Moment Payments for WooCommerce
·
Accept payments via Moment — one-time hosted checkout with webhook-driven order updates.
Moment Payments for WooCommerce integrates the Moment hosted checkout into your WooCommerce store. Customers are redirected to a secure Moment-hosted payment page and returned to your store after completion. Order status is driven by signed webhooks — no polling required.
Features
- One-time payments via hosted checkout redirect
- EFT and wallet support
- Subscriptions (requires WooCommerce Subscriptions)
- Full and partial refunds from the WooCommerce admin
- Block checkout and classic shortcode checkout support
- HMAC-SHA256 webhook signature verification with replay-attack protection
- Configurable verify-on-return API check to close the redirect–webhook race
- Admin notices for missing credentials, no HTTPS, and WooCommerce version checks
- Debug logging via WooCommerce log viewer (tagged
source=moment-payments)
Requirements
- WordPress 6.0+
- WooCommerce 8.0+
- PHP 7.4+
- A Moment merchant account (sign up)
- Store currency must be ZAR
External services
This plugin connects to the Moment payments API (https://api.momentpay.net) operated by Moment. The connection is required for the plugin to function as a payment gateway.
What is sent and when
- When a customer places an order, the plugin sends the order ID, order key, currency, amount, customer email, and billing details (name, address) to Moment to create a hosted-checkout payment session.
- After the customer is redirected back to the store, if the “Verify on return” option is enabled, the plugin queries Moment for the session status using the session ID.
- When a card last-4 / scheme is needed for display in the WooCommerce admin, the plugin queries Moment for the payment object using its payment ID.
- When a merchant issues a refund from the WooCommerce admin, the plugin sends the payment ID, amount, and optional reason to Moment.
- Moment delivers signed webhook events (payment_session.updated, payment.refunded) inbound to the plugin’s webhook endpoint; the plugin verifies the HMAC-SHA256 signature and updates order status accordingly.
No card data ever touches the merchant site — card details are entered only on Moment’s hosted checkout pages, which the plugin does not control.
Service provider
- Service: Moment — https://momentco.net
- Terms of service and privacy policy: https://momentco.net/legal