S4D Payment Gateway with Thawani for WooCommerce

Originally a paid plugin developed by The Source for Development (https://www.s4d.om), rewritten with Claude Code and released as open source.

Features:

• Hosted Thawani checkout — customers redirect to Thawani’s secure checkout page; PCI scope stays with Thawani.
• Saved cards — logged-in customers can tokenize cards on Thawani and reuse them at checkout.
• Refunds — full refunds from the WooCommerce admin (Thawani does not support partial refunds).
• Webhooks — optional server-to-server endpoint so payment status syncs even if the customer closes the page before redirect. Optional HMAC-SHA256 signature verification.
• WooCommerce Blocks support and HPOS compatibility.
• Currency conversion hook (thawani_gateway_convert_to_omr) for non-OMR stores.

External services

This plugin connects to Thawani Pay, the payment gateway operated by Thawani Technologies LLC (https://thawani.om), to process card payments for your WooCommerce store. Using this plugin requires a Thawani merchant account and API keys, which you enter in the gateway settings. Thawani is a third-party service and is not affiliated with this plugin’s authors.

The plugin communicates with Thawani’s API endpoints (https://checkout.thawani.om in live mode and https://uatcheckout.thawani.om in test mode) in the following situations:

• When a customer places an order with this gateway, a checkout session or payment intent is created. The data sent includes the order amount and currency, product/line-item names, a client reference derived from the order ID, and your merchant API key (sent as a request header). The customer is then redirected to Thawani’s hosted checkout page to enter their card details — no card data is handled or stored by your site.
• When a logged-in customer reuses or deletes a saved card, the plugin creates/retrieves a Thawani customer record and its stored payment methods. The data sent is a customer identifier and your merchant API key.
• When a store administrator issues a refund, the plugin looks up the payment and sends a refund request containing the payment ID, amount, and reason.
• If you configure the optional webhook, Thawani sends payment-status notifications back to your site, which the plugin verifies (optionally via HMAC-SHA256) and uses to update the order.

No data is sent to Thawani except as part of these payment operations.

• Thawani Terms and Conditions: https://thawani.om/terms/
• Thawani Privacy Policy: https://thawani.om/privacy-policy-2/

1. Upload the plugin folder to /wp-content/plugins/ or install via the Plugins screen.
2. Activate the plugin.
3. Go to WooCommerce > Settings > Payments > Thawani Gateway and enter your Thawani API keys.
4. (Optional) Copy the Webhook URL shown in the settings into your Thawani portal under Webhooks.

2.0.4

• Removed the remote jQuery Confirm script/stylesheet loaded from cdnjs.cloudflare.com; the saved-card delete confirmation now uses a native browser dialog so no external assets are requested.
• Webhook payloads decoded from the request body are now recursively sanitized before being logged or written to order meta.
• Documented the Thawani external service in the readme, including Terms of Service and Privacy Policy links.
• Added the Requires Plugins: woocommerce header and an ABSPATH guard to the blocks asset manifest.

2.0.3

• Renamed plugin constants from WC_GATEWAY_THAWANI_* to THAWANI_* to clear Plugin Check warnings about the WooCommerce-reserved WC_ prefix.
• Added a phpcs.xml.dist declaring the plugin’s accepted prefixes and text domain so coding-standard scans recognize correctly-prefixed hooks.

2.0.2

• Aligned the plugin’s text domain with the WordPress.org slug thawani-payment-gateway-for-woocommerce. Translation files have been renamed accordingly.

2.0.1

• Activation no longer emits “unexpected output” warnings; the invoice-map table is now created via a direct query that bypasses dbDelta’s reserved-word column parser.
• Plugin Check findings addressed: removed the discouraged load_plugin_textdomain() call (WP auto-loads bundled translations), tightened input casts at checkout and in the saved-card AJAX handler, and prefixed the currency conversion filter as thawani_gateway_convert_to_omr (the legacy thawani_convert_to_omr continues to work via apply_filters_deprecated).
• Bumped tested-up-to header to WordPress 6.9.

2.0.0

• First open-source release. Rewrite of the paid plugin against Thawani’s v1 API.
• Refunds now resolve the real payment_id via GET /payments before calling /refunds.
• Added a server-to-server webhook endpoint with optional HMAC signature verification.
• WooCommerce Blocks and HPOS compatibility.