Skip to content

Plugins

On this page

CS-Cart Plugin

Install the official Paymos add-on for CS-Cart and Multi-Vendor, connect a project, verify signed status updates, and test an order before launch.

1. Requirements

  • CS-Cart or Multi-Vendor 4.20+ and a public HTTPS storefront
  • A Paymos account with a project selected in the dashboard
  • The official package from GitHub Releases

Official packages are identical for every merchant and contain no API keys, API secrets, project IDs, webhook secrets, OAuth tokens, or device codes.

2. Install

Upload the add-on release in Add-ons → Manage add-ons, create or edit the Paymos payment method, and click Connect Paymos in processor settings.

3. Connect

  1. Open the project you want to connect in the Paymos dashboard. The plugin uses that current project automatically; it never asks you to select it again.
  2. Click Connect Paymos in CS-Cart.
  3. Approve the displayed store URL and current project in Paymos. There is no second project selector.
  4. Return to the CMS after the connected status appears.

For Sandbox and Live, Paymos reuses the merchant's single active Payment key or creates one when none exists. It reuses a webhook only when the exact callback URL, Invoice category, and current project match; otherwise it creates a dedicated Invoice webhook. A conflicting webhook at the same URL is never silently overwritten:

https://your-store.example/index.php?dispatch=payment_notification.notify&payment=paymos&mode=webhook

OAuth device authorization is only the one-time delivery channel. The short-lived token is discarded; runtime Merchant API calls remain HMAC signed.

4. Secret storage

Credentials and temporary device state are stored in an AES-256-GCM envelope in the dedicated paymos_config table, keyed from CS-Cart crypt_key. Saved secrets are not rendered back into the administration page.

5. Test and go live

Select Sandbox, place a test order, and confirm the invoice and webhook-driven status update. Switch the same installation to Live when ready; reconnect only after changing the store URL, revoking a Payment key, or rotating a webhook secret.

Easy Digital Downloads Plugin Magento 2 Plugin