ePay Paycenter for WooCommerce

Accept credit or debit card payments through the secure Redirection service of Piraeus Bank / Euronet Merchant Services.

The ePay Paycenter for WooCommerce is the payment module of our online store for card payments through the ePay Paycenter Redirection service of Piraeus Bank / Euronet Merchant Services.

The customer selects card payment at checkout, is transferred to the bank's secure payment page, completes the transaction (with 3D Secure where required) and returns automatically to the store with the order updated. Card details never pass through the store's server.

Why choose it

Secure payment through the bank. The transaction takes place entirely on the Piraeus Bank / Euronet page. The store neither stores nor processes card numbers.
Cards and IRIS. Credit and debit cards are supported, as well as IRIS payments when the service is enabled in the merchant's agreement.
Instalments. Optionally, interest-bearing instalments are offered according to the order amount, as long as the bank agreement allows it.
Modern checkout. Both the classic checkout and the WooCommerce Blocks Checkout are supported, as well as HPOS (High-Performance Order Storage).
Full traceability. Every callback is logged, authenticity is verified with HMAC-SHA256, there is a built-in callback address diagnostic and special care is taken for Cloudflare / WAF.
Greek and English payment page. The language of the payment page is selected from the settings (Greek, English, Russian, German).

What you need from the bank

To activate the module, simply ask Euronet Merchant Services / Piraeus Bank for the following details of your merchant account:

Item	Description
Environment	Production account (for real payments). Test and production accounts have different credentials.
Acquirer ID	Numeric acquirer identifier.
Merchant ID	Numeric merchant identifier.
POS ID	Numeric POS identifier.
Username	Username for the Ticketing Web Service (up to 50 characters).
Password	Password for the Ticketing Web Service. It is entered in plain text and is automatically converted to an MD5 hash before it is sent to Paycenter.

You don't need to request or configure anything else in terms of code. The remaining details (callback addresses, IP, response method) are generated automatically by the module and are shown ready to copy on the settings page.

Settings in WooCommerce

Go to WooCommerce → Settings → Payments → ePay Paycenter and fill in:

General

Setting	Recommended value
Enable	Enabled
Title	`Credit / Debit Card (Piraeus Bank)`
Description	The text the customer sees at checkout. Default: secure card payment through the Piraeus Bank page.

Merchant credentials

Setting	Value
Environment	Production account (for live payments)
Acquirer ID	From the bank
Merchant ID	From the bank
POS ID	From the bank
Username	From the bank
Password	From the bank

Payment behaviour

Setting	Recommended value	Note
Transaction type	Sale (immediate charge)	The charge is completed immediately. "Pre-approval" requires activation by Euronet Merchant Services.
Pre-approval expiry (days)	7	Applies only to Pre-approval transactions. Ignored when the type is "Sale".
Payment page language	Greek (`el-GR`)	Alternatively English, Russian or German.

Instalments (optional)

Enable Instalments support only if the bank has enabled instalments in your agreement. You can set a maximum number of instalments, a minimum order amount and a tiered limit per amount (e.g. 50:3, 100:6, 200:12). Instalments are interest-bearing for the customer and the fee is borne by the merchant.

Completion

Press Save changes and then Test callback address. The test checks whether the callback reaches our server and whether a hosting firewall (ModSecurity, cPFence, Imunify360, BitNinja, LiteSpeed) blocks it.

What the bank asks for

On the same settings page, the Bank integration data card shows ready-to-use values for Euronet Merchant Services:

Field	Value
Website URL	The URL of the store
Referrer URL	The checkout page that starts the payment
Success URL	`/?wc-api=epay_paycenter`
Failure URL	`/?wc-api=epay_paycenter`
Backlink URL	`/?wc-api=epay_paycenter`
IP address	The server's address (confirm the outgoing IP behind a proxy/CDN with your hosting provider)
Response method	POST (recommended — GET is supported too)

Use the Copy button to copy all callback addresses and declare them in the Euronet portal.

