Payra for WooCommerce

Payra for WooCommerce adds up to four Payra payment options to your checkout, on both the classic checkout and the Checkout block: card, US bank account (ACH debit) and Canadian bank account (EFT, pre-authorized debit) fields inside your checkout, and the Payra checkout page, where the customer pays on a Payra page and comes back.

• Card and bank account details are entered in secure fields rendered by Payra Elements and are tokenized before they reach Payra; your store never sees a card or account number.
• A bank debit carries the account holder’s ACH authorization, or for a Canadian account their pre-authorized debit (PAD) agreement, shown and accepted inside the secure fields. The order waits on hold until the debit settles, when the processor sends it to the bank in its next batch, and moves to processing when Payra confirms it.
• Orders are charged through the Payra API with your secret key, from your server.
• The Payra checkout page is a payment option of its own: the customer pays by card or bank account on a Payra page that shows your business name and logo, and comes back to your order confirmation. It needs your store on https.
• Customers with an account can save a card at checkout, or under My account → Payment methods, and pay later orders with it without typing it again. The card stays in Payra’s vault; your store keeps a reference to it. A card removed under My account is removed in Payra too.
• Refunds, full or partial, are issued from the order screen.
• Payra tells your store about payments that change after checkout (a confirmed charge, a returned payment, a refund) through a signed webhook.
• Test mode uses your sandbox keys, so you can try the checkout without moving money.

You need a Payra account with the API enabled. Keys are created in Payra under Settings → Integrations → API keys.

External services

This plugin connects to Payra (https://payra.com), the payment service it exists for. It does nothing until you paste your Payra API keys in its settings; entering them is your consent to the connections below.

• Card and bank account fields: the plugin loads Payra Elements, a JavaScript library, from the Payra API host (https://api-dashboard.payra.com/v1/payra.js). The library renders the card or bank account fields inside secure frames served by Payra’s vault, so the card number, expiration date and security code, or the routing and account numbers (for a Canadian account, the account number), go from the customer’s browser to the vault and never through your site. It also sends the customer’s name to Payra together with the tokenized details; for a card or a US bank account, the billing postal code; for a US bank account, the account type and the customer’s acceptance of the ACH authorization; for a Canadian account, the institution and transit numbers, the account type and the customer’s acceptance of the pre-authorized debit agreement.
• Card vault (Very Good Security): the secure frames are served from https://js.verygoodvault.com and the card number, expiration date and security code, or the bank account numbers, the customer types are sent from the frames to https://vgs-collect-keeper.apps.verygood.systems, the vault Payra uses to tokenize them on its behalf. Very Good Security’s terms: https://www.verygoodsecurity.com/terms — privacy policy: https://www.verygoodsecurity.com/privacy-policy
• Your server: when an order is placed, the plugin sends Payra the order total, currency, order number, the store name, the order’s lines (each product’s name, SKU, quantity and price, and any fee) with its shipping, tax and discount, and the tokenized card or bank account reference to charge it and, for a card, the address of your order confirmation page; when you refund from the order screen it sends the amount and the reason. Payra answers with the payment’s status, which the plugin stores on the order. When the card’s bank asks to verify the customer (3-D Secure), the customer is sent to their bank’s page and back, through Payra, to your order confirmation page, where the plugin reads the payment’s status from Payra.
• Saved cards (customers with an account): when a customer creates an account, or first saves a card, the plugin sends Payra their email address, their first and last name when they gave one, and a reference made of your site and their user id, so Payra keeps them as a customer of your workspace. To show the saved cards at checkout and under My account, the plugin reads the customer’s saved cards from Payra; a card the customer deletes under My account is removed in Payra.
• Payra checkout page (only when you offer it): when an order is placed, the plugin sends Payra the order total, currency, order number and id, a description with the store name, the order’s lines (each product’s name, SKU, quantity and price, and any fee) with its shipping, tax and discount, the customer’s email address, and the addresses of your order confirmation and order payment pages. The customer is then sent to a Payra page on https://dashboard.payra.com, enters the card or bank account details there in the same secure frames, and is sent back to your order confirmation page.
• Webhook: Payra sends signed notifications to your site (/wp-json/payra/v1/webhook) when a payment or refund changes; the plugin verifies the signature with the secret you configured before acting.

Payra’s terms of service: https://payra.com/terms — Payra’s privacy policy: https://payra.com/privacy