Title: Relqor — Gateway for Up2pay e-Transactions
Author: relqor
Published: October 27, 2026
Last modified: October 27, 2026
---
Search plugins
# Relqor — Gateway for Up2pay e-Transactions
By [relqor](https://profiles.wordpress.org/relqor/)
[Download](https://downloads.wordpress.org/plugin/relqor-gateway-for-up2pay-e-transactions.0.1.0.zip)
* [Details](https://wordpress.org/plugins/relqor-gateway-for-up2pay-e-transactions/#description)
* [Reviews](https://wordpress.org/plugins/relqor-gateway-for-up2pay-e-transactions/#reviews)
* [Installation](https://wordpress.org/plugins/relqor-gateway-for-up2pay-e-transactions/#installation)
* [Development](https://wordpress.org/plugins/relqor-gateway-for-up2pay-e-transactions/#developers)
[Support](https://wordpress.org/support/plugin/relqor-gateway-for-up2pay-e-transactions/)
## Description
Relqor connects WooCommerce to the **Up2pay e-Transactions** hosted payment page(
Paybox System protocol). Your customers enter their card details on the payment
platform’s secure page, never on your site.
**Relqor is an independent plugin. It is not affiliated with, endorsed by or supported
by Verifone, Up2pay or Crédit Agricole.** Up2pay e-Transactions and Paybox are trademarks
of their respective owners. You need an Up2pay e-Transactions merchant contract (
SITE, RANG, IDENTIFIANT and HMAC key) to use this plugin.
Reliability first:
* Order statuses are only changed by the **signed server-to-server notification(
IPN)**. The signature is verified with the platform’s public key, and the amount
and reference are checked against the order. Duplicate notifications have no
effect.
* **Manual confirmation in production mode, on by default.** A signed “payment
accepted” notification puts the order **on hold** instead of marking it as paid,
because the signed data does not identify your merchant account. In the Vision
back office, check that your account has an accepted transaction (authorized
or captured; not declined, cancelled or pending) for the order’s reference and
amount (the transaction number alone proves nothing), then set the order to Processing
or Completed. You can turn this off in the settings (see the FAQ). In test mode,
an accepted payment marks the order as paid automatically (an order that has
a payment attempt created in production mode keeps the production rules), so
the payment method is only offered to logged-in users who can manage WooCommerce(
administrators and shop managers): other visitors do not see it.
* The customer return page never changes an order, and only shows the order page
to the customer who placed it (same browser session or logged-in account).
* HMAC-SHA512 request signing, with a test and a production key set.
* Automatic fallback to the secondary payment server when the main one is unavailable.
* Classic checkout and WooCommerce Checkout block, HPOS and legacy order storage.
* Shipping address and pickup-point data are left untouched.
* Settings are never lost on update. Uninstalling keeps your settings unless you
define `RELQOR_REMOVE_ALL_DATA`.
* Logs in WooCommerce > Status > Logs (source `relqor`), with no card data and
no secret.
Supported currency: euro only (the Up2pay e-Transactions platform only accepts EUR).
### External services
This plugin relies on the **Up2pay e-Transactions** online card payment service,
provided by Crédit Agricole (your bank), which runs it on Verifone’s Paybox platform.
The service is required: without it no payment can be taken. **Using it is governed
by the contract you (the merchant) sign with your Crédit Agricole regional bank;
the plugin does not create any contract.** The platform’s payment page, not your
store, collects the card details; it also sees the customer’s IP address and browser,
like any website.
#### When the service is used
1. When the customer confirms the order, the plugin only records a payment attempt;
nothing is sent yet.
2. On the “Pay for order” page, the plugin builds a signed form. Before showing it,
your server checks that the payment server is available: it requests the platform’s
public status page `/load.html` (5 seconds timeout, no redirect followed). The
result is kept for 60 seconds per server. The secondary server is only checked
when the main one is not available. No customer or order data is sent: only the
standard headers of WordPress, including its User-Agent (WordPress version and
your site address).
