WooCommerce plugin

WooCommerce plugin

The Biz Invoice Pay WooCommerce plugin adds "Pay by card (Biz Invoice Pay)" to your checkout. Customers pay on Biz Invoice Pay's secure hosted checkout; your store is notified by signed webhook and the order is marked paid automatically. Card data never touches your server.

Requirements

• WordPress 6.2+ with WooCommerce 8.0+
• Store currency USD (the gateway hides itself otherwise)
• An Biz Invoice Pay account with an API key (inv_test_… / inv_live_…)
• HTTPS on your store (required for webhooks and live checkout)

Install

1. Download invoicly-for-woocommerce.zip and upload via Plugins → Add New → Upload, then activate.
2. Go to WooCommerce → Settings → Payments → Biz Invoice Pay and enable it.

Enter your API key

Paste your Biz Invoice Pay API key (Dashboard → Settings → API keys). Keys starting with inv_test_ put the plugin in test mode (visible TEST MODE badge); keys starting with inv_live_ are live. Never enter a Stripe secret key — the plugin has no field for one and never handles one.

Webhook URL

Copy the webhook URL shown on the settings page (https://yourstore.com/?wc-api=invoicly), add it in Biz Invoice Pay → Settings → Webhooks (subscribe to payment.succeeded, payment.failed, payment.refunded), then paste the signing secret back into the plugin settings. Click Test connection to verify.

Test mode checklist

1. Use an inv_test_… key and point the API base URL at your Biz Invoice Pay instance.
2. Place a test order and pay with 4242 4242 4242 4242 (mock mode).
3. The order-received page shows "We're confirming your payment…" while the

plugin polls; the order should flip to Processing once the webhook arrives.

1. Check the order's Biz Invoice Pay payment meta box for the payment id.
2. Issue a partial refund from the order screen and confirm the order note.

Going live

1. Switch the API key to an inv_live_… key.
2. Confirm the webhook URL uses HTTPS and the signing secret is set.
3. Place a real small order yourself before announcing it.

How it works (design notes)

• Checkout: process_payment() creates a payment session via

POST /api/v1/payment-sessions with an idempotency key derived from the order id + total, saves the session id, sets the order to Pending, and redirects to the hosted checkout url.

• Webhook: the receiver reads the raw body and verifies the

Biz Invoice Pay-Signature header (t=…,v1=…, HMAC-SHA256 of t.body, constant-time compare, 5-minute tolerance) — see Webhooks. Deliveries are idempotent via the Biz Invoice Pay-Delivery id.

• **payment.succeeded** verifies amount_cents matches the order total before

calling payment_complete(); mismatches put the order on hold for review.

• Never trusts the redirect: the browser return URL alone never marks an

order paid — only the verified webhook or a server-side session status check.

• Refunds: process_refund() calls POST /api/v1/payments/:id/refunds;

refunds originating in Biz Invoice Pay are mirrored as WooCommerce refund records (loop-safe).

Troubleshooting

For the full developer guide (Docker test rig, contract tests, packaging), see the plugin's README.md.