Relqor connects WooCommerce to the Up2pay e-Transactions hosted payment page (Paybox System protocol). Your customers enter their card details on the payment platform’s secure page, never on your site.

Relqor is an independent plugin. It is not affiliated with, endorsed by or supported by Verifone, Up2pay or Crédit Agricole. Up2pay e-Transactions and Paybox are trademarks of their respective owners. You need an Up2pay e-Transactions merchant contract (SITE, RANG, IDENTIFIANT and HMAC key) to use this plugin.

Reliability first:

Order statuses are only changed by the signed server-to-server notification (IPN). The signature is verified with the platform’s public key, and the amount and reference are checked against the order. Duplicate notifications have no effect.
Manual confirmation in production mode, on by default. A signed “payment accepted” notification puts the order on hold instead of marking it as paid, because the signed data does not identify your merchant account. In the Vision back office, check that your account has an accepted transaction (authorized or captured; not declined, cancelled or pending) for the order’s reference and amount (the transaction number alone proves nothing), then set the order to Processing or Completed. You can turn this off in the settings (see the FAQ). In test mode, an accepted payment marks the order as paid automatically (an order that has a payment attempt created in production mode keeps the production rules), so the payment method is only offered to logged-in users who can manage WooCommerce (administrators and shop managers): other visitors do not see it.
The customer return page never changes an order, and only shows the order page to the customer who placed it (same browser session or logged-in account).
HMAC-SHA512 request signing, with a test and a production key set.
Automatic fallback to the secondary payment server when the main one is unavailable.
Classic checkout and WooCommerce Checkout block, HPOS and legacy order storage.
Shipping address and pickup-point data are left untouched.
Settings are never lost on update. Uninstalling keeps your settings unless you define RELQOR_REMOVE_ALL_DATA.
Logs in WooCommerce > Status > Logs (source relqor), with no card data and no secret.

Supported currency: euro only (the Up2pay e-Transactions platform only accepts EUR).

External services

This plugin relies on the Up2pay e-Transactions online card payment service, provided by Crédit Agricole (your bank), which runs it on Verifone’s Paybox platform. The service is required: without it no payment can be taken. Using it is governed by the contract you (the merchant) sign with your Crédit Agricole regional bank; the plugin does not create any contract. The platform’s payment page, not your store, collects the card details; it also sees the customer’s IP address and browser, like any website.

When the service is used

When the customer confirms the order, the plugin only records a payment attempt; nothing is sent yet.
On the “Pay for order” page, the plugin builds a signed form. Before showing it, your server checks that the payment server is available: it requests the platform’s public status page /load.html (5 seconds timeout, no redirect followed). The result is kept for 60 seconds per server. The secondary server is only checked when the main one is not available. No customer or order data is sent: only the standard headers of WordPress, including its User-Agent (WordPress version and your site address).
The customer’s browser then posts the form to the payment page (/php/ on the available server). Each new display of the page (refresh, back button) creates a new payment reference.
After each payment attempt, the platform’s server calls your store’s notification URL (?wc-api=relqor_ipn, GET request) with the signed result. This is the only message that can change the order status.
When the customer comes back from the payment page, their browser opens ?wc-api=relqor_return on your store with the same signed values; it only shows a message and never changes the order.

Data sent to the payment platform

Sent by the customer’s browser in the signed form:

your SITE, RANG and IDENTIFIANT;
the order amount in cents and the currency (euro), and the order reference (<order ID>-<attempt>);
the customer’s billing email address (ASCII only, at most 80 characters; an internationalized domain name is converted to its ASCII form when possible);
the date and time of the request, the requested response format, the signature algorithm and the payment page format (responsive);
the number of items in the order (from 1 to 99);
the billing first name, last name, address lines 1 and 2, postcode, city and country (numeric code), cut to the platform’s field lengths;
the billing phone number, sent as the mobile phone field with the country calling code, only when it has 1 to 10 digits and the calling code is known;
the page language (3-letter code of the current WordPress language; French when not supported);
your store’s 4 return URLs and its notification (IPN) URL.

The request is signed with HMAC-SHA512 and your HMAC key; the key itself is never sent. The plugin sends no card data and no IP address.

Data received and stored

After each payment attempt, the notification contains: the amount, the reference, the authorization number, the response code, the transaction number, the call number, the payment type, the card type (brand, e.g. CB or Visa), the 3-D Secure authentication status, the 3-D Secure guarantee, the 3-D Secure version and the platform’s signature. No card number is requested or stored.

Once the signature is verified, the plugin stores in the order:

the transaction number (_relqor_transaction; also the order’s transaction ID when an accepted payment marks the order as paid automatically), next to the call number (_relqor_call_number) and the response code (_relqor_code);
the notifications already processed (_relqor_ipn_done, as SHA-256 fingerprints of their signed content), so that a repeated notification has no effect;
when manual confirmation puts an order on hold, the reference of the signed “payment accepted” notification awaiting your confirmation (_relqor_signed_success), kept so that later notifications for that order only add a note;
an order note: for an accepted payment, the authorization number, the transaction number, the reference and the 3-D Secure result; otherwise the response code and its meaning.

Any received value that is not plain text (letters, digits, spaces and _ . : / + -, at most 64 characters) is never copied: it is shown as “(invalid)”. The plugin also records its own payment attempts (_relqor_attempts: reference, amount, dates, and the mode (test or production) and manual confirmation setting in force when each attempt was created). The payment type and card type are not stored. The WooCommerce log (source relqor) records the IP address of the server that sent a notification when this address is not in the platform’s published list or when the signature is invalid.

Payment page addresses (test / production)

Test mode (the default): recette-tpeweb.e-transactions.fr, with no secondary server by default.
Production mode: tpeweb.e-transactions.fr (main server) and tpeweb1.e-transactions.fr (secondary server) by default.

These addresses are prefilled in the settings and can be changed; any HTTPS payment server you enter is used in the same way.

Legal pages

Up2pay e-Transactions (Crédit Agricole, the service provider):

The service: https://www.ca-moncommerce.com/credit-agricole/up2pay-e-transactions/
Service FAQ: https://www.ca-moncommerce.com/espace-client-mon-commerce/up2pay-e-transactions/faq/
General terms of the remote card payment acceptance contract, including the specific terms of the Up2pay e-Transactions services option (PDF, edition of 1 January 2024): https://www.credit-agricole.fr/content/dam/assetsca/master/public/commun/documents/CG-FIP_Contrat%20Acceptation%20Paiement%20%C3%A0%20distance_.pdf
Legal notice and terms of use of the CA Mon Commerce website: https://www.ca-moncommerce.com/cgu-mentions-legales/
Privacy policy of the CA Mon Commerce website: https://www.ca-moncommerce.com/politique-de-protection-des-donnees/
Service terms and personal data policy: your contract with your Crédit Agricole regional bank.

Verifone (Paybox platform):

Paybox, Verifone’s e-commerce brand in France: https://www.paybox.com/presentation-du-groupe/
Privacy notice (UK and EEA): https://www.verifone.com/legal/gdpr-privacy-policy-uk-and-european-economic-area
PAYBOX services GDPR notice and sub-processors: https://www.paybox.com/politique-de-confidentialite-rgpd/
Legal information: https://www.verifone.com/legal
Terms of Verifone’s direct Paybox service (not your Up2pay e-Transactions contract): https://www.paybox.com/cgu/

Relqor — Gateway for Up2pay e-Transactions

About this plugin