3. The **customer’s browser** then posts the form to the payment page (`/php/` on
the available server). Each new display of the page (refresh, back button) creates
a new payment reference.
4. After each payment attempt, **the platform’s server** calls your store’s notification
URL (`?wc-api=relqor_ipn`, GET request) with the signed result. This is the only
message that can change the order status.
5. When the customer comes back from the payment page, their browser opens `?wc-api
=relqor_return` on your store with the same signed values; it only shows a message
and never changes the order.
#### Data sent to the payment platform
Sent by the customer’s browser in the signed form:
* your SITE, RANG and IDENTIFIANT;
* the order amount in cents and the currency (euro), and the order reference (`
-`);
* the customer’s billing email address (ASCII only, at most 80 characters; an internationalized
domain name is converted to its ASCII form when possible);
* the date and time of the request, the requested response format, the signature
algorithm and the payment page format (responsive);
* the number of items in the order (from 1 to 99);
* the billing first name, last name, address lines 1 and 2, postcode, city and
country (numeric code), cut to the platform’s field lengths;
* the billing phone number, sent as the mobile phone field with the country calling
code, only when it has 1 to 10 digits and the calling code is known;
* the page language (3-letter code of the current WordPress language; French when
not supported);
* your store’s 4 return URLs and its notification (IPN) URL.
The request is signed with HMAC-SHA512 and your HMAC key; the key itself is never
sent. The plugin sends no card data and no IP address.
#### Data received and stored
After each payment attempt, the notification contains: the amount, the reference,
the authorization number, the response code, the transaction number, the call number,
the payment type, the card type (brand, e.g. CB or Visa), the 3-D Secure authentication
status, the 3-D Secure guarantee, the 3-D Secure version and the platform’s signature.
No card number is requested or stored.
Once the signature is verified, the plugin stores in the order:
* the transaction number (`_relqor_transaction`; also the order’s transaction ID
when an accepted payment marks the order as paid automatically), next to the
call number (`_relqor_call_number`) and the response code (`_relqor_code`);
* the notifications already processed (`_relqor_ipn_done`, as SHA-256 fingerprints
of their signed content), so that a repeated notification has no effect;
* when manual confirmation puts an order on hold, the reference of the signed “
payment accepted” notification awaiting your confirmation (`_relqor_signed_success`),
kept so that later notifications for that order only add a note;
* an order note: for an accepted payment, the authorization number, the transaction
number, the reference and the 3-D Secure result; otherwise the response code
and its meaning.
Any received value that is not plain text (letters, digits, spaces and `_ . : /
+ -`, at most 64 characters) is never copied: it is shown as “(invalid)”. The plugin
also records its own payment attempts (`_relqor_attempts`: reference, amount, dates,
and the mode (test or production) and manual confirmation setting in force when
each attempt was created). The payment type and card type are not stored. The WooCommerce
log (source `relqor`) records the IP address of the server that sent a notification
when this address is not in the platform’s published list or when the signature
is invalid.
#### Payment page addresses (test / production)
* Test mode (the default): `recette-tpeweb.e-transactions.fr`, with no secondary
server by default.
* Production mode: `tpeweb.e-transactions.fr` (main server) and `tpeweb1.e-transactions.
fr` (secondary server) by default.
These addresses are prefilled in the settings and can be changed; any HTTPS payment
server you enter is used in the same way.
#### Legal pages
Up2pay e-Transactions (Crédit Agricole, the service provider):
* The service: https://www.ca-moncommerce.com/credit-agricole/up2pay-e-transactions/
* Service FAQ: https://www.ca-moncommerce.com/espace-client-mon-commerce/up2pay-
e-transactions/faq/
* General terms of the remote card payment acceptance contract, including the specific
terms of the Up2pay e-Transactions services option (PDF, edition of 1 January
2024): https://www.credit-agricole.fr/content/dam/assetsca/master/public/commun/
documents/CG-FIP_Contrat%20Acceptation%20Paiement%20%C3%A0%20distance_.pdf
* Legal notice and terms of use of the CA Mon Commerce website: https://www.ca-
moncommerce.com/cgu-mentions-legales/
* Privacy policy of the CA Mon Commerce website: https://www.ca-moncommerce.com/
politique-de-protection-des-donnees/
* Service terms and personal data policy: your contract with your Crédit Agricole
regional bank.
