CartModules: Swish Payment Gateway

Why Swish?

• 9+ million users -- Swish is used by the vast majority of Sweden's adult population
• Instant payments -- Funds are transferred in real-time via Bankgirot
• High conversion -- Familiar, trusted payment method for Swedish shoppers
• Low friction -- Customers approve payments with a single tap in their app
• Low fees -- Competitive merchant fees compared to card payments

Key Features

Swish E-commerce API v2

Built on the latest Swish for Merchants API with full e-commerce flow support. Creates payment requests that trigger push notifications to customers.

mTLS Security

Uses mutual TLS (client certificate) authentication as required by Swish. Your certificate credentials never leave your server.

Async Callbacks

Server-to-server callbacks ensure reliable payment status updates even if the customer closes their browser.

Sandbox Support

Full sandbox/test mode support. Develop and test your integration before going live using Swish test certificates.

Status Mapping

Configure which CS-Cart order status maps to each Swish payment outcome (PAID, DECLINED, ERROR, CANCELLED).

Idempotent Processing

Duplicate callbacks are handled gracefully. Already-processed orders are never re-processed, preventing double charges.

How It Works

1. Customer selects Swish at checkout and confirms the order.
2. Your store creates a payment request via the Swish API.
3. Customer receives a push notification in their Swish app.
4. Customer opens Swish, reviews the payment details, and approves.
5. Swish sends a server callback confirming the payment status.
6. Your store automatically updates the order to Processed.

Requirements

Configuration

Installation

1. Go to Add-ons > Manage add-ons, click Manual installation, and upload the addon zip
2. Activate the addon and enter the license key
3. Go to Administration > Payment methods and create a new payment method with the Swish processor.
4. Enter your Swish merchant number, certificate path, and passphrase.
5. Test using sandbox mode, then switch to live when ready.

Security

• All API communication uses TLS 1.2+ with mutual TLS (client certificate authentication).
• SSL peer verification is always enabled -- never disabled.
• Certificate paths and passwords are never logged in plain text.
• No customer card data is handled (PCI SAQ A compliant).
• All database queries use parameterized placeholders.
• All user input is type-cast and sanitized.
• Callbacks are idempotent -- duplicate notifications are handled safely.