Docs

Appearance

Payments & Webhooks ​

NXCart supports Stripe and PayPal hosted payment flows with webhook-based order confirmation.

Stripe setup checklist ​

  1. Create webhook endpoint in Stripe: https://yoursite.com/index.php?option=com_nxcart&task=webhook.stripe
  2. Subscribe to:
    • checkout.session.completed (required — settles the order once payment clears)
    • checkout.session.expired (recommended — cancels an abandoned checkout and releases the reserved stock promptly)
  3. Copy webhook signing secret (whsec_...).
  4. Add publishable key, secret key, and webhook secret in Settings → Payments → Stripe.

Which events to send

NXCart settles strictly from the Checkout Session lifecycle, so those two events are all it needs. You don't need to add payment_intent.* events — they're ignored (they share the session's payment id, so acting on them could interfere with settlement). A failed card attempt simply leaves the order pending; the buyer can retry, and an unfinished checkout is cleaned up when its session expires.

PayPal setup checklist ​

  1. Create webhook endpoint in PayPal: https://yoursite.com/index.php?option=com_nxcart&task=webhook.paypal
  2. Subscribe to:
    • CHECKOUT.ORDER.APPROVED (required)
    • PAYMENT.CAPTURE.COMPLETED (required)
    • PAYMENT.CAPTURE.DENIED (recommended)
    • PAYMENT.CAPTURE.REFUNDED (recommended)
  3. Copy webhook ID (not the URL).
  4. Add client ID, client secret, and webhook ID in Settings → Payments → PayPal.

Webhook behavior ​

  • Webhooks transition orders from pending to paid/refunded states.
  • Signature validation is mandatory for both gateways.
  • Duplicate gateway notifications are handled safely, so orders are not charged or recorded twice.

Troubleshooting ​

Orders stuck in pending ​

Check:

  1. Endpoint URL is reachable from the gateway.
  2. Correct webhook secret/ID is saved.
  3. Required events are enabled.
  4. SSL and firewall configuration allow webhook POST requests.

Signature validation errors ​

  • Re-copy Stripe signing secret (whsec_...).
  • For PayPal, verify you stored the webhook ID, not endpoint URL.
  • Ensure sandbox/live credentials match the active gateway mode.

Monitoring ​

  • Review webhook attempts in Stripe/PayPal dashboards.
  • Review component audit trail and logs in admin for failed webhook processing.