Troubleshooting

“Test connection” fails

Check the mode: test keys work only in test mode and production keys only in live mode. The test environment is apitest.vipps.no and needs a test sales unit.
Check for spaces before or after the client id, the secret and the subscription key. The MSN is a number with 4 to 10 digits (“The Merchant Serial Number (MSN) is a number with 4 to 10 digits.”).
Open Log: the answer of Vipps MobilePay is shown (title, detail, trace id), masked. With Debug log on, the masked request is stored too.
Your server must reach Vipps MobilePay over HTTPS (outgoing port 443) and have a current CA bundle.

“Register webhook” fails

The storefront must run on HTTPS; Vipps MobilePay accepts only https:// addresses, no redirects and common ports (80, 443, 8080).
Test the keys first with Test connection.
If the shop address changed (domain, HTTPS), the page says “The shop address changed since it was registered: register it again.”

Webhooks are rejected or never arrive

The log lists rejected webhooks with the action “webhook”: “missing or wrong HMAC signature” means the stored secret does not belong to the registration. Click Register webhook again (it replaces the registration).
Check that the address is reachable from the internet without a login, IP filter, bot challenge or redirect.
Behind a proxy or FastCGI the Authorization header can be removed. The add-on reads the PHP-FPM fallbacks; if your server still strips it, pass it on (for Apache SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1).
Without a webhook the customer’s return and the cron still settle payments.

An order stays unpaid after the customer approved

Open the order’s Vipps MobilePay tab and click Read back.
Check the cron: the Jobs page and the log show the last runs. If nothing ever runs, run php admin.php --dispatch=kv_vipps_mobilepay.cron once by hand.
A flag Amount mismatch means the order total changed while the payment was pending; the reservation was released. Ask the customer to pay again.
A flag Order was cancelled means the customer approved after the order was cancelled; the reservation was released.
Check the Vipps MobilePay business portal for the payment (the reference starts with your prefix).

The customer says the app shows nothing or an error

The sales unit currency must match what the portal expects (NOK, DKK or EUR) and the order total must be inside the limits (NOK 1.00 minimum, DKK and EUR 0.01, maximum 650000.00).
The shop must have the sales unit currency defined if the cart is in another currency (“This payment method cannot be used with the shop’s currency settings.”).

Vipps MobilePay is not offered at checkout

Check Settings > Enable, the license status, the payment method (active, the right storefronts) and that the Connection page says “Connected” for the selected mode.
The order total is outside the accepted range, or the shop does not have the sales unit currency.
Multi-Vendor, owner mode off: a cart with several vendors does not offer the method, and a vendor without a sales unit is not offered.

A capture, refund or release shows “Unconfirmed”

The add-on did not get a clear answer. It reads the payment back before it sends anything again; if the totals show the operation it is marked done, otherwise it is sent again with the same Idempotency-Key within 24 hours. After 24 hours it is closed as “not confirmed, check the business portal”. Check the portal and, if needed, repeat the action.

The capture deadline

If a reservation passes its “Capture guaranteed until” date, capture may fail. The banner on the payments list and the log warn 3 days ahead. Capture or release in time.

A job is “Waiting to retry” or “Gave up”

The last error is shown in the list. Fix the cause (keys, outage) and press Retry. Jobs retry after 5 minutes, 15 minutes, 1 hour, 3 hours and 12 hours.

The cron address answers “Forbidden”

The key in the address is wrong. Copy the address again from the settings page.

Still stuck

Contact us through https://cs-cart.kaviolabs.com with the add-on version, the CS-Cart version and the relevant log lines (secrets are masked automatically).