OpenCart 4 · Coriunder Hosted Gateway

The Coriunder gateway, rebuilt for the OpenCart 4 admin.

A PHP 8 extension for OpenCart 4.1 that hands checkout to the Coriunder hosted payment page and settles the order from a signed webhook. Like its OpenCart 3 sibling, it refuses HTTP and non-production endpoints by design.

Download OCMOD package Read the documentation
4.1.0.x
OpenCart
PHP 8.0.2+
Required
Signed
Webhooks
What you get

Built for OpenCart 4, not ported to it

Built against the OpenCart 4.1 extension APIs, installed from a single OCMOD archive.

Hosted payment page

The shopper pays on Coriunder’s page and returns to your store. Card data never reaches your OpenCart installation.

PHP 8 native

Requires PHP 8.0.2 or newer, within the range supported by your OpenCart release, with JSON, hash, OpenSSL and sessions enabled.

Production endpoints only

HTTP is rejected, along with common test, sandbox, staging, demo and development endpoints. Production URLs must sit under coriunder.cloud.

Signed webhooks

Notification signatures are verified before an order changes state, so a forged POST cannot mark an order as paid.

Three-way status mapping

Pending/3DS, successful/paid and failed/declined each map to an OpenCart order status you choose.

Portal or static credentials

Use a live merchant ID and personal hash, or a live portal token and production portal endpoint.

How it works

From cart to confirmed order

A redirect flow with a signed webhook backing it up.

Shopper picks Coriunder

The payment method appears at checkout once the extension is enabled and credentials are saved.

They pay on the hosted page

OpenCart hands the signed request to the Coriunder payment page over HTTPS. 3-D Secure runs here when enabled.

They return to your store

The shopper lands back on your confirmation page while the order awaits its verified result.

The webhook settles it

Coriunder POSTs the result to your store. The signature is verified, then the order moves to your mapped status.

Built for trust

Built to fail safe, not fail quietly

The extension takes a deliberately strict line on configuration. A store pointed at an unapproved or non-HTTPS endpoint will not process payments, which is the correct outcome for a payment integration.

Before general enablement, take a current file and database backup and complete a controlled low-value live transaction.

See the technical documentation
  • HTTP rejected. Only publicly trusted HTTPS endpoints are accepted for the storefront and the gateway.
  • Non-production endpoints rejected. Common test, sandbox, staging, demo and development URLs are refused outright.
  • Approved hosts only. The production URL must be an approved address under coriunder.cloud.
  • Verified webhooks. Notification signatures are checked before an order changes state.
  • Reachable by design. The webhook must be reachable without login, maintenance blocking or a CDN challenge.
  • Admin-gated. Installing and configuring the extension requires administrator rights.
Requirements

Check your store in ten seconds

Current extension version: 3.1.3.

RequirementSupported
OpenCart4.1.0.1, 4.1.0.2 or 4.1.0.3. 4.0.2.3 is expected to work but must be verified on the target store
PHP8.0.2 or newer, within the range supported by the selected OpenCart release, with JSON, hash, OpenSSL, sessions and HTTPS URL-stream support enabled
StorefrontPublicly trusted HTTPS. The webhook must be reachable without login, maintenance blocking or a CDN challenge
CredentialsLive merchant ID, personal hash and an approved production URL under coriunder.cloud; or a live portal token and production portal endpoint
Order statusesPending/3DS, successful/paid and failed/declined
PermissionsAdministrator rights to install extensions and configure payment methods
Installation

Live in four steps

Back up first, then install like any other OpenCart 4 extension.

Back up

Take a current file and database backup before installing anything on a live store.

Install the OCMOD

Upload coriunder.ocmod.zip through Extensions → Installer, then refresh the modification cache.

Configure

Open Extensions → Payments → Coriunder, enter your live credentials and production URL, and map your order statuses.

Verify live

Complete a controlled low-value live transaction before enabling the method for all shoppers.

Questions

Frequently asked

Which OpenCart 4 versions are supported?

4.1.0.1, 4.1.0.2 and 4.1.0.3. Version 4.0.2.3 is expected to work but must be verified on your own store.

What PHP version do I need?

PHP 8.0.2 or newer, within the range supported by your OpenCart release, with the JSON, hash, OpenSSL, sessions and HTTPS URL-stream features available.

Can I test it on a sandbox endpoint?

No. The extension intentionally rejects HTTP and common test, sandbox, staging, demo and development endpoints. Verify with a controlled low-value live transaction instead.

Is this the same package as OpenCart 3?

No. OpenCart 3 and OpenCart 4 have separate packages. Use coriunder.ocmod.zip for OpenCart 4.

What does the webhook need?

It must be reachable over publicly trusted HTTPS without a login, maintenance-mode block or CDN challenge in front of it.

What happens to orders during 3-D Secure?

They sit in your configured pending/3DS status until the verified result arrives, then move to the paid or failed status you mapped.

Ready to accept payments?

Download the OCMOD package and connect your OpenCart 4 store to Coriunder.

Download OCMOD package Talk to Coriunder