and webhook addresses are never cached pages; log with CSV export; jobs page; cron
Multi-Vendor: all orders paid to the owner with per-vendor capture and refund shares, or direct payments to each vendor's own sales unit

What you get

Package	kv_vipps_mobilepay-1.0.0.zip, installed through Add-ons → Manage add-ons
Updates & support	12 months included. Download new versions from your account and install them in Add-ons → Manage add-ons or the Upgrade Center.
License	1 production installation. Staging, dev and localhost are free and unlimited. The add-on keeps working after the update period ends. How licensing works
For developers	Uses 3 CS-Cart PHP hooks. No core files are changed.

Compatibility

We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.

CS-Cart version and edition compatibility
CS-Cart version	CS-Cart	CS-Cart Ultimate	Multi-Vendor	Multi-Vendor Ultimate
4.22 and later	Testing next	Testing next	Testing next	Testing next
4.21.2	Supported	Supported	Supported	Supported
4.20.x	Supported	Supported	Supported	Supported
4.19.x	Supported	Supported	Supported	Supported
4.18.x	Supported	Supported	Supported	Supported
4.17.2	Supported	Supported	Tested	Supported
Before 4.17.2	Not supported	Not supported	Not supported	Not supported

Last tested build: Multi-Vendor 4.17.2, Nov 7, 2026Tested on: Multi-Vendor 4.17.2

Requirements

PHP	CS-Cart, CS-Cart Ultimate, Multi-Vendor or Multi-Vendor Ultimate 4.17.2 to 4.21.x; PHP 7.4 to 8.3 as your CS-Cart version supports
PHP	cURL and OpenSSL for PHP; MySQL 5.7 or later, or MariaDB 10.2 or later (the add-on uses nested named locks)
Requirement	An HTTPS storefront. The webhook and the return address must be reachable over https:// without a redirect in production
Requirement	A Vipps MobilePay merchant agreement with online payments. In the business portal (portal.vippsmobilepay.com) you find the Merchant Serial Number (MSN) of the sales unit, the client id, the client secret and the subscription key (Ocp-Apim-Subscription-Key). For tests you need the keys of a test sales unit; the test environment is apitest.vipps.no
Requirement	A cron job on your server (step 6). Without it payments are still confirmed by the webhook and the customer's return, but a lost webhook is not recovered
Core changes	None. Hooks and template overrides only

1.0.0

Nov 7, 2026

Latest

Added 9

Initial release, a port of our OpenCart extension to CS-Cart, CS-Cart Ultimate, Multi-Vendor and Multi-Vendor Ultimate 4.17.2 to 4.21.x (PHP 7.4 to 8.3).
Vipps MobilePay ePayment API, wallet payments with WEB_REDIRECT (app on phones, landing page on computers); NOK, DKK and EUR sales units, other shop currencies converted once at payment start.
Connection page per mode (test and production): MSN, sales unit currency, client id, client secret and subscription key sealed with AES-256-GCM, Save and test, Test connection, one-click webhook registration (seven events, HMAC-SHA256 verified, 503 when the read-back fails).
An order is approved only after a read-back (AUTHORIZED, amount created, order total stored); webhook, the customer's return (three reads) and the cron trigger it; a pending payment is never shown as cancelled and the cart and saved cart rows are emptied on return.
Capture at the capture status, at once after approval or by hand; partial captures; refunds (partial or all captured money) and release of the reservation from the Vipps MobilePay order tab or by order status; read back; capture deadline highlighted and warned 3 days ahead.
Money safety: idempotency key stored before every create, capture, refund and release; unanswered operations read back before any resend (same key within 24 hours); per-order and per-payment locks; flags for amount mismatch, duplicate and late approvals (released, never booked).
Local brand name (Vipps for NOK, MobilePay for DKK and EUR until 12 January 2027, then Vipps) with the unchanged paymark, the brand book line and a TEST MODE line.
Multi-Vendor: owner mode (one payment per cart on the parent order, per-vendor capture and refund shares, vendors view only) or direct payments to each vendor's own sales unit.
Payments list, log with filters and CSV export, jobs page with retries and back-off, cron (command line and secret address), Upgrade Synchronizer and Kavio Labs license client.

