by Kavio Labs · for OpenCart 4.1.x
Przelewy24 for Polish shops: the customer pays on the Przelewy24 page with BLIK, a bank transfer or a card; every notification is checked against the order (signature, merchant, POS, session, amount, currency) and confirmed with the verify call before the order counts as paid; repeated notifications change an order once, a lost notification is recovered by the return and the cron, and full or partial refunds start from the order page. You connect with your own Przelewy24 merchant account. A payment extension with events and cron, no OCMOD.
Przelewy24 for Polish shops: the customer pays on the Przelewy24 page with BLIK, a bank transfer or a card; every notification is checked against the order (signature, merchant, POS, session, amount, currency) and confirmed with the verify call before the order counts as paid; repeated notifications change an order once, a lost notification is recovered by the return and the cron, and full or partial refunds start from the order page. You connect with your own Przelewy24 merchant account. A payment extension with events and cron, no OCMOD.
Przelewy24 Payments works with OpenCart 4.1.0.4.
We list the builds we install and test on. “Tested” means the test plan ran on that build; “Supported” means the build is inside the supported range.
| Version | Range | Runs on | Status |
|---|---|---|---|
| OpenCart 4.1.0.x | 4.1.0.0 – 4.1.0.4 | PHP 8.1 – 8.3 | Tested on 4.1.0.4 |
| OpenCart 4.0.2.x | 4.0.2.0 – 4.0.2.3 | PHP 8.0 – 8.2 | Supported |
The Documentation tab covers the settings and every screen.
OpenCart 4.1.0.4. Tested on OpenCart 4.1.0.4. The Compatibility tab lists every version range.
No. They work through OpenCart events and standard extension types (modules, order totals, themes). No core file edits, no OCMOD patches, no theme template edits, so OpenCart updates and other extensions keep working.
One production store domain with every subdomain (www, shop., staging.), plus local development hosts such as localhost, *.local and *.test. A store on another domain needs its own license; a second-store license is 40% off. You have 14 days after installing to enter the key. 12 months of updates and support are included; after that the extension keeps working and renewals are 50% off. How licensing works
Yes. Ask for a full refund within 30 days of your first purchase, no reason needed: open a ticket or write to [email protected] with your order number. The money goes back to the card or bank account you paid with within 5 business days of approval. Refund policy
Open a ticket from your account, so your license details are attached. We answer Monday to Friday: bug reports within 1 business day, how-to questions within 2. Support policy. Not a customer yet? Ask a pre-sales question.
7 more answers about setup and daily use in the Documentation tab.
Przelewy24 Payments adds Przelewy24 to the checkout of your OpenCart 4 shop. The customer confirms the order, pays on the secure Przelewy24 page with BLIK, a bank transfer (pay-by-link) or a card, and returns to your shop. You connect with your own Przelewy24 merchant account.
What it does
Przelewy24 and BLIK are trademarks of their owners; this extension is independent software and is not affiliated with or endorsed by Przelewy24. The Przelewy24 logo is not used.
Requirements: OpenCart 4.1.0.x, PHP 7.4 or newer with cURL and OpenSSL, a Przelewy24 merchant account (a sandbox account for testing), HTTPS on the shop (Przelewy24 sends its notification there).
kv_przelewy24.ocmod.zip and click Install.Uninstall: Extensions > Payments > Uninstall removes the settings, the keys, the payment records, the refunds and the log. Payments already taken stay with Przelewy24 and in the order history.
Update: upload the new zip in the Installer; settings and keys stay.
Extensions > Extensions > Payments > Przelewy24 Payments.
| Setting | Meaning |
|---|---|
| Status | Offer Przelewy24 at checkout (needs a complete connection) |
| Name at checkout | Shown to the customer |
| Payment methods on the Przelewy24 page | All methods of your account, BLIK only, cards only, pay-by-link only |
| Time to pay | Minutes the customer has on the Przelewy24 page (0 = Przelewy24 default, at most 99) |
| Geo zone, sort order | As for any OpenCart payment method |
Test and live credentials are stored separately: POS id, merchant id (empty = same as POS id), API key and CRC key. Keys are stored encrypted and never shown again; leave a field empty to keep the stored value, type a single minus sign to clear it. Save and test connection calls the Przelewy24 test access of the selected mode and counts your payment methods.