Verifone (Paybox platform):
* Paybox, Verifone’s e-commerce brand in France: https://www.paybox.com/presentation-
du-groupe/
* Privacy notice (UK and EEA): https://www.verifone.com/legal/gdpr-privacy-policy-
uk-and-european-economic-area
* PAYBOX services GDPR notice and sub-processors: https://www.paybox.com/politique-
de-confidentialite-rgpd/
* Legal information: https://www.verifone.com/legal
* Terms of Verifone’s direct Paybox service (not your Up2pay e-Transactions contract):
https://www.paybox.com/cgu/
## Installation
1. Install and activate WooCommerce, then this plugin.
2. Go to WooCommerce > Settings > Payments > Relqor — Up2pay e-Transactions.
3. Enter your test credentials (SITE, RANG, IDENTIFIANT, test HMAC key) and keep the
mode on “Test”.
4. Place a test order while logged in as an administrator or shop manager, then switch
to “Production” with your production credentials and production HMAC key.
In production mode, manual confirmation is on by default: for each card payment,
check in the Vision back office that your account has an accepted transaction (authorized
or captured; not declined, cancelled or pending) for the order’s reference and amount,
then set the order to Processing or Completed (see the FAQ).
The HMAC key is generated in the Vision back office. The test and production keys
are different.
## FAQ
### Is this the official Up2pay plugin?
No. Relqor is an independent plugin and is not affiliated with Verifone, Up2pay
or Crédit Agricole.
### How do I test, then switch to production?
New installations start in Test mode, on the test server `recette-tpeweb.e-transactions.
fr`. Tick Enable and fill in “Test credentials (sandbox)”; if you have no test account,
Crédit Agricole’s guide “Up2pay e-Transactions – Réalisation des tests d’intégration”
publishes a shared one with its HMAC key.
* Place your test order while logged in: in Test mode, only administrators and
shop managers see the payment method.
* Pay with a test card from Verifone’s DSP2 integration manual, such as `4000000000001000`(
accepted without a 3-D Secure challenge). The payment page shows `***TEST***`
before the shop name.
* An accepted test payment marks your test order as paid automatically once the
payment notification reaches your store, so your store must be reachable from
the Internet, even in Test mode.
To go live, fill in “Production credentials”, set Mode to Production and save: the
payment method is then offered to all your customers, or disappears from checkout
if the production credentials are incomplete. Manual confirmation is then on by
default: each accepted payment puts the order on hold until you have checked it
in Vision and changed its status yourself (see the question about orders “On hold”
in production mode).
### Why doesn’t card payment appear at checkout?
It appears in the classic checkout, the Checkout block and on the “Pay for order”
page only when:
* the Enable box is ticked and the store currency is the euro;
* PHP’s OpenSSL extension is available (it is needed to verify the platform’s notifications);
* the credentials section that matches Mode is complete: a 7-digit SITE, a 2- or
3-digit RANG, an IDENTIFIANT of 1 to 9 digits, a hexadecimal HMAC key and a payment
URL starting with `https://`;
* in Test mode, you are logged in as an administrator or shop manager (other visitors
see it only in Production mode).
A value in the wrong format is not saved: the field keeps its previous value, so
check it again after saving.
### The payment page shows “Accès refusé” and “Error while proceeding authentication with HMAC key”. What should I check?
The payment platform could not verify the request with your HMAC key. In the credentials
section that matches Mode, paste the HMAC key for that Mode again, in full: the
test and production keys are different. If saving then shows “the HMAC key is not
128 characters long”, check your copy and paste. Also check SITE, RANG and IDENTIFIANT
in the same section.
