Braintree Payments

Edition: CS-Cart & Multi-Vendor · Latest version: 1.0.0 · Compatible with: CS-Cart & Multi-Vendor 4.17.2 – 4.21.x, PHP 7.4 – 8.3 · Changelog: view

Take card payments and PayPal through your own Braintree account on CS-Cart, CS-Cart Ultimate, Multi-Vendor and Multi-Vendor Ultimate (4.17.2 to 4.21.x). After the order is placed, the customer pays on a secure page of your store: the card is typed into Braintree Hosted Fields (the fields are hosted by Braintree, so card data never reaches your server), cards go through 3D Secure 2, and PayPal runs through the same Braintree account. Charge at once, or authorize and capture when you ship; void, full and partial refunds from the order page.

What it does

Hosted Fields, not the old Drop-in. Braintree deprecated its Drop-in UI on 1 October 2026 and asks merchants to move to the JavaScript SDK. This add-on uses the JavaScript SDK v3 components (client, Hosted Fields, 3D Secure, PayPal Checkout, Data Collector) on a clean pay page that follows your storefront.
3D Secure 2 with a server-side check. With the 3D Secure setting on (default), every card goes through 3D Secure 2 before the charge. With “Require liability shift” on (default), the store reads the card back from Braintree and refuses it before anything is charged when 3D Secure could have shifted the liability but did not, or when the result is missing. The store also reads the payment method type from Braintree: whether it is a card or PayPal is decided by Braintree, never by the browser, so a card cannot skip 3D Secure by claiming to be PayPal.
PayPal through Braintree. The PayPal button of your Braintree account, the same order tab, the same refunds.
Your merchant account currencies. Each Braintree merchant account settles in one currency. An order in a currency with its own merchant account is charged in that currency; other currencies can be charged in your default merchant account, converted with your store rate (the customer sees the amount before paying). Amounts use the exact number of decimals of each currency (JPY “1000”, USD “10.00”, BHD “1.000”).
Paid means paid. An order gets your paid status only when Braintree returned the transaction, its amount, currency, merchant account and order id match what the store sent, and the order still costs that amount. Otherwise the payment is voided or refunded automatically and shown on the order tab; it is never booked as paid.
No lost payment, no double charge. Every charge, capture, void and refund is written down before it is sent, with Braintree’s idempotency key (apiRequestKey). A charge without a clear answer is looked up by its unique order id; it stays “waiting for Braintree” (the cart is emptied so the order cannot be paid twice) and the cron keeps looking for it for 24 hours. It is never closed as failed while Braintree may still complete it. An operation without a clear answer is read back before anything is sent again.
Sale or authorize + capture. Charge at once, or authorize and capture when the order reaches a status you choose (default Complete) or by hand; an authorization is voided when the order is cancelled or declined. A capture never changes the order status.
Void, refunds, partial refunds from the order tab, with the Braintree status, card brand, last four digits, 3D Secure result and dispute status.
Signed webhooks. Disputes and settlement results arrive on a webhook URL; each notification is checked with its Braintree signature, applied once, and the transaction is read back.
Multi-Vendor. Owner mode (default): every order is paid to the marketplace owner’s Braintree account; a cart with several vendors is one payment on the parent order, each vendor order refunds its own share, and an authorization is captured once every vendor order is shipped or cancelled (a cancelled vendor’s share is left out). Owner mode off: each vendor connects their own Braintree account and receives the payments for their orders directly.
Your keys, kept safe. The private key is stored encrypted (AES-256-GCM) and never shown again. Keys, card data and personal data are masked in the log.
Updates keep your data. Uninstalling keeps the payment records unless you tick “Delete payment records on uninstall”, so refunds of older orders keep working after a reinstall.
Full page cache ready (4.21). The pay page, the payment return and the webhook are never cached pages; checkout shows no per-visitor data in cached blocks.

Requirements

CS-Cart or Multi-Vendor 4.17.2 to 4.21.x (all four editions), PHP 7.4 to 8.3 with cURL and OpenSSL.
A Braintree merchant account (sandbox for testing, production for live payments) and its API keys.
3D Secure and PayPal enabled for your Braintree account if you use them.
HTTPS for the storefront and webhooks (Braintree sends webhooks only to HTTPS URLs).

Braintree and PayPal are trademarks of PayPal, Inc. This add-on is independent software by Kavio Labs that integrates with the Braintree GraphQL API; it is not affiliated with or endorsed by PayPal, Inc.