Payments

Commerce → Payments opens each method on its own page. Switch it on, enter the sandbox and/or live API key, and save. Secrets are stored in encrypted plugin secrets and never sent back to the browser; the page only says whether one is set.

Mollie#

On the Mollie page, choose Mollie checkout (one choice that opens Mollie's payment page) or the methods active on your Mollie profile (each its own choice that sends the customer straight to that method). Checkout offers one or the other, not both. Show payment method logos at checkout turns the icons on or off. Each Mollie payment includes the order lines with tax, billing and shipping addresses, the visitor's language, a cancel link, and the Justflows user, customer, and order ids in its metadata. The order stays Awaiting payment until Mollie reports it paid. Apple Pay is offered only in browsers that support it.

When a Mollie payment fails, is cancelled, or expires, the customer gets one Payment failed email with a {{payment_url}} link. It opens a Finish your payment page for the same order, where they can pay another way. Paid, cancelled, or refunded orders cannot be paid again from that link.

Capture, cancel, and refund#

The Payments list shows every payment attempt. From an attempt you can capture an authorization (fully or partly), cancel an open authorization, or refund a captured amount (fully or partly). Each action carries an idempotency key, so a retry never charges or refunds twice. An action Mollie did not clearly confirm shows as waiting and is sent again for up to 45 minutes; after that, staff check Mollie's dashboard and choose It went through or It did not go through. A background job every five minutes releases expired stock holds, retries failed payment notifications, and asks Mollie about payments whose webhook never arrived.

Payment webhooks#

Mollie needs nothing registered: Shop sends its notification URL with each payment and looks every notification up at Mollie with your API key before applying it. Each notification is stored once, so a duplicate, or a notification arriving together with the shopper's return, marks the order paid once, with one email and one stock commit. A notification that cannot be applied is answered with an error so Mollie sends it again. The token in the URL is random and created the first time you save the method; treat the whole URL as a secret. Webhook routes skip the session CSRF token and are limited to 60 requests a minute per IP.

https://<your-site>/api/shop/payments/hooks/<method>/<token>