Optimist Hub Payment Gateway with Moka United for WooCommerce

Description

This plugin adds a Moka United virtual POS integration to your WooCommerce store, for merchants taking payments in Turkey.

It uses Moka United’s hosted payment page (Ortak Ödeme Sayfası / WebPos): the customer is redirected to Moka United to pay, so you can start taking cards without ever handling card data yourself.

The card number, expiry date and CVC code are therefore never entered on your site, never pass through your server and are never stored in your database. Your PCI-DSS scope stays at SAQ A.

How it works

1. The customer selects “Moka United” at checkout. The plugin renders no card fields at all (has_fields = false) — only your description text.
2. The plugin creates a payment session on Moka United’s WebPos service and redirects the customer to Moka United’s hosted payment page.
3. The customer enters their card details, chooses an installment plan and completes 3D Secure entirely on Moka United’s page.
4. Moka United returns the customer to your store with a signed result. The plugin verifies the signature, re-checks the amount and confirms the transaction server-to-server with Moka United before marking the order as paid.

Features

• Redirect (hosted payment page) flow — no card data is ever collected by the store (PCI scope SAQ A)
• 3D Secure authentication
• Installments, including the interest/commission rates of the customer’s own card, shown on Moka United’s payment page
• An installment table on the product page, so shoppers can see the monthly cost before they reach checkout
• The card brand logos and per-installment totals are read live from your Moka United dealer account
• Compatible with both the classic (shortcode) and the block-based checkout
• High-Performance Order Storage (HPOS) compatible
• Test mode, which points every request at the Moka United test environment so you can rehearse the full flow before going live
• Transaction log screen
• English source with a bundled Turkish (tr_TR) translation; the interface follows the site language

Requirements

• WordPress 6.4 or higher
• WooCommerce 8.0 or higher
• PHP 7.4 or higher
• A Moka United merchant account (dealer code, API username and password)
• TLS 1.2 or higher

External services

This plugin connects to Moka United services in order to process payments. This section describes exactly what data is sent, to which service, for what purpose and when.

1. Moka United — Hosted Payment Page (payment session creation)

• Service address: https://clientwebpos.mokaunited.com (test environment: https://clientwebpos.refmokaunited.com)
• Endpoint: POST /Api/WebPos/CreateWebPosRequest
• Data sent: payment amount and currency, order number, order description, buyer full name, buyer email address, buyer phone number (optional), buyer address, basket line items (product name, quantity, unit price), dealer code and API username
• Purpose: to create a payment session and redirect the customer to Moka United’s secure hosted payment page
• When: when the customer places the order and the payment is initiated
• No card number, expiry date or CVC code is sent in this request. Those details are entered by the customer directly on Moka United’s own page, in the customer’s own browser.
• Provider policies (Moka United) — terms of use: https://www.mokaunited.com/legal-documents-and-representatives/terms-of-use ; privacy policy: https://www.mokaunited.com/legal-documents-and-representatives/privacy-policy

2. Moka United — PaymentDealer services (transaction verification)

• Service address: https://service.mokaunited.com (test environment: https://service.refmokaunited.com)
• Endpoints: POST /PaymentDealer/GetDealerPaymentTrxDetailList (transaction verification)
• Data sent: transaction code and order number for verification; dealer code, API username and password for authentication
• Purpose: to confirm server-to-server that the payment actually succeeded
• When: on the payment return (callback)
• Provider policies (Moka United) — terms of use: https://www.mokaunited.com/legal-documents-and-representatives/terms-of-use ; privacy policy: https://www.mokaunited.com/legal-documents-and-representatives/privacy-policy

3. Moka United — dealer information

• Service address: https://service.mokaunited.com (test environment: https://service.refmokaunited.com)
• Endpoint: POST /Dealer/GetDealer
• Data sent: dealer code and API username
• Purpose: to validate the connection credentials
• When: when the settings are saved
• Provider policies (Moka United) — terms of use: https://www.mokaunited.com/legal-documents-and-representatives/terms-of-use ; privacy policy: https://www.mokaunited.com/legal-documents-and-representatives/privacy-policy

4. Moka United — card logo CDN

• Service address: https://cdn.moka.com/Content/BankLogo/
• Data sent: nothing by the plugin. The customer’s browser requests one PNG image per card family shown in the installment table (for example https://cdn.moka.com/Content/BankLogo/AXESS.png). As with any other image on a web page, that request carries the image URL, the visitor’s IP address and the browser’s referrer and user agent.
• Purpose: to display the card family logo (Axess, Bonus, Maximum, …) beside that family’s rows in the installment table.
• When: when a product page, or a page containing the [moka_taksit_tablosu] shortcode, renders the installment table. The image is fetched by the visitor’s browser, never by the store’s server.
• This is a static asset host. No payment data, no personal data and no credentials are sent to it, and the table works without it: a card family whose logo is unavailable is shown with its name only.
• Provider policies (Moka United) — terms of use: https://www.mokaunited.com/legal-documents-and-representatives/terms-of-use ; privacy policy: https://www.mokaunited.com/legal-documents-and-representatives/privacy-policy

When Test Mode is enabled, requests 2 and 3 are sent to the Moka United test environment (service.refmokaunited.com) instead, and request 1 is sent to the test WebPos address (clientwebpos.refmokaunited.com). The card logo CDN has no test counterpart; it is a static asset host. No request is made to Moka United at all while the gateway is disabled.

No card data is ever sent to any Moka United service by this plugin, and no card data is ever collected on your site. Card details travel from the customer’s browser directly to Moka United’s payment page. The plugin neither collects, nor transmits, nor stores them (PCI scope SAQ A).

The service provider is Moka United (Moka Ödeme Kuruluşu A.Ş.), not Optimist Hub. The terms of use and privacy policy of that provider are linked under each service above. Because this plugin uses Moka United’s payment service, the following also applies:

• Moka United terms and conditions of payment services: https://www.mokaunited.com/legal-documents-and-representatives/terms-and-conditions-of-payment-services

This plugin contacts no other external service. It does not use its own update server; updates are delivered through WordPress.org.

Some further domains appear in the plugin’s code but are never contacted. They are listed here so the list above is exhaustive:

• moka.com — the host allow-list used when validating a logo URL that the Moka API returned. It is a validation rule, not a connection; the only logo requests actually made are the cdn.moka.com images described in 4.
• service.moka.com — the bundled Moka PHP client’s built-in default address. The plugin always sets the PaymentDealer address explicitly (see 2 and 3 above), so this default is never used.
• service.refmoka.com — a retired test address. It appears only in a code comment recording that it no longer works; nothing calls it.
• github.com — appears only in the file headers that the Strauss build tool writes into the bundled library, crediting itself. No request is made.