Title: ROKI Connect for WooCommerce Author: rokiconnect Published: August 26, 2026 Last modified: August 26, 2026 --- Search plugins ![](https://ps.w.org/roki-connect-for-woocommerce/assets/banner-772x250.png?rev= 3667440) ![](https://ps.w.org/roki-connect-for-woocommerce/assets/icon-256x256.png?rev=3667440) # ROKI Connect for WooCommerce By [rokiconnect](https://profiles.wordpress.org/rokiconnect/) [Download](https://downloads.wordpress.org/plugin/roki-connect-for-woocommerce.1.1.7.zip) * [Details](https://wordpress.org/plugins/roki-connect-for-woocommerce/#description) * [Reviews](https://wordpress.org/plugins/roki-connect-for-woocommerce/#reviews) * [Installation](https://wordpress.org/plugins/roki-connect-for-woocommerce/#installation) * [Development](https://wordpress.org/plugins/roki-connect-for-woocommerce/#developers) [Support](https://wordpress.org/support/plugin/roki-connect-for-woocommerce/) ## Description ROKI Connect lets your WooCommerce store accept credit and debit cards in Honduran lempira (HNL). The plugin interface is in Spanish. The settings labels, the admin notices and the texts your customers read are written for Honduran merchants and are not translated. Only this readme is in English, because the plugin directory requires it. **Two ways to charge, and you pick** * **Card fields in your store.** ROKI draws the card fields inside your own checkout, in a secure iframe. The customer never leaves your page and the card number never touches your server. * **The ROKI hosted checkout.** The customer goes out to a ROKI page, pays, and comes back. It is the simplest path and it works even if your store has no HTTPS. Both behave the same in the classic checkout and in the block checkout. **What it does for you** * **Refunds and voids from the admin.** If the transaction can still be voided, the plugin voids it instead of refunding it: a void never shows up on the customer’s card statement. * **Automatic reconciliation.** Every five minutes it looks at pending orders and asks ROKI about them. If a webhook is lost to a deployment or a network outage, your customer is not left with a stuck order. * **Verified webhooks.** The signature is checked with HMAC-SHA256 over the raw body and in constant time, and repeated deliveries are discarded by their event id. * **A diagnostics button.** It checks your configuration end to end – key, environment, webhook, signature – and tells you exactly what is missing, instead of failing only when a customer tries to pay. * **Processing fee passed to the customer.** An optional switch: ROKI recalculates the total so that your store keeps the order amount. **What this plugin does NOT do, said plainly** * It does not mark an order as paid because the customer came back from the checkout. Coming back means the browser came back, not that money moved. An order is marked paid by the webhook or by reconciliation. * It does not store card numbers. It never receives them: card entry always happens on a ROKI surface. **Third-party service: a ROKI account is required** This plugin connects your store to ROKI Connect, a payment service operated by ROKI, and it does nothing without it. You need a ROKI merchant account to obtain your API keys. Card numbers are never sent by your server: they are typed directly into a ROKI surface. Exactly what is sent, when, and the links to ROKI’s terms and privacy policy are in the **External services** section below. It is written out there once rather than in two places, so the two cannot drift apart. * Service and merchant accounts: https://roki.la * Technical documentation: https://connect.roki.la Built in Honduras by Danilo Antúnez. ### External services This plugin connects to **ROKI Connect**, the payment API of ROKI Technologies S. A. de C.V., to create and manage card payments. A ROKI merchant account is required; the plugin does nothing without one. ROKI is the payment processor, so this connection is what the plugin is for. **Every place this plugin reaches out, and from where** There are exactly four, and all four are ROKI: Where in the code Address When it happens `includes/class-roki-gateway.php` `https://aura.roki.systems/api/connect/v1` Server- side. Creating a payment, reading its status, voiding, refunding, fetching a receipt `includes/class-roki-gateway.php` `https://aura.roki.systems/api/connect/embed/ confirm` Server-side. Only in the embedded card-fields mode, to complete a charge from the single-use token `includes/class-roki-gateway.php` `https://aura.roki.systems/connect/components/ v1/roki.js` In the customer’s browser, on the checkout page of the classic checkout, only in the embedded card-fields mode `includes/class-roki-blocks.php` `https://aura.roki.systems/connect/components/ v1/roki.js` The same script, for the block checkout The two server-side calls carry your secret API key. The browser script never does: it is loaded with the