KueskiPay Gateway

Choose how many fortnights to pay with Kueski Pay

Requirements

• WordPress 6.2 or newer.
• WooCommerce 7.6 or newer.
• PHP 7.4 or newer is recommended.

External services

This plugin connects to services operated by Kueski (Kueski, S.A.P.I. de C.V., SOFOM, E.N.R.) to show promotional widgets and to create, check and refund payments. The payment connections are required for the gateway to work. They are made only after you activate the plugin and enter your Kueski API key.

When Sandbox mode is enabled, the Payments API calls go to https://payments-api.staging-pay.kueski.codes instead of https://api.kueskipay.com.

Kueski privacy notices:

• Customers and users: https://preguntas.frecuentes.kueski.com/hc/es/articles/12385430001563-Aviso-de-privacidad-integral-para-clientes-y-usuarios-de-Kueski-S-A-P-I-de-C-V-SOFOM-E-N-R
• Merchants (commercial allies): https://preguntas.frecuentes.kueski.com/hc/es/articles/12385599806747-PRIVACY-NOTICE-FOR-THIRD-PARTIES-AND-COMMERCIAL-ALLIES-OF-KUESKI-SAPI-DE-CV-SOFOM-ENR

Kueski Pay widgets (cdn.kueskipay.com)

• What it is: the script https://cdn.kueskipay.com/widgets.js, which shows the Kueski Pay installment widget on product and cart pages.
• When: the script is loaded on storefront pages.
• Data sent: your Kueski public API key, whether Sandbox mode is on, the integration name (woocommerce) and the plugin version. The visitor’s browser also sends its usual request data (IP address, User-Agent) to the CDN.
• Code: public/class-wc-kueski-gateway-public.php (kueski_widget_enqueue_scripts(), add_widget_init()).

Kueski Payments API (api.kueskipay.com)

Every request sends your Kueski API key in the Authorization header (refunds send a short-lived signed token instead, see below), plus the customer’s browser User-Agent, the request source (web or mobile), and the WordPress, WooCommerce, PHP and plugin versions. All calls are in includes/class-wc-kueski-gateway-api.php.

1. Validate API key: GET /v1/validate-keys
   • When: to check that the gateway is available at checkout, when an order is placed, and when the plugin’s kueski/v1/monitoring REST endpoint is called. The result is cached for 12 hours (10 minutes after an error).
   • Data sent: your API key.
2. Create payment: POST /v2/payment_intents
   • When: a customer places an order with Kueski Pay. The customer is then redirected to Kueski to complete the payment.
   • Data sent: the order ID and description, order total and currency, each item (name, description, SKU or WC-<product ID> when the product has none, quantity, price), the shipping address (first and last name, street, interior, city, state, postcode, country), the billing email and phone number, and the URLs Kueski returns the customer to.
3. Check one payment: GET /v2/payment_intents/{id}
   • When: the customer returns to the store from Kueski, and when an admin refreshes a pending refund.
   • Data sent: the Kueski payment ID.
4. Check pending payments: POST /v2/payment_intents/status
   • When: a WP-Cron task every 5 minutes, only while there are pending Kueski orders (up to 3 per run).
   • Data sent: the Kueski payment IDs of those orders.
5. Refund a payment: POST /v2/payment_intents/{id}/refunds
   • When: an admin issues a refund from the Kueski box on the order screen.
   • Data sent: the Kueski payment ID, the refund amount and currency, the reason (merchant_refund), a reference derived from the refund’s idempotency key, and an Authorization token (JWT, valid 5 minutes) signed with your private key. The private key itself is never sent.