iyzico Virtual POS Payment Gateway for CS-Cart - One Store - SoftCrafter

Softcrafter iyzico adds iyzico's hosted Checkout Form to CS-Cart. The card is typed on iyzico's own page, so no card number ever reaches your store, your database or your backups.

What decides whether an order is paid

iyzico does, twice. The add-on asks iyzico for the payment and verifies iyzico's signed notification; the page a customer lands on confirms nothing. A forged or replayed notification cannot pay an order, and a repeated one cannot pay it twice. The amount must match the frozen payable total of the order to the kurus, and the payment must belong to that attempt, that order and your merchant account.

Cancellations and refunds an operator can be trusted with

• Two steps: a server-side preparation states exactly what would be sent, then an administrator holding the privilege confirms it.
• A full reversal on the same day is sent as a cancellation; iyzico's own answer decides whether it becomes a refund instead. Partial amounts are refunds, and the remaining refundable balance is recalculated from what iyzico confirmed.
• An unreadable result is never resent. That is the one rule that keeps a customer from being refunded twice: the amount stays reserved and the item is queued for a provider query and an authorised repair.
• Two order statuses, Refunded and Partially Refunded, are created for you to use. The add-on never picks one for you.

Operations

• A payment journey tab on every order: the attempt, the initialization, iyzico's verification, the finalization and any reversal, with safe references only — never a raw provider payload, a token or card data.
• An unresolved-work queue for payments that need a person, with a side-by-side comparison against iyzico and an explicitly confirmed repair.
• Two separate privileges, so reversing money and repairing records can be held by different people.
• Scheduled, rate-budgeted recovery from the command line, so a stopped payment does not wait for somebody to notice it.
• API and secret keys are stored encrypted with the store's crypt key and are write-only in the interface. No screen ever shows key material.
• Upgrading is self-completing: CS-Cart runs no database queries on an in-place upgrade, so the add-on creates whatever its schema is missing on the first admin page load and says so if it cannot.

Requirements

• CS-Cart 4.20.x, single-store edition, PHP 8.1 or newer
• An iyzico merchant account: merchant identity, API key and secret key
• HTTPS reachable from the internet. iyzico posts its notification to your store; without it a customer pays and the order stays unpaid
• Turkish Lira. The add-on offers itself to a TRY cart and to no other

Full documentation, in English and Turkish: docs.softcrafter.dev/iyzico

Built and supported by Softcrafter · tech@softcrafter.net