publishable key, which cannot charge anything on its own. **With the hosted checkout, no ROKI script is loaded on your site at all** – the customer goes to a ROKI page instead. The browser only contacts ROKI when you turn on the card fields inside your own store. **What is sent, and when** Every time a customer places an order and chooses this payment method, the plugin sends the following to `https://aura.roki.systems/api/connect/v1`: * the order total, and a label built from the order number, so you can recognise the payment; * the order id, the order key and your store URL, so the payment can be matched back to the order when ROKI notifies your site; * an expiry time for the payment link; * the return addresses on your store, so the customer comes back after paying; * the billing name, email address and phone number, **only if the customer filled them in** at checkout. They prefill ROKI’s payment form and are used for the receipt. The card number is never sent by the plugin and never reaches your server: the customer types it on ROKI’s own page, or into an iframe served by ROKI, and only a single- use token comes back. The plugin also queries that same API to check the status of pending orders, and to void or refund a payment when you ask it to from the order screen. **What the browser script does** ``` roki.js draws the card fields inside an iframe served by ROKI and turns the card into a ``` single-use token. The card number is entered inside that iframe, on ROKI’s domain, so it never reaches your page or your server – only the token does, and your server exchanges it for a charge. **Terms and privacy** * Terms and Conditions: https://roki.la/terms * Privacy Policy: https://roki.la/privacy ## Screenshots [⌊ROKI Connect offered as a payment method in the store checkout.⌉⌊ROKI Connect offered as a payment method in the store checkout.⌉[ ROKI Connect offered as a payment method in the store checkout. [⌊The settings screen, with the selector between the two ways of charging.⌉⌊The settings screen, with the selector between the two ways of charging.⌉[ The settings screen, with the selector between the two ways of charging. [⌊The diagnostics, checking the configuration point by point.⌉⌊The diagnostics, checking the configuration point by point.⌉[ The diagnostics, checking the configuration point by point. [⌊A paid order, showing its ROKI transaction identifier.⌉⌊A paid order, showing its ROKI transaction identifier.⌉[ A paid order, showing its ROKI transaction identifier. ## Installation 1. Upload the plugin folder to `/wp-content/plugins/`, or install it from **Plugins > Add New**. 2. Activate it from the **Plugins** menu. 3. Go to **WooCommerce > Settings > Payments > ROKI Connect**. 4. Paste your secret key. It starts with `sk_test_` for testing and with `sk_live_` to charge for real. You will find it in the API integration tab of the ROKI portal. 5. In the mode selector, labelled `Como cobra`, choose how you want to charge: `Checkout de ROKI (el cliente sale de tu tienda)` sends the customer out to ROKI, and `Campos de tarjeta en tu tienda` draws the card fields inside your own checkout. For the second one you also need the publishable key (`pk_test_` or `pk_live_`) and your store must be served over HTTPS. 6. Copy the webhook address shown on that screen, register it in the ROKI portal, and paste back the signing secret it gives you. 7. Press the `Ejecutar diagnostico` button. If every check comes out green, you can start charging. ## FAQ ### Is the plugin interface in English? No. The settings, the notices and the customer-facing texts are in Spanish, because ROKI Connect is a Honduran payment gateway and its merchants read Spanish. Only this readme is in English, as the plugin directory requires. That is why the steps above quote the on-screen labels in Spanish: they are what you will actually see. ### Do I need HTTPS? Not for the ROKI hosted checkout: the payment happens on a ROKI page, which is HTTPS. For the card fields inside your store, yes – ROKI requires the return addresses to be HTTPS. If you have no certificate, the plugin falls back to the hosted checkout on its own and says so in the diagnostics. ### What happens if a webhook is lost? Nothing serious. Every five minutes the plugin looks at the orders that are still pending and asks ROKI about each one. A paid order is credited on its own even if the notification never arrived. ### Can I refund from WooCommerce? Yes, from the order. The plugin tries to void first, which is the right thing to do while the transaction has not settled, and refunds it if it can no longer be voided. ### Which currency does it charge in? Honduran lempira (HNL), which is what ROKI Connect processes. ### Can I test without charging for real? Yes. With an `sk_test_` key everything works the same against ROKI’s sandbox, without moving money. