Scalapay Payments

Edition: CS-Cart & Multi-Vendor · Latest version: 1.0.0 · Compatible with: CS-Cart & Multi-Vendor 4.17.2 – 4.21.x, PHP 7.4 – 8.3 · Changelog: view

Integrates CS-Cart and Multi-Vendor with Scalapay, the “buy now, pay later” provider: your customers pay in 3 or 4 instalments, or later, on Scalapay’s own checkout page, and you receive the order amount from Scalapay. The add-on creates the Scalapay order, sends the customer to Scalapay, reads the order back when the customer returns and captures it at once, or authorizes it with a delayed capture and captures when the order ships. Void, full and partial refunds from the order page.

What it does

One payment method per Scalapay product. Create a payment method for Pay in 3, Pay in 4 or Pay later (the products of your Scalapay contract), or one without a product. The add-on never pre-selects Scalapay at checkout.
Scalapay’s widget where Scalapay recommends it. Optionally below the product price, below the cart total and in the payment step. It shows Scalapay’s own texts, logo and information window, and only while the page shows prices in euro.
Paid means paid. An order moves to your paid status only after the shop read the order back from Scalapay, its amount equals what the shop sent AND what the order costs now, and Scalapay confirmed the capture. A changed order total, a second payment of a paid order or an authorization for a cancelled order is voided automatically and shown on the order page, never marked paid.
Capture at once or later. Standard flow: captured as soon as the customer authorized. Delayed capture: Scalapay holds the authorization for 1 to 5 days; it is captured when the order reaches a status you choose (default Complete) or by hand, and voided when you cancel. While it waits the order is at an “authorized” status that does not count as paid (default Open); an authorization that expires or is voided moves the order to your “not paid” status, so it is never shipped unpaid.
Never twice. Every create, capture, delay, void and refund is written down before it is sent, with Scalapay’s Idempotency-Key. A lost answer is read back first and only then sent again with the same key.
A pending payment is never shown as cancelled. A customer who returns before Scalapay decided sees the order, and the cart is emptied (saved carts of signed-in customers too) so the order cannot be paid twice. The signed webhook and the cron pick up what the browser missed.
Safe return from Scalapay. The address Scalapay sends the customer back to carries core’s no_session=Y, so the return never replaces the customer’s session cookie, whatever method Scalapay uses; the page then continues to the order inside your shop.
Signed webhooks. Checked with the HMAC signature of your API key; they only trigger a read-back.
Amount limits and countries. Minimum and maximum of your contract; offered only for orders in euro (a shop in another currency converts with its own euro rate, once) and for delivery to Austria, Belgium, Finland, France, Germany, the Netherlands, Italy, Portugal and Spain.
Neutral presentation (CCD2). The new EU Consumer Credit Directive applies from 20 November 2026. The add-on helps you show Scalapay neutrally: no pre-selection, no claims about cost, ease or speed, details from Scalapay’s own widget and page, an optional information line. This is not legal advice.
Multi-Vendor. Marketplace owner mode (a cart with several vendors is one Scalapay order on the parent order, captured once, each vendor order refunds its own share) or direct payments to each vendor’s own Scalapay account.
Your key, kept safe. The API key is stored encrypted (AES-256-GCM) and never shown again.
Uninstall keeps your records. Payments, captures, voids and refunds and the connection survive an uninstall (unless you tick “Delete payment records on uninstall”), so refunds of older orders work after a reinstall.

Compatibility

CS-Cart, CS-Cart Ultimate, Multi-Vendor and Multi-Vendor Ultimate 4.17.2 to 4.21.x. PHP 7.4 to 8.3, depending on your CS-Cart version; cURL and OpenSSL; a cron job.
An HTTPS storefront (Scalapay returns the customer to https:// addresses).
Full page cache (4.21): designed for it: the product page widget prints only shop-wide data (product price, language, display currency); cart, checkout, return, webhook and cron are never cached pages. Not yet run on a 4.21 store with the cache on. After changing the Connection or widget settings, clear the cache so cached product pages pick them up.
Tested: see tests/test-plan.md. Unit tests on PHP 8.1 and 8.3; HTTP end-to-end tests on Multi-Vendor 4.17.2 and CS-Cart 4.17.2 against a local stand-in built from the published Scalapay API reference; Smarty 5 offline compile of every template. Not run against the real Scalapay sandbox and not on a live 4.21 store: run one sandbox order with your own setup before going live (test card 5200828282828210).

You need

A Scalapay merchant account and its API key (sandbox: the public test key Scalapay publishes works for first tests). Scalapay charges its own fees.
Euro as a store currency, and the phone field filled at checkout (Scalapay needs the customer’s phone number).

Next steps

Scalapay is a trademark of its owner. This add-on is independent software by Kavio Labs that integrates with the Scalapay API; it is not affiliated with or endorsed by Scalapay.