> For the complete documentation index, see [llms.txt](https://docs.ecommerce.seb.ee/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ecommerce.seb.ee/integration/web-plugins/woocommerce/configuration.md). # Configuration Configure the SEB E-commerce Payment Gateway plugin for WooCommerce Open **WooCommerce → Settings → Payments**, find **SEB E-commerce Payment Gateway** and select **Manage**. ## Settings reference | Setting | What it does | Default | When to change | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | **Enabled** | Offers or hides the payment method at checkout | Enabled | Enable after entering credentials | | **Environment** | Selects *Sandbox* (test) or *Live* (real payments). Each has its own OAuth2 Client Credentials; the plugin switches the visible fields and the gateway endpoints it calls | Sandbox | Switch to Live only after completing [testing](/integration/web-plugins/woocommerce/testing-and-go-live.md) | | **Title** | Payment method name your customer sees at checkout | Online Payment | Rename or localize freely (required, cannot be blank) | | **Description** | Text shown under the title at checkout | You will be redirected to a secure payment page to complete your purchase. | Keep the redirect expectation clear (required) | | **Gateway API URL** | Your SEB E-commerce Payment Gateway base hostname, from your onboarding information. The plugin derives the API and identity endpoints for the selected environment from it | `https://ecommerce.sebgroup.com` | Set once (required) | | **OAuth2 Client ID** | Shop credential from the Merchant Portal → **Settings → Shop Settings → Technical Information** | — | Required for the selected environment | | **OAuth2 Client Secret** | Its secret counterpart, stored by WordPress. Treat your database as sensitive | — | Rotate here whenever you rotate it in the portal | | **Saved cards** | Lets logged-in customers save the card they pay with and pay with it later in one click. See [Saved cards](#saved-cards) | Off | Enable when you want to offer one-click checkout | | **Saved card purposes** | What a newly saved card may be used for: *one-click payments*, or *one-click and merchant-initiated payments*. Only applies when **Saved cards** is on | One-click payments | Keep the default — the plugin only makes payments with the customer present | | **Callback Notification URL** | Read-only. Register this as the Callback URL for your shop in the Merchant Portal | `https:///?wc-api=egw_checkout_callback` | See [Register the callback URL](#register-the-callback-url) | Save your changes. Blank required fields are flagged at the top of the page and highlighted inline. ![The gateway settings panel (WooCommerce → Settings → Payments → Manage), showing Enabled, Environment = Sandbox, Title, Description, Gateway API URL, OAuth2 Client ID/Secret (masked) and the read-only Callback Notification URL.](https://1157570179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuBDtfypkI85zidcVwaDj%2Fuploads%2FDFrlcRUyNvQSklZOjohm%2Fwc-settings-panel.png?alt=media) ## Saved cards Optional, **off by default** — with **Saved cards** off nothing changes for your customers. Switch it on in the settings above and save. It works with both the classic and the Blocks checkout and uses WooCommerce's own saved payment methods. * **Saving a card.** Customers who are logged in see an unticked **Save my card for faster checkout** option (WooCommerce's standard "save payment information" checkbox). If they tick it, the gateway keeps a token for the card after a successful payment. Your store keeps only that token and display details (card brand, last four digits, expiry, cardholder name, card image) — never the card number. Guest checkouts are never offered the option. * **Paying with a saved card.** On later orders the customer picks the saved card in the checkout's list of saved payment methods, with the card image next to it. That skips card entry; the customer goes to the gateway only for 3-D Secure. * **Managing cards.** Customers see their cards under **My Account → Payment methods** and can delete them there. Deleting removes the card from your store and asks the gateway to stop accepting it. * **Switching it off** stops offering saved cards at checkout. Stored cards are not deleted. * **Card images** are the card art the gateway returns; a card without one is shown as text only. * Mention saved cards in your store's privacy information as appropriate for your business. Test it in Sandbox first with the test card from [Testing & go-live](/integration/web-plugins/woocommerce/testing-and-go-live.md). ## Register the callback URL The plugin finalizes an order the moment the customer is redirected back to your store after checkout — that doesn't need the callback. Register it anyway for the cases that do: a shopper who never makes it back (closed tab, bank redirect timeout, dropped connection), and status changes that happen later, such as delayed settlement or a refund issued in the Merchant Portal. 1. Copy the **Callback Notification URL** shown in the settings screen. 2. In the Merchant Portal at , go to **Settings → Shop Settings → Technical Information** and save it as the **Callback URL** for your shop. 3. Confirm it with a sandbox test payment ([Testing & go-live](/integration/web-plugins/woocommerce/testing-and-go-live.md)) — the order status changes without you touching it. ![Merchant Portal → Settings → Shop Settings → Technical Information, with the Callback URL field filled in with the store's callback address.](https://1157570179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuBDtfypkI85zidcVwaDj%2Fuploads%2F4Qkp1AJeE5CU7rRt4aP3%2Fwc-callback-url-registration.png?alt=media) ⚠️ **Never let a cache, firewall, or security plugin block or cache the callback URL.** A blocked callback silently stops order status updates for every payment it would have covered — allow POST requests to it explicitly. ## How callback notifications are verified The callback URL is a public endpoint, and SEB E-commerce Payment Gateway does not sign its notifications — your store can't cryptographically prove who sent one. The plugin compensates by never trusting the message body on its own: * It rejects any notification whose payment ID doesn't match the transaction ID already stored on the referenced order. * It then asks the gateway, over its own authenticated API connection, what the payment status actually is, and applies only that. A message claiming a payment succeeded can't mark an order paid unless the gateway independently confirms it. This still has a practical limit: someone who already knows a valid payment ID and its order can trigger your store into re-processing that order — re-applying the status the gateway reports, along with the emails and stock effects that follow. They can't invent a status, change an amount, or touch any other order. ## Sandbox vs Live Sandbox and Live differ in exactly two things: the endpoints the plugin calls, and which credential pair it uses. Always test in Sandbox first. To switch to Live: set Environment to *Live*, enter your Live credentials, save, and place one real test order. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.ecommerce.seb.ee/integration/web-plugins/woocommerce/configuration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.