About this plugin
Y2KWebs Gateway for LAFISE connects WooCommerce stores to the LAFISE Costa Rica REST payment service. Customers enter their card details at checkout and complete the issuing bank’s 3DS verification when requested.
The plugin is free and open source. You need a LAFISE merchant account with REST payment credentials for your store. Bank fees and service conditions are governed by your merchant agreement.
No Y2KWebs account or paid Y2KWebs service is required.
This is an independent integration developed by Y2KWebs. It is not an official LAFISE plugin and does not imply endorsement by LAFISE or WooCommerce. Their trademarks belong to their respective owners.
Features
- Classic WooCommerce checkout and Checkout Blocks.
- Card encryption in the browser using JWE and bank-provided transport keys.
- 3DS fingerprint and challenge handling.
- Merchant credentials managed in WooCommerce settings; Password and API KEY are stored encrypted.
- Payment response signature, amount and currency validation, with duplicate-sale protection.
- Encrypted payment-attempt history and an administrator action to query payment status without making a new charge.
- WooCommerce High-Performance Order Storage (HPOS) and traditional order storage.
- No telemetry or checkout advertising. Optional professional installation and support is available separately.
Languages
The interface supports English and includes a complete Spanish translation for Spanish WordPress locales, even without downloaded language packs. Regional WordPress translations take precedence. The administrator follows the user language; checkout and payment verification follow the store language.
Merchant-defined payment titles are preserved. Official directory translations are managed separately on Translate WordPress.
Requirements and current scope
2 or later with OpenSSL and DOM, MySQL/MariaDB with GET_LOCK support, HTTPS and pretty permalinks are required. Each installation uses one store currency (CRC or USD) and the corresponding bank terminal, without automatic currency conversion. Available currencies depend on your merchant agreement.
Automatic bank refunds, subscriptions and saved cards are not implemented. Refunds must be handled with LAFISE and recorded manually in WooCommerce.
Direct financial Sale approvals and declines are not classified automatically. Process3DS decline 59 is recognized only after signature and financial validation with no authorization. Other unrecognized or contradictory results remain on hold for review.
Do not initiate another payment until an uncertain result has been reconciled with the bank.
1. Automated tests use a simulated bank. See the validation record for exact versions, test coverage and remaining scenarios.
External service and privacy
This plugin requires the LAFISE Costa Rica payment service. com/Interfaces/ for authentication, transport keys, payment processing, 3DS continuation and status queries.
Payment requests send encrypted card data, merchant and terminal identifiers, order reference, amount, tax, currency, buyer first and last name, phone, email, country, IP address, screen dimensions and the store’s 3DS callback URL. Authentication uses the merchant’s bank credentials over HTTPS. Server-to-server secrets are not exposed to the browser.
During 3DS, the browser also contacts the issuing bank’s authentication service at a destination received from authenticated bank responses.
No developer-operated intermediary receives payments or buyer data. The plugin does not persist card numbers, CVV or encrypted card payloads. Payment attempts and bank references are retained locally, with the sensitive attempt payload encrypted.
Deactivation and uninstall preserve that financial history. Review the security and retention guidance when configuring logs, backups and your store privacy notice.
Service information: LAFISE Costa Rica merchants.
Privacy information: LAFISE Costa Rica privacy policy.
Payment-service terms and fees are supplied by LAFISE in your merchant agreement; the bank’s general website terms are not a substitute for that agreement.
Documentation and support
- Configuration guide
- Source code, tests and development instructions
- Report an issue
- Private vulnerability reporting
For support, provide versions, reproduction steps using fictitious data and a generic error code. Never publish credentials, card details, cookies, bank responses or URLs containing payment tokens. Community support has no guaranteed response time.