The notification address shown on the tab is sent with every payment; there is nothing to enter in the Przelewy24 panel.
| Setting | Meaning |
|---|---|
| While waiting for payment | Missing order until paid (default) or a visible status |
| Paid | Set after the verify call succeeded; orders already processing or complete are not moved back |
| Fully refunded | Set when the refund of the last part is completed |
| E-mail the customer | Send the status e-mail when the order becomes paid |
The log lists calls and confirmed payments; errors are always kept, with Debug log every request is kept (keys masked). Entries older than 60 days are removed. The OpenCart cron reads open payments back every hour for 14 days; the tab shows the cron command and a secret web address for other schedulers.
Customer. Chooses Przelewy24 in the payment dialog, confirms the order, is taken to the Przelewy24 page, pays and returns to the shop. If the customer comes back without paying, the shop shows the payment failed page and the order stays unpaid; the customer can try again.
You. The order page has a Przelewy24 tab with the amount, state, Przelewy24 transaction id, refunds and, for payments that are not confirmed yet, Read back from Przelewy24. To refund, enter an amount in the payment currency (empty = the rest) and press Refund; the result arrives as a notification and appears in the order history. A rejected refund returns the amount to the refundable balance.
A payment shown as Duplicate payment is a second verified payment for an order that was already paid: refund it.
| Item | Value |
|---|---|
| Extension code | kv_przelewy24 (type payment) |
| Settings | payment_kv_przelewy24_* |
| Tables | kv_przelewy24_txn, kv_przelewy24_refund, kv_przelewy24_log |
| Events | admin/view/sale/order_info/before (order tab) |
| Cron | extension/kv_przelewy24/payment/kv_przelewy24.cron |
| Routes (catalog) | .confirm (register, redirect), .back (customer return), .notify (urlStatus), .cron |
The controller and model files are named kv_przelewy_24.php: the OpenCart 4 autoloader puts an underscore before every digit of a class name (KvPrzelewy24 is loaded from kv_przelewy_24.php). The core installer still checks that admin/controller/payment/kv_przelewy24.php exists, so that file is an empty marker.
Money rules: amounts are integers in grosz; merchantId, posId, orderId and amount are sent as integers because the checksum is made from the typed JSON; the Przelewy24 transaction id does not fit 32 bits and is stored as bigint. A payment is paid only after PUT /api/v1/transaction/verify succeeded.
Tests: php81 tests/unit.php and php83 tests/unit.php (needs node tests/mock-server/server.js 11958 and MariaDB), node tests/e2e.js on a dev store. The hidden setting payment_kv_przelewy24_base_url (loopback hosts only) points the extension to the mock.
Against the Przelewy24 REST API v1 documentation (developers.przelewy24.pl, OpenAPI 1.0.18 as read for the sister add-on). The extension is proven against a local stand-in that follows these pages (unit and browser tests); it has not been run against a live or sandbox Przelewy24 account. The documentation site renders in the browser only, so it was not re-read word for word for this port; items under "To confirm" are taken over from the first reading and must be confirmed with your sandbox account.
