Integrate Tilopay into your Adobe Commerce or Magento store

Official Tilopay extension for Adobe Commerce and Magento Open Source 2.4. Process card payments right inside your checkout, without sending the customer away from your store, and handle captures, refunds and voids from the Magento admin itself.

Direct download

tilopay-payment-magento-1.0.0.zip

Version 1.0.0 · Size 83 KB

Compatible with Adobe Commerce and Magento Open Source 2.4.6 or later (PHP 8.1 to 8.5).

Download the extension

SHA-256 checksum

33b81ea0097375398625b95de8e01b9f5523a63258848b06bdf15527dc1aaa62

•Embedded checkout with tokenization: the customer never leaves your store.
•3DS challenge in an overlay when the issuer requires it, without breaking the purchase.
•Cards, 0% interest installments, SINPE Móvil, Yappy and Apple Pay in a single payment method.
•Capture, full or partial refund and void from the Magento admin.
•Compatible with Adobe Commerce and Magento Open Source 2.4.6+ (PHP 8.1 to 8.5).
•Encrypted credentials, with card data always redacted from logs.

Start getting paid today

Download the extension View the setup guide

Official links

Get your credentials in the Tilopay dashboard

Talk to sales

Supported payment methods

MethodCheckout experience

Credit or debit card

Embedded form with tokenization and live brand detection; 3DS challenge in an overlay when the issuer requires it.

0% interest installments

Same card form; the plan is chosen in the checkout payment method selector.

SINPE Móvil

No fields to fill in: when the order is placed, the destination number, the exact amount and the description code are shown, and the order confirms itself as soon as the deposit is detected.

Yappy

Redirect to the Tilopay Hosted Payment Page.

Apple Pay

Native Apple Pay button in Safari on Apple devices, with the charge verified server-side.

Saved cards

Available when the merchant account has them enabled.

Available methods are read dynamically from your Tilopay account: the checkout only offers what your account has enabled.

Requirements

Platform: Adobe Commerce or Magento Open Source 2.4.6 or higher
PHP: 8.1 to 8.5, depending on what your Magento line supports
Credentials: A Tilopay account with API Key, API User and API Password (Admin dashboard → Platform integrations)
Version: 1.0.0
License: OSL-3.0
Access: Shell access on the store server to run the bin/magento commands

Installation

Download the extension with the button above and pick the installation path your store uses. In the commands, <locales> is the list of locales used by your store views, separated by spaces (for example: en_US es_CR).

Via Composer (recommended)

composer require tilopay/module-payment
bin/magento module:enable Tilopay_Payment
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f <locales>
bin/magento cache:flush

By copying the code

mkdir -p app/code/Tilopay/Payment

Unzip the package contents there and then run:

bin/magento module:enable Tilopay_Payment
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f <locales>
bin/magento cache:flush

In production mode the setup:static-content:deploy -f step is mandatory and must explicitly include every locale used by your store views (for example: en_US es_CR). If you skip it, the payment method simply does not appear at checkout.

Updating the module on Magento 2.4.7 or higher

bin/magento maintenance:enable
rm -rf pub/static/frontend/* pub/static/adminhtml/* pub/static/deployed_version.txt
rm -rf var/view_preprocessed/* var/cache/* var/page_cache/*
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f <locales>
bin/magento cache:flush
bin/magento maintenance:disable

Magento 2.4.7+ emits integrity attributes (SRI) for its static files. When updating the module in production mode you must regenerate static content from scratch, or the browser will block the checkout JavaScript. Also purge Varnish or your hosting cache if you have one.

Configuration

Stores → Configuration → Sales → Payment Methods → Tilopay.

Enabled: Turns the payment method on at checkout.
Title: The name your customer sees when choosing the payment method.
Environment: Production or Sandbox/Test. It must match the mode of your credentials, according to your Tilopay account setup.
API Key, API User and API Password: Credentials from your Tilopay admin dashboard. They are stored encrypted.
Payment Action: Authorize and capture (recommended) or authorize only.
New Order Status: The status Magento uses to create the order before charging.
Accepted Credit Card Types: Brands displayed at checkout.
Sort Order: The position of the method in the checkout list.
Debug Mode: Logs API requests and responses to var/log/tilopay_payment.log. Keep it off during normal operation.

•Credentials and settings support store view scope, so a single Magento install can run several stores with different accounts.
•The Tilopay API and SDK URLs are hardcoded in the module and are not configurable, so an admin account cannot repoint the script that captures card data to another host.

Operations from the Magento admin

•Capture: automatic with "Authorize and Capture", or manual by creating the Invoice if you use "Authorize Only".
•Full or partial refund: an online Credit Memo on the invoice. Available only for orders already captured.
•Void: available only for authorized orders that have not been captured yet.
•The order view shows the card brand, the last 4 digits and the authorization code, filled in automatically from Tilopay when the order is opened.

How the payment is confirmed

The extension never trusts return URL parameters to approve a charge.

•The order is created in Magento before charging, in a pending state, so no charge ever exists without its record.
•When the customer returns, the transaction is verified directly against the Tilopay API before the order is confirmed.
•If the payment is declined, the pending order is cancelled, the cart is kept and the reason is shown in the payment step so the customer can retry.
•Credentials, PAN, CVV and Apple Pay tokens are always redacted before anything is written to a log.
•The success page and the checkout session are only granted for an order placed by that same session, so the sequential order number in the return URL cannot be used to reach another customer's order.
•The endpoint that cancels an abandoned order only acts on an order belonging to the session that placed it, and only if it is a Tilopay order.

Before going live

•If your host uses a WAF or mod_security (Cloudways, for example), request an exemption for the tilopay/response/index route and verify it with a test purchase.
•Apple Pay only appears in Safari on Apple devices with Wallet set up, and requires Apple Pay enabled on your Tilopay account plus your store domain verified with Apple. Tilopay handles that verification.
•SINPE Móvil uses whole amounts: the total is rounded up for the transfer.
•This version does not include recurring payments or subscriptions.
•Confirmation emails: the module does not change how Magento sends email, but on a store with a slow SMTP relay, synchronous sending can delay order placement with any payment method. If that happens, enable asynchronous sending in Stores → Configuration → Sales → Sales Emails.

Frequently asked questions

Yes. It is the same extension for Adobe Commerce, Adobe Commerce Cloud and Magento Open Source 2.4.6 or higher.

Not with cards, 0% interest installments, SINPE Móvil or Apple Pay: everything happens inside your checkout. Only Yappy redirects to the Tilopay Hosted Payment Page.

Yes. They are issued with an online Credit Memo on the invoice, and are available for orders already captured. Authorized but uncaptured orders are cancelled with a void.

From the download button on this page. It is also available in your Tilopay admin dashboard, under Platform integrations.

Not in version 1.0.0. For recurring payments, use Tilopay's other integrations.

The API Key, API User and API Password from your Tilopay account. You set them in the Magento admin and they are stored encrypted.

Every transaction protected

The highest levels of international security so your customers' money and your payments stay more than safe.