Fintoc for WooCommerce

Changelog

1.2.4

• Orders are no longer cancelled while Fintoc is still validating the payment: a bank transfer that takes longer than the hold-stock window (60 minutes by default) now waits in On hold, with its stock reserved, instead of being cancelled after the money was already collected.
• Stock reserved by a validating payment is restored when the payment fails.
• A validating payment is polled against the Fintoc API as a fallback, so an order whose confirmation webhook was never delivered still resolves on its own.
• An expiring checkout session no longer cancels an order that has another payment still being validated.
• A second payment succeeding for an order that was already paid now leaves an order note and emails the store admin, so the duplicate can be refunded.
• Customers receive WooCommerce’s standard order on-hold email when their payment enters validation. It can be turned off under WooCommerce > Settings > Emails.

1.2.3

• Fixed checkout failing with “Unrecognized request: POST /v2/checkout_sessions” on Fintoc organizations pinned to an API version older than 2026-02-01: requests now send the Fintoc-Version header.

1.2.2

• A payment made in an earlier Fintoc checkout session is no longer lost when the customer goes back to the checkout and a second session is created.
• An expiring checkout session no longer cancels an order whose payment is still being confirmed by Fintoc.

1.2.1

• Two Fintoc webhooks arriving at once for the same order can no longer confirm it twice, which duplicated the stock reduction, the order notes and the customer emails.
• A payment that WooCommerce fails to complete is now retried instead of being acknowledged, so the order no longer stays unpaid after the money was captured.
• The order-received page no longer says the payment is still being confirmed when the webhook already confirmed it.
• The gateway icon now matches the payment methods enabled for the organization, at a readable size, on both the classic and the Blocks checkout.
• Checkout sessions no longer send the customer object.

1.2.0

• SmartCheckout: sessions no longer pin bank_transfer — the Fintoc-hosted checkout offers every payment method enabled for the organization (bank transfer, cards).
• Test mode now defaults to off.
• Refund hardening: settings now instruct subscribing to refund.* events; reverting a failed refund reverses restocked inventory and restores the order’s real pre-refund status; the customer is notified when a refund is reverted; Dashboard-created refunds are reconciled into WooCommerce; canceled refunds revert like failed ones; refund webhooks validate that the refund belongs to the order; permanent API errors no longer cause endless webhook retries; cross-mode refunds and over-precise partial amounts fail early with clear messages.

1.1.0

• Webhooks are now verified against the Fintoc API instead of an HMAC signature: the payload only locates the order and every state change comes from an authenticated API lookup. The webhook endpoint secret settings were removed — no secret to configure.
• Checkout sessions are created with payment_method_types: bank_transfer, skipping Fintoc’s method selector so the checkout matches what the gateway promises.
• Embedded payments are now read from the documented payment_resource.payment_intent shape of the checkout session, fixing immediate confirmation on return and the checkout_session.finished safety net.
• Refund outcomes are reconciled asynchronously: refund.succeeded confirms the refund, and refund.failed reverts the WooCommerce refund, restores the order status and emails the store admin.

1.0.0

• Initial release: hosted checkout, webhooks, refunds, Blocks support, HPOS compatibility.