Plugins & E-commerce
The official extensions, and what to do when your platform has none.
If you sell on an existing e-commerce platform, you don't need to touch the API: install the Wajub extension, paste your keys, start accepting payments.
Available integrations
Platforms
Not on WordPress? Two zero-code products cover the rest
Payment Links generates a shareable checkout link, no platform, no plugin. Invoice sends a payable invoice by email. Both are Wajub products in their own right (with their own quickstarts), not plugins. That's why they're not listed as "integrations" above.
Another platform?
Are you using Shopify, PrestaShop, or a custom CMS? Modules are gradually being deployed. Check the Changelog or write to support. In the meantime, API integration or a Payment Link covers all cases.
The principle, the same everywhere
- Install the extension on your platform.
- Paste your secret key, starting in sandbox. The browser never sees a key.
- Register the webhook URL the extension gives you, and save its signing secret.
- Place a test order, then switch to
livekeys.
Step three is the one people skip. Without the webhook, a payment the customer approves after closing the tab never reaches your store.
Connecting your own app
A plugin, a browser extension or a mobile app should not ask the merchant to copy a secret key.
It can ask for one instead, the way wajub login does: the merchant approves the request in the
Dashboard and your app receives a key once.
Start by opening a pairing session. Every field is optional except, in practice, client_type:
it is mobile, browser_extension, shopify, woocommerce or other, and names your app on the
approval screen.
curl https://dashboard.wajub.com/api/apps/auth/sessions \
-H "Content-Type: application/json" \
-d '{
"device_name": "Boutique Amina, WooCommerce",
"client_type": "woocommerce",
"environment": "sandbox"
}'The answer carries the code the merchant sees, the token only your app holds, and the page to open. The session expires after 15 minutes.
Open confirm_url in the merchant's browser. They sign in, pick the environment, give the key
every permission or a restricted set, and approve or refuse. Meanwhile, poll every interval
seconds with the polling token.
curl https://dashboard.wajub.com/api/apps/auth/sessions/poll \
-H "Authorization: Bearer <polling_token>"| Answer | Meaning |
|---|---|
200 with status: pending | Not decided yet, poll again |
200 with status: authorized | key, environment, client_type, business, api_base and key_expires_at are in the body |
403 with status: denied | The merchant refused |
410 with status: expired or consumed | Too late, or the key was already handed over |
404 | Unknown polling token |
The key is returned once, on the first authorized answer. Store it the way you would store any
secret key: it is a private key, or a restricted one if the merchant narrowed its permissions.
key_expires_at says when it expires, if it does.