| Topic | Documented behaviour | What the extension does |
|---|---|---|
| Hosts | Production https://secure.przelewy24.pl, sandbox https://sandbox.przelewy24.pl (separate accounts) | Test mode uses the sandbox, Live mode production; credentials per mode |
| Authentication | HTTP Basic: user = POS id, password = API key | As documented |
| Test access | GET /api/v1/testAccess answers {"data": true} | Connection test; also counts GET /api/v1/payment/methods/{lang} |
| Register | POST /api/v1/transaction/register; sign = SHA-384 of the JSON {sessionId, merchantId, amount, currency, crc} | Typed JSON (integers for ids and amount), flags JSON_UNESCAPED_UNICODE and JSON_UNESCAPED_SLASHES; sends merchantId, posId, sessionId, amount, currency, description, email, country, language, urlReturn, urlStatus, waitForResult, encoding and optional client, address, zip, city, timeLimit, channel; answers a token, the customer goes to {host}/trnRequest/{token} |
| Verify | PUT /api/v1/transaction/verify; sign over {sessionId, orderId, amount, currency, crc} | Called after every checked notification or read-back; only a status: success answer marks the order paid |
| Notification (urlStatus) | JSON body merchantId, posId, sessionId, amount, originAmount, currency, orderId, methodId, statement, sign; sign over the fields in this order plus the CRC key; must be answered HTTP 200 | Signature compared in constant time; merchantId and posId must equal the account of the transaction (the mode stored with the session); the session must be one we registered; amount, originAmount and currency must equal the registered ones; any failure answers 4xx and verifies nothing; a repeated notification answers 200 without a second verify |
| Refund notification | orderId, sessionId, refundsUuid, merchantId, amount, currency, timestamp, status, sign; sign over {orderId, sessionId, refundsUuid, merchantId, amount, currency, status, crc}; status 0 completed, 1 rejected | Same checks plus refund uuid, amount and Przelewy24 transaction id must match the refund we sent; idempotent |
| Read back | GET /api/v1/transaction/by/sessionId/{sessionId}; status 0 none, 1 advance, 2 paid, 3 returned; 404 when the customer has not started | Status 2 starts the same checks and verify call as a notification |
| Refund | POST /api/v1/transaction/refund with requestId (max 45), refunds[{orderId, sessionId, amount, description (max 35)}], refundsUuid (max 35), urlStatus; answers 201, 409 on conflict | As documented; the amount is reserved before the call and returned when the call fails or the refund is rejected |
| Errors | {"error": "text", "code": n} or {"error": [{"message": ...}], "code": 409} | Message shown to the administrator; network errors, 5xx and 429 are retryable |
channel bit mask: taken over from the first reading, not re-read.Card-on-file and recurring payments, instalments, wallets with their own API, multiple POS ids per store, other currencies.
Trademark: Przelewy24 and BLIK are trademarks of their owners; this extension is not affiliated with or endorsed by Przelewy24. The Przelewy24 logo is not used (no terms for third-party use were found, so the name appears in text only).
No.
Only when Przelewy24 confirms it: the return reads the payment back and confirms it with the verify call.
The customer paid but the order is not paid. Przelewy24 repeats the notification; the cron also reads the payment back. Use "Read back from Przelewy24" on the order tab to do it at once, and check the log.
By default an unpaid order is a missing order (Sales > Orders > filter Missing Orders). Choose a visible status under Order statuses to see it earlier.
PLN, EUR, GBP, CZK (the currency must be enabled on your Przelewy24 account). Other cart currencies are charged in PLN when the store has PLN.
Not supported; the method is hidden for them.
No, OpenCart 4 only.
No.
Buy with confidence
This product was tested on this build. Builds we did not test are not listed.
Updates and support are included in the price. The product keeps working afterwards; renewing is optional.
How licensing worksIf it is not what you expected, tell us within 30 days and we refund the order.
Refund policyPay by card, Apple Pay or Google Pay on Stripe's secure page. Your card number never reaches our server.
Ask a pre-sales questionSold by Kavio Labs Software Limited, registered in England and Wales No. 17532441. About us
More for OpenCart
Server-side tracking for OpenCart 4.x and 3.0.x: purchases, refunds, add to cart, checkout, product views and leads go from your server to the free official GA4 Measurement Protocol, Meta Conversions API and TikTok Events API, deduplicated with the browser pixels through shared event ids. Consent-aware, SHA-256 hashed customer data, order status mapping, queue with retries, test mode and an event log. No paid relay, events only, no OCMOD.
The department store theme for OpenCart 4.x and 3.0.x: colour-coded departments, a department list beside the hero slider with two side promos, a big search with a department selector, tabbed product blocks, a 2 + 1 + 2 offer grid, deals of the day with real countdowns, a department showcase, a promotions band and a three-column product page with a sticky buy box. Four styles (Meridian, Harbor, Citrus, Night) and your own colours on top. Events only, no core changes.
Stop AI crawlers, scrapers, vulnerability scanners and unwanted countries before OpenCart 4.x or 3.0.x builds a page. Googlebot and Bingbot are verified by DNS and always allowed; 50+ bots get one switch each; country rules use free GeoIP databases and can close only the checkout; IP and network lists, rate limits, honeypots and the cart flood fix; a one-second challenge instead of a captcha; learning mode, dashboard, log, IP tester and Cloudflare export. No core changes, no OCMOD.
