Fynex for WooCommerce
Hosted checkout, signed webhooks, refunds from the order screen. Card data never touches your store.
What the plugin does
Everything in the current release, in the order a store meets it.
Hosted checkout
Customers are sent to a Fynex-hosted payment page and returned to your store. Card details are entered there, never in WordPress — your PCI scope stays minimal.
Classic and Blocks checkout
Fynex appears as a payment method in the classic shortcode checkout and in the Cart & Checkout Blocks. One plugin, both flows.
Signed webhooks
Fynex posts payment events to your store signed with HMAC-SHA256. The plugin verifies the signature and a five-minute timestamp window before it touches an order.
Amount-matched confirmation
An order is marked paid only when the confirmed amount and currency match the checkout that was created for it. A mismatch flags the order for review instead of fulfilling it.
Full and partial refunds
Refund from the WooCommerce order screen. The plugin submits the refund to Fynex and records it in WooCommerce once Fynex confirms it, so the two never disagree.
HPOS and idempotency
High-Performance Order Storage is declared. Every checkout and refund request carries an idempotency key, so a retried request never creates a second charge.
How a payment moves
Three exchanges between your store and Fynex, all of them signed.
- 1
Checkout
On Place order the plugin creates a hosted checkout for the order's total and currency, with a per-attempt reference, and redirects the customer to it. The order waits as Pending payment.
- 2
Confirmation
Fynex confirms the payment to your store's webhook. The plugin checks the signature, matches amount and currency to the attempt, and marks the order paid. Failed or cancelled attempts set it to Failed so the customer can retry.
- 3
Refund
A refund from the order screen goes to Fynex with an idempotency key. WooCommerce records it when Fynex confirms — by webhook, or by the plugin checking back a minute later.
Install and connect in four steps
A store owner does this once. No code, one token.
Upload the plugin
Download the release zip, then in WordPress open Plugins → Add New → Upload Plugin, install and activate. WooCommerce must already be active.
Get your seller token
In the Fynex dashboard open Integration and copy the API token for the seller account this store belongs to.
Paste it and save
Open WooCommerce → Settings → Payments → Fynex → Manage, paste the token and save. The plugin registers your store's webhook with Fynex and stores the signing secret itself.
Enable and test
Add your store's HTTPS host to the allowed return hosts in Fynex, tick Enable Fynex payments, and place a test order. A demo token runs the whole flow against demo money.
What this version does not do
Version 0.1.0 covers hosted checkout, signed confirmations and reconciled refunds. It does not yet do manual capture, saved cards, WooCommerce Subscriptions, or split payouts to vendors of a multi-vendor store, and it is not yet listed on WordPress.org — install it from the GitHub release.
Demo and live are chosen by the token you paste, not by a switch in the plugin: the plugin always talks to api.fynex.ai.
Built so the store and the money cannot disagree
The checks a payments reviewer looks for, already in the code.
Signed and time-boxed
HMAC-SHA256 over the timestamp and the raw body, constant-time comparison, a five-minute skew window, and replayed event IDs dropped.
No card data in WordPress
The hosted page handles the card. The store holds a checkout URL and an order reference, nothing a breach could use.
Secrets kept apart
The API token and the webhook secret live in their own autoload-off options, not in the gateway settings blob, and are never rendered back to the browser.
The three calls the plugin makes
Every request below is what the plugin sends to the Fynex Payments API. Same endpoints if you build your own integration.
Create the checkout for an order
Amount, currency, the store's return URLs and a per-attempt reference. The response carries the URL the customer is sent to.
POST /payments-api/v1/checkout
{ "externalOrderRef": "wc-1042-1",
"amount": 129.00,
"currencyCode": "GBP",
"autoSettlement": true }
→ { "checkoutUrl": "https://…" }Register the store's endpoint
Done once when the token is saved. Fynex returns the signing secret the plugin will verify every event against.
POST /payments-api/v1/webhooks
{ "webhookUrl":
"https://store.example
/wp-json/fynex/v1/webhook" }
→ { "secretKey": "whsec_…" }Refund part of an order
Sent when a refund is issued from the order screen. Idempotent, so a double click never refunds twice.
POST /payments-api/v1/payments
/wc-1042-1/refund
Idempotency-Key: 6f1c…
{ "amount": 25.00 }Confirm before recording
If the refund webhook has not arrived a minute later, the plugin asks. WooCommerce records the refund only on *succeeded*.
GET /payments-api/v1/refunds/{id}
→ { "status": "succeeded" }