Important: The callback address must be registered in the bank's portal as a full URL with the store's domain and ending exactly in /?wc-api=epay_paycenter (or /wc-api/epay_paycenter/). If a different address is registered, payments may be charged while the orders are not updated automatically.

How the payment works

The customer selects Credit / Debit Card (Piraeus Bank) at checkout.
The order is created with a Pending payment status and the customer is transferred to the order's payment page.
The module requests a TranTicket from the Paycenter Ticketing Web Service (SOAP).
The store automatically submits the connection form to the bank's Redirection page.
The customer pays on the secure Piraeus Bank / Euronet page (card or IRIS).
The bank posts the response to /?wc-api=epay_paycenter.
The module verifies the response with the HMAC-SHA256 HashKey, checks that the MerchantReference belongs to the order and:
on success, completes the order (Completed / Processing depending on the products) and empties the cart,
on failure, sets the order to Failed and shows the customer a message on the retry page.
If the customer presses Cancel on the bank's page, they return with a secure token and can try the payment again.

Technical implementation

Endpoints

Ticketing (SOAP): https://paycenter.piraeusbank.gr/services/tickets/issuer.asmx
Redirection (payment page): https://paycenter.piraeusbank.gr/redirection/pay.aspx
Callback: /?wc-api=epay_paycenter

Security

No card data is stored on the store's server.
HMAC-SHA256 HashKey on every successful response, with the fields defined by the Redirection v2.9 specification.
Verification that the MerchantReference matches the order and that the order uses this specific gateway.
Idempotency: repeated callbacks on an already paid order are ignored.
One-time cancel token for the return from the Cancel button.
The TranTicket is deleted from the meta after verification and is kept only as a SHA-256 digest in the {prefix}epay_paycenter_tickets table.
Optional IP allowlist through the epay_paycenter_allowed_callback_ips filter (supports CF-Connecting-IP behind Cloudflare).
Credentials are never written to the logs.

Order data

Stored as order meta, among others:

_epay_merchant_reference, _epay_tran_ticket, _epay_cancel_token, _epay_result_code, _epay_result_description, _epay_response_code, _epay_response_description, _epay_status_flag, _epay_transaction_id, _epay_auth_status, _epay_approval_code, _epay_package_no, _epay_trace_id, _epay_support_reference_id, _epay_card_type, _epay_payment_method, _epay_installments, _epay_last_callback_at.

Requirements

WordPress 6.3+
WooCommerce 7.0+ (tested up to 9.5)
PHP 7.4+
An active ePay Paycenter Redirection agreement with Euronet Merchant Services / Piraeus Bank

Troubleshooting

Symptom	What to check
The payment is charged but the order stays Pending	Make sure the Success / Failure / Backlink URLs in the bank's portal are exactly `/?wc-api=epay_paycenter`.
The callback never arrives	Press Test callback address. If it fails, ask your hosting provider to allow the callback address (WAF / ModSecurity / cPFence / Imunify360 / BitNinja / LiteSpeed).
Using Cloudflare	The settings page shows the current Cloudflare IPv4 ranges. Give them to Euronet so that callbacks are not blocked.
Order On hold after a successful payment	HashKey verification failed. Check the credentials and the `epay-paycenter` logs. A manual check is required before execution.
Blank page or `-1` after the payment	Check whether a callback is recorded in the logs. If not, the POST never reached the PHP (WAF or wrong URL).
Ticket issuance fails	Check the Acquirer ID, Merchant ID, POS ID, username/password and whether the environment is correct (Test / Production).

Enable Logging for detailed records in WooCommerce → Status → Logs, with source epay-paycenter.

Notes

Refunds are not performed by WooCommerce with this module; they are handled in the Piraeus Bank / Euronet back office.
IRIS payments do not support instalments or refunds.
Pre-approval expiry is ignored when the transaction type is Sale (immediate charge).
The credentials of the Test and the Production account are different. Never copy them between environments.

Want us to install it for you?

We can install and configure it for you, or adapt it to your store's needs.

Contact us