### A customer gets an error message instead of the payment page. Why?
The plugin checks the order before sending the customer to the payment page:
* “Incomplete billing address: … is missing.”: the billing first name, last name,
address, postcode, city and country are sent to the platform for 3-D Secure,
and the plugin never fills in a missing value. Keep these fields in your checkout,
including for virtual products; address line 2 and the phone number are optional.
* “Your email address is not accepted by the payment platform …”: the billing email
must have 6 to 80 characters, no accents before the @ and a dot after it.
* “The payment service is temporarily unavailable …”: no payment server answered“
OK” on its status page (`/load.html`, see External services) within 5 seconds.
If this happens for every order, check that your server can make outgoing HTTPS
requests to the payment server.
The `relqor` log gives the reason (“payment not possible before redirection”, “payment
form not generated” or “no payment server available”).
### Why is an order still “Pending payment”?
Relqor changes the status only when the platform’s signed notification reaches your
site address followed by `/?wc-api=relqor_ipn`, as a GET request, without any login;
the customer’s return never changes it. The plugin sends this address with every
payment request; according to the Up2pay e-Transactions integration manual, it takes
priority over an address saved in Vision.
* If a firewall, bot protection, maintenance mode or a password protects the whole
site, let this URL through. The plugin does not filter by IP address.
* In the `relqor` log, find the line “Order N: redirecting to the payment page (
reference …)”. If no later line mentions the order or that reference, the plugin
processed no notification for it.
* If a later line says “Invalid IPN signature — call ignored” with that reference,
a request arrived but could not be verified, and the order was not changed.
* If the customer did not pay, the order stays Pending payment unless a notification
reports a refusal or a cancellation. With stock management on (the WooCommerce
default), WooCommerce cancels unpaid checkout orders after its “Hold stock” time(
60 minutes by default).
If Vision shows an accepted transaction for the order’s reference and amount, set
the order to Processing or Completed yourself.
### An order is “On hold” in production mode. What do I do with it?
If the order note starts with “Signed payment notification received”, the order
is waiting for your check (manual confirmation, on by default). WooCommerce sends
the customer its on-hold email and, until you act, the order-received page shows“
Payment being confirmed”. Look up the reference from the note in Vision, with the
order total as the amount (see “Does the signed notification prove that the payment
reached my account?”), then:
* If your account has an accepted transaction for them, set the order to Processing
or Completed: WooCommerce then treats it as paid, gives access to downloads and
sends the customer its usual email for that status.
* Otherwise, do not deliver: leave the order on hold or cancel it.
A payment whose payment page was shown while manual confirmation was on still puts
the order on hold, even after you uncheck it. If the note says “Payment awaiting
approval by the issuer (code 99999 …)”, see the question about “Failed”, “Cancelled”
or “On hold” orders.
### Does the signed notification prove that the payment reached my account?
No. The platform signs its notifications with its own key, the same for every merchant
and for its test platform, and the signed data does not identify the merchant account:
a notification produced on the public test platform, or for another merchant account,
is validly signed too, and its values can quote a declined transaction or a transaction
of another order. That is why, by default in production mode, Relqor does not mark
an order as paid on a notification alone: a signed “payment accepted” notification
puts the order on hold, with a note giving the reference, the authorization number
and the transaction number. In the Vision back office, check that your account has
an accepted transaction (authorized or captured; not declined, cancelled or pending)
for that reference and for the order amount: the transaction number alone proves
nothing. Then set the order to Processing or Completed. Until you do, nothing is
delivered automatically, not even downloads, and later notifications for that order(
declined, cancelled or another payment) only add a note; if you set the order back
to Pending payment, another signed payment notification puts it on hold again. The
test platform’s authorization number (`XXXXXX`) is refused in production mode: the
order is left unchanged, with a note. In test mode, an accepted payment marks the
order as paid automatically, unless the order has a payment attempt created in production
mode: such an order keeps the production rules even after you switch back to test
mode, so `XXXXXX` is refused and, with manual confirmation, an accepted payment
puts it on hold.