Tested 1

Unit tests on PHP 8.1 and 8.3; HTTP and Multi-Vendor end-to-end tests against a local stand-in built from the published API specifications. See tests/test-plan.md. Not yet run against the real Vipps MobilePay test environment.

Tested on Multi-Vendor 4.17.2. First release.

Does it work with CS-Cart and Multi-Vendor?

Yes: CS-Cart, CS-Cart Ultimate, Multi-Vendor and Multi-Vendor Ultimate 4.17.2 to 4.21.x. In Multi-Vendor the marketplace owner can take all payments on one sales unit or let each vendor connect their own.

Do I need an agreement with Vipps MobilePay?

Yes. You need a Vipps MobilePay merchant agreement with online payments and a sales unit. Vipps MobilePay charges its own fees; the add-on has no per-transaction fee.

Has it been tested against the real Vipps MobilePay test environment?

Not yet. It was tested against a local stand-in built from the published API specifications, including the documented webhook signature algorithm (see tests/test-plan.md and Conformance). We have no test sales unit yet, so no real app has approved a payment. The points to confirm with your own test keys are listed in the conformance page.

Which payment methods and currencies?

Wallet payments through the redirect flow (the Vipps or MobilePay app). Card payments (CARD) are not part of version 1.0. Currencies NOK, DKK and EUR, the currency of your sales unit. A cart in another shop currency is converted once, when the payment starts, with the shop's own rate.

Is an order approved when the customer returns to the shop?

No. The return, the webhook and the cron only trigger a read-back; the order is approved only when Vipps MobilePay says the payment is authorized, with the amount that was created and the order total that was stored.

When is the money taken?

At approval the amount is reserved. It is captured when the order reaches the capture status (default Complete), at once after approval, or by hand, depending on the Capture setting. Capture before the date shown as "Capture guaranteed until".

Can I refund?

Yes, full or partial, from the order's Vipps MobilePay tab or at a refund status. Only captured money can be refunded. A reservation that is not captured is released instead.

Does it work with the full page cache of 4.21?

It is built for it: the checkout, the return address (payment_notification) and the webhook (a POST to the add-on's own dispatch) are never cacheable pages, and the add-on prints nothing into cached storefront pages. The full page cache test harness has not been run on a 4.21 store with the cache switched on yet.

What changes on 12 January 2027?

MobilePay becomes Vipps in Denmark and Finland. With "Show the local brand name" on, checkout shows MobilePay for DKK and EUR sales units until that day and Vipps from that day, by itself. The API does not change.

Where are my credentials stored?

In your database, encrypted with AES-256-GCM, with a key derived from your store's secret in config.php. They are never shown again after saving; an empty field keeps the stored value.

Does it send data to Kavio Labs?

No customer or payment data. The add-on talks to Vipps MobilePay for payments. The license check sends your domain name, license key, add-on and CS-Cart version once a day (see the license page in the settings).

What happens when Vipps MobilePay is down?

Webhooks that cannot be read back answer 503 and are retried by Vipps MobilePay; unanswered operations are read back before they are sent again (never twice); queued jobs retry after 5 minutes up to 12 hours; the cron reads open payments again.

What happens when the license expires?

The payment method is hidden from new orders. Payments, webhooks, captures and refunds already under way are still processed.

Is it affiliated with Vipps MobilePay?

No. It integrates with their public ePayment API. Vipps MobilePay, Vipps and MobilePay are trademarks of Vipps MobilePay AS.

How do I get support?

Contact us through https://cs-cart.kaviolabs.com with the add-on version, the CS-Cart version and the relevant log lines.