Conformance with the Braintree documentation (CS-Cart)
Checked against the Braintree GraphQL guides and schema, the developer docs, the JavaScript SDK reference and the webhook code of the official PHP SDK (see developer.md for every source), read 2026-11-07. The API client and the money rules are the ones of our OpenCart build, which passed its own release audit; this add-on adds the CS-Cart flow, Multi-Vendor and the audit fixes listed in the CHANGELOG.
How it was proven: unit tests (PHP 8.1 and 8.3) of the GraphQL contract, the webhook signature algorithm of the official SDK, Braintree’s sample notifications and the exact money format; HTTP end-to-end tests on CS-Cart 4.17.2 (Ultimate) and Multi-Vendor 4.17.2 against a local stand-in that follows those sources (connection, pay page, charge, authorize + capture by status, void, partial refunds, unclear answers, card / PayPal type checks, 3D Secure refusal, amount mismatch, second payment, signed webhooks, Multi-Vendor shares, vendor accounts, vendor panel rights). It has not been run against the real Braintree sandbox: we have no sandbox account yet. Confirm the points below once with your own sandbox keys.
| Topic | Documented behaviour | What the add-on does |
|---|---|---|
| API | GraphQL, POST, Basic auth with API keys, Braintree-Version, JSON | As documented |
| Client | JavaScript SDK v3, Hosted Fields (Drop-in deprecated 2026-10-01) | Hosted Fields + 3D Secure + PayPal Checkout + Data Collector, 3.147.0, on the store’s pay page |
| Client token | Same merchant account as the transaction | One token per pay page view with the account of the charge |
| 3D Secure | Version 2, amount + nonce + bin, onLookupComplete; required defaults to true for enriched nonces | As documented, plus a server-side liability check before the charge |
| Sale / authorize | chargePaymentMethod / authorizePaymentMethod | Setting “Payment action” |
| Idempotency | apiRequestKey returns the same transaction; a request with a key that is still in flight gets VALIDATION | Key stored before every money call; a charge is resent only after a finished retryable answer; a resend answered VALIDATION stays unknown until a read-back |
| Timeouts | 60 s; search after a timeout | 60 s; search by unique orderId; unclear attempts are watched for 24 hours |
| Void / refund | Void before settlement, refund when settling or settled, partial refunds | As documented, checked against the current transaction before the call |
| Webhooks | bt_signature + bt_payload, HMAC-SHA1 keyed with SHA-1 of the private key | Verified in constant time, applied once, transaction read back |
To confirm with your own sandbox keys
Section titled “To confirm with your own sandbox keys”- One card order with 3D Secure (a sandbox 3DS test card) and one PayPal order (sandbox PayPal account).
- One capture with a lower amount: the transaction amount afterwards.
- One partial refund after settlement (sandbox: settle with the testing tools).
- “Check URL” on your webhook reaches
index.php?dispatch=kv_braintree.webhook(firewall or bot filter).
Not covered in 1.0.0
Section titled “Not covered in 1.0.0”Apple Pay, Google Pay, Venmo, saved cards (Vault), multiple partial captures (PayPal), Fastlane, Local Payment Methods, ACH / SEPA, subscriptions. Card fields on the checkout page itself (1.0 uses a pay page after the order is placed).