### Can orders be marked as paid automatically in production mode?
Yes: in the settings, uncheck “Manual confirmation in Production”. A signed “payment
accepted” notification then marks the order as paid through the standard WooCommerce
payment flow (Processing, or Completed for virtual downloadable products). The plugin
cannot tell such a notification apart from one produced on the public test platform
for the same order and amount, so an order could then be marked as paid, and downloads
made available, without any real payment. If you turn it off, check in the Vision
back office that your account has an accepted transaction (authorized or captured;
not declined, cancelled or pending) for each order’s reference and amount before
delivering it. The test platform’s authorization number (`XXXXXX`) is still refused.
### Why is an order “Failed”, “Cancelled” or “On hold”?
The plugin sets these statuses after a signed notification and explains each one
in an order note:
* Failed: any response code not listed below, usually a refusal, for example `00151`(
insufficient funds), `00105` (do not honor), `00154` (card expired) or `00004`(
invalid card number or security code). `00006` means access refused: check SITE,
RANG, IDENTIFIANT and the HMAC key.
* Cancelled: `00030` (time-out on the payment page) or `00117` (customer cancellation
reported by the authorization center). A customer who leaves the payment page
with its Cancel link may get another code: on the test platform, this link carries`
00001`, and a notification with that code sets the order to Failed. An order
cancelled with the note “Unpaid order cancelled – time limit reached.” was cancelled
by WooCommerce itself (see the question about “Pending payment” orders).
* On hold: `99999` (the card issuer has not confirmed the payment yet; according
to the platform’s manual, a final notification follows) or, in production mode
with manual confirmation, an accepted payment waiting for your check (see the
question about orders “On hold” in production mode).
A refusal never changes the status of a paid order or of an order waiting for your
confirmation: a note is added. After a refusal, the customer can pay again, and
the next accepted payment is processed normally.
### An order note says “manual check required”, “status unchanged” or “no change”. What should I do?
The plugin could not apply the signed notification safely, so it only added this
note and left the status unchanged. Common causes:
* “Amount received … ≠ expected …”: the order total was edited after the payment
page was shown.
* “Test authorization (XXXXXX) received in Production mode”: the response came
from the test platform, for example for a test payment that finished after you
switched to Production, or for a test payment for an order that has a payment
attempt created in Production mode, even after you switched back to Test.
* “… after a signed payment notification for reference … that is waiting for your
confirmation”: another notification, such as a second payment or a refusal, arrived
for an order on hold for your check.
* “Reference … unknown for this order”: the reference is not one of this order’s
payment attempts.
* “Code 00000 without an authorization number”: the notification reports a success
but gives no authorization number.
Look up the reference given in the note in Vision; if your account has an accepted
transaction for it and for the order amount, set the status yourself. To avoid the
first two cases, do not edit an order’s total or change Mode while a customer is
paying.
### Where can I see what happened with a payment?
Open the order: each signed notification for it adds a note, usually with the response
code and its meaning or, for an accepted payment, the authorization and transaction
numbers; a repeated notification adds nothing. Each payment reference is the WooCommerce
order ID followed by the attempt number, for example `123-2`, even when a plugin
displays another order number. For more detail, open WooCommerce > Status > Logs,
source `relqor` (in English, or in French on a French site once the French language
pack is installed). The main lines are:
* “Order N: redirecting to the payment page (reference …)”: the payment form was
shown to the customer, whose browser then submits it. This line alone does not
show that the customer reached the payment page.
* “Order N: IPN accepted (valid signature) …”: after the arrow, `complete` (paid),`
on-hold`, `failed` or `cancelled` is the status given to the order; any other
word means that only a note was added.
* “Invalid IPN signature — call ignored”: a request could not be verified; the
order was not changed and no note was added.
