> For the complete documentation index, see [llms.txt](https://docs.ecommerce.seb.ee/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ecommerce.seb.ee/integration/web-plugins/magento-2/configuration.md). # Configuration Configure the SEB E-commerce Payment Gateway module for Magento 2 Open **Stores → Configuration → Sales → Payment Methods**, expand **Other Payment Methods** and find **SEB E-commerce Payment Gateway**. ## Settings reference | Setting | What it does | Default | When to change | | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | **Enabled** | Offers/hides the payment method at checkout | No | Set to *Yes* after entering credentials | | **Environment** | *Sandbox* (test) or *Live*. The credential fields shown switch with your selection; each environment keeps its own pair, and the module targets the matching gateway endpoints automatically | Sandbox | Switch to Live only after [testing](/integration/web-plugins/magento-2/testing-and-go-live.md) | | **Gateway API URL** | Your SEB E-commerce Payment Gateway base hostname, from your onboarding information. The module derives the API and identity endpoints for the selected environment from it | `https://ecommerce.sebgroup.com` | Set once (required) | | **OAuth2 Client ID** | Shop credential from the Merchant Portal → **Settings → Shop Settings → Technical Information** | — | Per environment | | **OAuth2 Client Secret** | Its secret counterpart — stored **encrypted** by Magento | — | Rotate here whenever rotated in the portal | | **Saved cards** | Lets logged-in customers save the card they pay with and pay with it later in one click. See [Saved cards](#saved-cards) | No | Set to *Yes* when you want to offer one-click checkout | | **Saved card purposes** | What a newly saved card may be used for: *one-click payments*, or *one-click and merchant-initiated payments*. Only shown and used when **Saved cards** is on | One-click payments | Keep the default — the module only makes payments with the customer present | | **Callback Notification URL** | Read-only. Register it as the Callback URL for your shop in the Merchant Portal | `https:///rest/V1/egw/payment/status` | See [Register the callback URL](#register-the-callback-url) | Configuration scope: settings can be set per website/store view using the standard Magento scope switcher. The payment method title your customer sees at checkout is *Online Payment*; it is not editable in this version. **Save Config**, then flush caches (**System → Cache Management**). ![The expanded SEB E-commerce Payment Gateway configuration section, showing Enabled = Yes, Environment = Sandbox, Gateway API URL, OAuth2 Client ID/Secret (masked) and the read-only Callback Notification URL.](https://1157570179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuBDtfypkI85zidcVwaDj%2Fuploads%2FkO9Q72ckjMsqdjtmwzn8%2Fm2-settings-panel.png?alt=media) ## Saved cards Optional, **off by default** — with **Saved cards** set to *No* nothing changes for your customers. It builds on Magento's own vault (stored payment methods) and works with the default Luma checkout. * **Saving a card.** Customers who are logged in see an unticked **Save my card for faster checkout** option in the *Online Payment* method. If they tick it, the gateway keeps a token for the card after a successful payment. Your store keeps only that token and display details (card brand, last four digits, expiry, cardholder name, card image) — never the card number. Guest checkouts are never offered the option. * **Paying with a saved card.** On later orders each saved card appears in Magento's **Stored Cards** group at the top of the payment step, with the card image next to it. Choosing one skips card entry; the customer goes to the gateway only for 3-D Secure. * **Managing cards.** Customers see their cards under **My Account → Stored Payment Methods** and can delete them there. Deleting removes the card from your store and asks the gateway to stop accepting it. Deleting a customer deactivates their tokens at the gateway. * **Card images** are loaded from the gateway's image host. Magento enforces a Content Security Policy on the checkout page, so the module adds that host to it automatically; if you manage the policy yourself, make sure it still applies on the checkout page. A card without an image shows Magento's normal card-type icon. * **Switching it off** hides the option and the saved cards at checkout. Stored cards are not deleted, and customers can still remove them under **My Account → Stored Payment Methods**. * Mention saved cards in your store's privacy information as appropriate for your business. Save the configuration and flush caches, then test it in Sandbox first with the test card from [Testing & go-live](/integration/web-plugins/magento-2/testing-and-go-live.md). ## Register the callback URL 1. Copy the **Callback Notification URL** shown in the settings. 2. In the Merchant Portal at , go to **Settings → Shop Settings → Technical Information** and save it as your shop's **Callback URL**. 3. Verify with a sandbox order ([Testing & go-live](/integration/web-plugins/magento-2/testing-and-go-live.md)). The endpoint is part of Magento's REST API — ensure no WAF/caching layer blocks anonymous POSTs to `/rest/V1/egw/payment/status`. ## How callback notifications are verified Order integrity here rests on verification rather than on a signature: the callback endpoint is public and SEB E-commerce Payment Gateway does not sign its notifications, so your store cannot cryptographically prove who sent one. Instead, the module never trusts the message body: * The notification must reference an order payment whose stored payment ID matches the payment ID in the message. Unknown or mismatched pairs are rejected. * The module then asks the gateway over its own authenticated API connection what the payment status actually is, and applies only that. A message claiming a payment succeeded cannot invoice an order unless the gateway independently reports it as paid. ## Sandbox vs Live Only the endpoints and the credential pair change. Test in Sandbox first; going live is: Environment → *Live*, live credentials, Save Config, cache flush, one real test order. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.ecommerce.seb.ee/integration/web-plugins/magento-2/configuration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.