Vipps MobilePay Payments

Edition: CS-Cart & Multi-Vendor · Latest version: 1.0.0 · Compatible with: CS-Cart & Multi-Vendor 4.17.2 – 4.21.x, PHP 7.4 – 8.3 · Changelog: view

Connects CS-Cart and Multi-Vendor to Vipps MobilePay through the ePayment API: the customer approves the payment in the Vipps or MobilePay app, the amount is reserved, and you capture it when the order ships. Capture, refunds and release run from the order page or by order status.

What it does

Offers Vipps MobilePay as a payment method at checkout. The customer is sent to the address Vipps MobilePay returns (the app opens on a phone; on a computer the customer enters the mobile number on the Vipps MobilePay page and approves in the app) and comes back to the shop.
Wallet payments only (WEB_REDIRECT). Currencies NOK, DKK and EUR: the currency of your sales unit.
An order counts as approved only after the shop has read the payment back from Vipps MobilePay and the amount equals the amount created and the order total at that time. Webhooks, the customer’s return and the cron only trigger that read-back.
Capture when the order reaches a status (default), right after approval, or by hand; partial captures; full or partial refunds of captured money; release of the rest of the reservation.
Every create, capture, refund and release is stored with its own Idempotency-Key before it is sent. An unanswered operation is read back first and never sent blind.
Webhooks are registered with one button and verified by their HMAC signature.
Credentials are sealed with AES-256-GCM, never shown again; test and production keys are kept side by side.
Order page tab with every attempt, amounts, capture deadline and the operations; log with filters and CSV export; jobs page.
Multi-Vendor: marketplace owner mode (all orders paid to the owner’s sales unit, vendor orders capture their own share) or direct payments to each vendor’s own sales unit.

Compatibility

CS-Cart, CS-Cart Ultimate, Multi-Vendor and Multi-Vendor Ultimate 4.17.2 to 4.21.x.
PHP 7.4 to 8.3, depending on your CS-Cart version; cURL and OpenSSL; MySQL 5.7+ or MariaDB 10.2+; a cron job.
An HTTPS storefront without a redirect on the webhook and return addresses (Vipps MobilePay accepts only https:// addresses).
Built for the 4.21 full page cache: the webhook and return addresses are never cacheable dispatches (design review; not yet run on a 4.21 store with the cache on).
Tested: see tests/test-plan.md (unit tests on PHP 8.1 and 8.3; HTTP and Multi-Vendor end-to-end tests against a local stand-in built from the published API specifications). Not yet run against the real Vipps MobilePay test environment; see Conformance. Tested on CS-Cart 4.17.2 (cs417: e2e 55/55, licence 43/43, lifecycle 12/12) and Multi-Vendor 4.17.2 (mv417c: e2e 40/40 after the audit fixes, vendor e2e 38/38), PHP 8.1 and 8.3 (unit 90), Smarty 5.4.3 offline compile of every template against the 4.21.2 engine; all against a stand-in built from the official specs. Not run: the Vipps MobilePay test environment, a live 4.21 store, CS-Cart Ultimate with several storefronts.

You need

A Vipps MobilePay merchant agreement with online payments and a sales unit; Vipps MobilePay charges its own fees. For testing, the keys of a test sales unit from the business portal.

Next steps

Vipps MobilePay, Vipps and MobilePay are trademarks of Vipps MobilePay AS. This add-on is not affiliated with or endorsed by Vipps MobilePay.