About this plugin
ROKI Connect lets your WooCommerce store accept credit and debit cards in Honduran lempira (HNL).
The plugin interface is in Spanish. The settings labels, the admin notices and the texts your customers read are written for Honduran merchants and are not translated. Only this readme is in English, because the plugin directory requires it.
Two ways to charge, and you pick
- Card fields in your store. ROKI draws the card fields inside your own checkout, in a secure iframe. The customer never leaves your page and the card number never touches your server.
- The ROKI hosted checkout. The customer goes out to a ROKI page, pays, and comes back. It is the simplest path and it works even if your store has no HTTPS.
Both behave the same in the classic checkout and in the block checkout.
What it does for you
- Refunds and voids from the admin. If the transaction can still be voided, the plugin voids it instead of refunding it: a void never shows up on the customer’s card statement.
- Automatic reconciliation. Every five minutes it looks at pending orders and asks ROKI about them. If a webhook is lost to a deployment or a network outage, your customer is not left with a stuck order.
- Verified webhooks. The signature is checked with HMAC-SHA256 over the raw body and in constant time, and repeated deliveries are discarded by their event id.
- A diagnostics button. It checks your configuration end to end – key, environment, webhook, signature – and tells you exactly what is missing, instead of failing only when a customer tries to pay.
- Processing fee passed to the customer. An optional switch: ROKI recalculates the total so that your store keeps the order amount.
What this plugin does NOT do, said plainly
- It does not mark an order as paid because the customer came back from the checkout. Coming back means the browser came back, not that money moved. An order is marked paid by the webhook or by reconciliation.
- It does not store card numbers. It never receives them: card entry always happens on a ROKI surface.
Third-party service: a ROKI account is required
This plugin connects your store to ROKI Connect, a payment service operated by ROKI, and it does nothing without it. You need a ROKI merchant account to obtain your API keys. Card numbers are never sent by your server: they are typed directly into a ROKI surface.
Exactly what is sent, when, and the links to ROKI’s terms and privacy policy are in the External services section below. It is written out there once rather than in two places, so the two cannot drift apart.
- Service and merchant accounts: https://roki.la
- Technical documentation: https://connect.roki.la
Built in Honduras by Danilo Antúnez.
External services
A. , to
create and manage card payments. A ROKI merchant account is required; the plugin does nothing
without one. ROKI is the payment processor, so this connection is what the plugin is for.
Every place this plugin reaches out, and from where
There are exactly four, and all four are ROKI:
Where in the code
Address
When it happens
php
systems/api/connect/v1
Server-side. Creating a payment, reading its status, voiding, refunding, fetching a receipt
php
systems/api/connect/embed/confirm
Server-side. Only in the embedded card-fields mode, to complete a charge from the single-use token
php
js
In the customer’s browser, on the checkout page of the classic checkout, only in the embedded card-fields mode
php
js
The same script, for the block checkout
The two server-side calls carry your secret API key. The browser script never does: it is loaded
with the publishable key, which cannot charge anything on its own.
With the hosted checkout, no ROKI script is loaded on your site at all – the customer goes to a
ROKI page instead. The browser only contacts ROKI when you turn on the card fields inside your own
store.
What is sent, and when
Every time a customer places an order and chooses this payment method, the plugin sends the
systems/api/connect/v1:
- the order total, and a label built from the order number, so you can recognise the payment;
- the order id, the order key and your store URL, so the payment can be matched back to the order
when ROKI notifies your site;
- an expiry time for the payment link;
- the return addresses on your store, so the customer comes back after paying;
- the billing name, email address and phone number, only if the customer filled them in at
checkout. They prefill ROKI’s payment form and are used for the receipt.
The card number is never sent by the plugin and never reaches your server: the customer types it on
ROKI’s own page, or into an iframe served by ROKI, and only a single-use token comes back.
The plugin also queries that same API to check the status of pending orders, and to void or refund a
payment when you ask it to from the order screen.
What the browser script does
js draws the card fields inside an iframe served by ROKI and turns the card into a
single-use token. The card number is entered inside that iframe, on ROKI’s domain, so it never
reaches your page or your server – only the token does, and your server exchanges it for a charge.
Terms and privacy
- Terms and Conditions: https://roki.la/terms
- Privacy Policy: https://roki.la/privacy