CatCode Card Payments with Mono for WooCommerce

A WooCommerce payment gateway for monobank acquiring (Monobank Acquiring API).

The customer pays on the secure monobank page and comes back to a confirmed order — the confirmation itself arrives over a webhook whose ECDSA signature is verified against the merchant public key, so a forged callback cannot mark an order as paid.

• Invoice creation and redirect to the monobank payment page.
• Automatic order confirmation through the webhook, with ECDSA signature verification (X-Sign).
• Status re-check when the buyer returns to the thank-you page, in case the webhook is delayed.
• The paid amount and currency are compared with the order before it is completed.
• Cart contents (basketOrder) are sent with the invoice, so the receipt lists real items.
• Classic checkout and block checkout (Checkout Blocks), HPOS compatible.
• Test mode with a separate test token — the whole flow can be checked without a contract.
• Merchant tokens are stored encrypted at rest.

Tokens

The live token is issued in the monobank merchant dashboard after the acquiring contract is signed. A test token is free and is created at https://api.monobank.ua/ with the “Create test token” button.

Опис українською

Платіжний шлюз для WooCommerce, що приймає оплату карткою через еквайринг monobank.

• Створення рахунку і перенаправлення покупця на захищену сторінку оплати monobank.
• Автоматичне підтвердження замовлення вебхуком з перевіркою ECDSA-підпису (X-Sign).
• Резервна звірка статусу при поверненні покупця — на випадок затримки вебхука.
• Сума і валюта оплати звіряються із замовленням перед підтвердженням.
• Склад кошика передається у рахунок (basketOrder) — у чеку видно реальні позиції.
• Класичний і блоковий чекаут, сумісність з HPOS.
• Тестовий режим з окремим токеном — інтеграцію можна перевірити без договору.
• Токени мерчанта зберігаються в базі зашифрованими.

monobank — сторонній сервіс. Цей плагін є незалежною інтеграцією від CatCode і не афілійований з monobank чи Universal Bank.

External services

This plugin connects to the monobank acquiring API so the store can create payment
invoices and confirm orders. Nothing is sent anywhere else.

monobank Acquiring API (https://api.monobank.ua)

• When an order is placed with this gateway, the plugin sends the order amount, order
  number, currency, the cart line items (name, quantity, price), the return URL and the
  webhook URL, so monobank can create the invoice and redirect the buyer to its payment page.
• When the buyer returns, or when the webhook fires, the plugin asks the API for the
  invoice status and the merchant public key used to verify the callback signature.
• The “Check the token” button in the settings requests the merchant details to confirm
  the token works.
• API documentation: https://api.monobank.ua/docs/acquiring.html
• monobank terms, public offers and personal data documents: https://monobank.ua/terms

No customer data is sent to CatCode or to any other third party.

monobank is a third-party service. This plugin is an independent integration built by
CatCode; it is not affiliated with, endorsed by or sponsored by monobank or Universal Bank.

1. Upload the plugin to /wp-content/plugins/ and activate it.
2. Go to WooCommerce → Settings → Payments → Mono Acquiring.
3. Enable the method, paste a token (test or live) and save.
4. The webhook URL is set automatically with every payment — nothing to configure by hand.

1. 

   The monobank payment method in the WooCommerce checkout.

2. 

   Gateway settings: tokens, test mode and the connection check.

3. 

   The monobank payment page the buyer is redirected to.

4. 

   A paid order with the monobank payment notes.

1.0.5

• Fixed: on sites where every language has a URL prefix (Polylang), the buyer came back from monobank to a “Page not found” page instead of the thank-you page.

1.0.4

• Fixed: while the full version from catcode.com.ua is installed, deleting this copy keeps the shared settings, so the full version goes on working with them. Without the full version, deleting still removes everything.
• Changed: while the full version is active, this copy switches itself off instead of loading next to it (no more PHP warnings).

1.0.3

• Fixed: the basket monobank shows on the payment page (and passes on to the fiscalisation) did not add up to the charged amount — shipping and fees were missing from it and an order-level discount was not taken into account at all. Shipping and fees are now their own rows, the rest of the difference is spread over the product rows, and quantity x price always equals the row total.

1.0.2

• Security: stored API keys are now encrypted with AES-256 (OpenSSL) instead of the old XOR obfuscation, which some hosting antivirus scanners flagged and deleted. Keys saved by earlier versions keep working.

1.0.1

• Fixed: the “Check the token” button on the settings screen did nothing — the
  script and the AJAX endpoint behind it were missing from the build.

1.0.0

• First release: invoice creation, redirect payment, webhook with ECDSA signature
  verification, thank-you page reconciliation, cart contents in the invoice, block
  checkout and HPOS support, encrypted token storage.