* “… not in the Up2pay list (not blocking …)”: information only. Behind a proxy
or a CDN, your server may see the proxy’s address instead of the platform’s.
### Can I refund, capture later, or take instalments, subscriptions or saved cards?
No. The plugin only takes one-off payments in euros through the hosted payment page;
it does not handle refunds, cancellations, deferred or manual capture, instalments,
subscriptions or saved cards, and it sends no capture setting, so the platform’s
default applies. Apart from the status page check, your server never contacts the
platform: a refund recorded in WooCommerce moves no money, so refund or cancel payments
with your bank.
If a customer pays the same order twice (each display of the payment page has its
own reference), the second accepted payment does not change the order status or
its WooCommerce transaction ID: it adds a note to the order and, unless the first
payment put the order on hold for your confirmation, the `_relqor_transaction`, `
_relqor_call_number` and `_relqor_code` fields then show the second payment. Check
both references in Vision and refund the extra payment with your bank.
### Where is my HMAC key stored, and is it kept when I update or delete the plugin?
It is stored unencrypted with the other settings, in the WordPress option `relqor_settings`,
so limit who can access your database and backups, and do not share it in a support
request. The settings page does not show it again: the empty field displays ••••
and the key’s last 4 characters. Leave the field empty to keep the saved key, or
paste a new one to replace it, then check that the last 4 characters shown match
the new key.
* Updating: the settings upgrade only adds missing settings with their default
value; it never deletes or overwrites a saved value, HMAC keys included.
* Deactivating: nothing is removed, but notifications that arrive while the plugin
is inactive are not processed: check in Vision the payments made during that
time.
* Deleting: settings and keys are kept for a reinstall, unless `define( 'RELQOR_REMOVE_ALL_DATA',
true );` is in wp-config.php, which erases them. The payment data saved on orders(
the `_relqor_*` fields listed under External services) and the order notes are
always kept.
### Which currencies are supported?
Euro only.
### Is the plugin available in French?
The plugin is written in English and is ready to be translated. Its French translation
will be delivered by WordPress.org as a language pack (translate.wordpress.org),
which WordPress uses automatically when the site language is French. The plugin
asks the platform to show the payment page in the site language when that language
is French, English, Spanish, Italian, German, Dutch, Swedish or Portuguese, and
in French otherwise.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Relqor — Gateway for Up2pay e-Transactions” is open source software. The following
people have contributed to this plugin.
Contributors
* [ relqor ](https://profiles.wordpress.org/relqor/)
[Translate “Relqor — Gateway for Up2pay e-Transactions” into your language.](https://translate.wordpress.org/projects/wp-plugins/relqor-gateway-for-up2pay-e-transactions)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/relqor-gateway-for-up2pay-e-transactions/),
check out the [SVN repository](https://plugins.svn.wordpress.org/relqor-gateway-for-up2pay-e-transactions/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/relqor-gateway-for-up2pay-e-transactions/)
by [RSS](https://plugins.trac.wordpress.org/log/relqor-gateway-for-up2pay-e-transactions/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 0.1.0
* First version: hosted payment page redirection, signed IPN, manual confirmation
of card payments in production mode (on by default), classic checkout and Checkout
block, HPOS, in English and ready to be translated.
## Meta
* Version **0.1.0**
* Last updated **5 days ago**
* Active installations **Fewer than 10**
* WordPress version ** 7.0 or higher **
* Tested up to **7.1.4**
* PHP version ** 8.1 or higher **
* Tags
* [payment gateway](https://wordpress.org/plugins/tags/payment-gateway/)[woocommerce](https://wordpress.org/plugins/tags/woocommerce/)
* [Advanced View](https://wordpress.org/plugins/relqor-gateway-for-up2pay-e-transactions/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/relqor-gateway-for-up2pay-e-transactions/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/relqor-gateway-for-up2pay-e-transactions/reviews/)
## Contributors
* [ relqor ](https://profiles.wordpress.org/relqor/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/relqor-gateway-for-up2pay-e-transactions/)