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “ROKI Connect for WooCommerce” is open source software. The following people have contributed to this plugin. Contributors * [ rokiconnect ](https://profiles.wordpress.org/rokiconnect/) [Translate “ROKI Connect for WooCommerce” into your language.](https://translate.wordpress.org/projects/wp-plugins/roki-connect-for-woocommerce) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/roki-connect-for-woocommerce/), check out the [SVN repository](https://plugins.svn.wordpress.org/roki-connect-for-woocommerce/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/roki-connect-for-woocommerce/) by [RSS](https://plugins.trac.wordpress.org/log/roki-connect-for-woocommerce/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.7 * The External services section now lists, one by one, every address this plugin contacts, which file does it, and under what conditions – including that with the hosted checkout the browser never contacts ROKI at all. #### 1.1.6 * Ready for the WordPress.org plugin directory. The text domain now matches the plugin slug, so the directory can serve translations; the plugin name follows the “for WooCommerce” pattern the directory requires; and this readme is in English. Nothing in the interface changed: the screens, the settings and their labels are exactly the same, in Spanish. * The diagnostics script is registered and attached with `wp_add_inline_script()` instead of being printed as a tag, and its result is built with `createElement` rather than `innerHTML`, because part of that text comes from the API response. * Added the `Requires Plugins: woocommerce` header. * The ROKI card script is now enqueued with the plugin version attached, so updating the plugin also refreshes the copy the browser had cached. * The diagnostics button is only drawn for users who can manage WooCommerce. It never granted anything by itself – the diagnostics action already checked the capability and rejected anyone else – but it printed its nonce on any admin screen that carried the right query parameter. #### 1.1.4 * Fixes a crash that took down the whole site when two ROKI plugins live together. Each one carries its own copy of the PHP client, and the second one to load brought WordPress down with a white screen. It showed up when installing the GiveWP donations plugin next to this one, which is a normal combination for a school or a church with a shop. Now the first one to load wins and the other reuses it. #### 1.1.3 * A payment made in ANOTHER store can no longer mark an order of this one as paid. If you have two stores connected to the same ROKI account – a test copy, two brands, or a migration with the old store still plugged in – each one receives the other’s notifications, signed with the same secret. The plugin now checks whose payment it is before touching anything. #### 1.1.2 * The card fields inside your store are no longer marked as Beta. The mode has already taken real payments, 3-D Secure included, and there is no reason for the setting to keep saying otherwise. #### 1.1.1 * Orders taken with the embedded card fields are back in reconciliation and in the query made when the customer returns from the checkout. They used to fall out of both, because both started by asking for a numeric id that this mode never produces: if the webhook was lost, the order stayed pending forever. #### 1.1.0 * The card fields can live inside your own store: the customer no longer has to go out to the ROKI checkout. You choose it in the settings, under `Como cobra`. * The hosted checkout is still there and is what gets used when the publishable key is missing or the store is not HTTPS. * The diagnostics warns you when you picked the card fields in your store but they are not being used, and why. #### 1.0.1 * The API client records the warnings ROKI returns when it ignores a field. * The automatic update check tolerates a manifest with a BOM, which used to make it fail silently. #### 1.0.0 * Classic and block checkout. * Signed webhooks with deduplication by event id. * Voids and refunds from the admin. * Automatic reconciliation every five minutes. ## Meta * Version **1.1.7** * Last updated **1 day ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1** * PHP version ** 8.0 or higher ** * Tags * [checkout](https://wordpress.org/plugins/tags/checkout/)[credit card](https://wordpress.org/plugins/tags/credit-card/) [payment gateway](https://wordpress.org/plugins/tags/payment-gateway/)[payments](https://wordpress.org/plugins/tags/payments/) * [Advanced View](https://wordpress.org/plugins/roki-connect-for-woocommerce/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/roki-connect-for-woocommerce/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/roki-connect-for-woocommerce/reviews/) ## Contributors * [ rokiconnect ](https://profiles.wordpress.org/rokiconnect/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/roki-connect-for-woocommerce/)