Baratek Payment Gateway with MPGS for WooCommerce

Description

This file documents installation, settings, and FAQ. For architecture, request-flow diagrams, and the security design rationale, see README.md in this plugin’s repository.

A WooCommerce payment gateway for Mastercard Payment Gateway Services (MPGS) – works with any MPGS-based provider (Areeba, or others exposing the same Transaction API), not tied to one reseller:

• Full WooCommerce Subscriptions support: automatic recurring renewals charged against a securely stored card token (no re-entering card details), subscription cancellation/suspension/reactivation, amount and date changes, payment method change (by the customer or an admin), and multiple subscriptions in one checkout – all built in, not bolted on.
• One-off card payments via an on-site card form (MPGS session.js), with 3DS2 authentication.
• Optional Hosted Checkout mode – redirect customers to your provider’s own hosted payment page instead. Subscription renewals work identically either way.
• HPOS (High-Performance Order Storage) compatible.
• Compatible with both the classic [woocommerce_checkout] shortcode checkout and the WooCommerce Checkout block.
• Structured event log under WooCommerce > MPGS Logs – readable in the dashboard, no FTP or raw log files.
• Admin email alert when a payment or subscription renewal fails.
• MPGS Transaction Details meta box on the order screen (receipt, transaction ID/type, card brand/last 4/type, gateway response, API version, link to the provider’s merchant portal).
• Common decline reasons (insufficient funds, expired card, do-not-honour, etc.) are mapped to plain-language messages instead of a generic “payment failed”.
• Logs a hint when a request fails with HTTP 401/403 or an obviously malformed gateway URL, pointing at the likely settings mistake.
• Nonce-protected payment callback and REST completion endpoint, with session/order ownership verification.

Refunds are handled directly in your MPGS provider’s merchant portal and are intentionally not implemented in this plugin.

Most MPGS providers have no separate “test mode” – which Merchant ID you configure determines whether the account is test or live.

Recurring/subscription payments require the separate WooCommerce Subscriptions plugin to be installed and active. Without it, this gateway still works fully for one-off card payments – the subscription-related settings and behavior simply don’t apply.

External Services

This plugin connects to your MPGS provider’s gateway (e.g. Areeba, or another bank/reseller exposing the same MPGS Transaction API) to process payments. It does not call any other third-party service.

• Provider: whichever bank or reseller issued your MPGS Merchant ID – the specific gateway host is entered in the plugin’s settings, not hardcoded.
• Underlying platform: Mastercard Payment Gateway Services, operated by Mastercard International Incorporated – mastercard.com.

When and what data is sent

1. At checkout – creates a payment session with the order amount, currency, order ID/description, the recurring agreement block (for token creation), and – if present on the order – the customer’s name, email, and phone.
2. After payment – re-verifies the transaction result directly with the gateway using the order ID (Hosted Checkout mode), or performs the final PAY call (custom checkout mode). Nothing posted by the browser is trusted on its own.
3. On subscription renewal – charges the previously stored card token via a server-to-server call; no browser involved.

Merchant credentials (Merchant ID, Authentication Password) are sent server-side only and never exposed to the browser. Card numbers, CVV, and expiry dates are never sent to or stored on this server – they’re tokenized client-side (custom checkout mode) or entered directly on the provider’s hosted page (Hosted Checkout mode).

Privacy

This plugin does not track users, use tracking cookies, or share data with anyone other than the configured MPGS provider for payment processing. It stores a card token (not the card itself) and transaction metadata (receipt, transaction ID/type, card brand/last 4/funding type, gateway response code) as order meta, for display in the order screen’s MPGS Transaction Details box.