Brumisphere Checkout Button for HelloAsso
| 开发者 | brumisphere |
|---|---|
| 更新时间 | 2026年8月15日 18:23 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
[helloasso_checkout_button] shortcode to WordPress. It creates HelloAsso checkout intents server-side only after the visitor clicks the button, stores payment records in separate sandbox and production tables, and updates payment state through HelloAsso webhooks.
The plugin is published by Brumisphère, Agence Webmarketing, and is designed as a business-agnostic HelloAsso checkout integration. It does not include booking, calendar, week selection, or custom business workflows.
Features
- Generic
[helloasso_checkout_button]shortcode. - Server-side checkout creation after an explicit visitor click.
- Transient-backed checkout configuration with nonce validation.
- Separate sandbox and production credentials.
- Separate physical payment tables for sandbox and production.
- HelloAsso OAuth and API v5 clients with tuned WordPress HTTP requests.
- Optional defensive cURL fallback for a specific Azure 404 HTML misroute, disabled by default and available through a developer filter after WordPress HTTP API is tried first.
- Environment-specific webhook endpoints.
- HMAC SHA-256 webhook validation when an environment Webhook Signature Key is configured.
- Controlled unsigned webhook fallback when a signature key is unavailable.
- Admin Payments screen for sandbox and production logs without changing the active checkout environment.
- Minimized webhook event storage; raw webhook payloads are not stored by default.
- Secure output escaping, settings sanitization, and admin capability checks.
安装:
- Upload the
brumisphere-checkout-button-helloassofolder to/wp-content/plugins/. - Activate Brumisphere Checkout Button for HelloAsso through the WordPress Plugins screen.
- Open HelloAsso Checkout > Settings.
- Configure sandbox credentials first.
- Add
[helloasso_checkout_button]to a page or post.
常见问题:
What does this plugin do?
It adds a generic HelloAsso checkout button to WordPress and handles server-side checkout creation, payment persistence, and webhook updates.
Do I need a HelloAsso account?
Yes. You need a HelloAsso organization and API credentials for the environment you want to use.
Can I use Sandbox and Production?
Yes. Sandbox and production credentials can be configured at the same time. The active environment controls new checkouts only; the Payments screen can show both environments.
How do I display the checkout button?
Add [helloasso_checkout_button] to a post, page, or compatible editor block.
Does the plugin expose API secrets on the frontend or admin screens?
No. Client secrets, access tokens, webhook signature keys, and Authorization headers are never exposed to visitors. Configured admin secrets are not printed back into password field values; leave the field empty to keep an existing value, enter a new value to replace it, or use the explicit clear checkbox to remove it.
How are webhooks secured?
When a Webhook Signature Key is configured for the environment, the plugin validates the x-ha-signature HMAC SHA-256 signature and rejects invalid signatures. Webhook bodies are also limited to 262144 bytes by default before signature validation or JSON parsing.
What if HelloAsso does not provide a Webhook Signature Key?
Use the unsigned webhook fallback only if necessary. It is disabled by default, visibly warned in admin, and only works when the environment key is missing. It cannot bypass an invalid signature when a key is configured.
What happens if a webhook arrives before the local payment row is available?
If the event includes payment_uuid but no local payment row is found yet, the event is stored as pending_payment_match and the endpoint returns HTTP 503 Service Unavailable so delivery can be retried. Once the payment row exists, a later delivery can process the event and mark it processed; later deliveries are then treated as duplicates.
What happens if a webhook finds the payment row but the database update fails?
The event is stored as retryable_update_failed without processed_at and the endpoint returns HTTP 503 Service Unavailable. If WordPress reports zero affected payment rows, the plugin accepts that only when rereading the row confirms the expected status is already persisted. Debug logs can report field_mismatch with mismatched_field to identify the field without logging its value. A later delivery of the same event_id can retry the update. Once the update succeeds, the event is marked processed and later deliveries are treated as duplicates.
Does the plugin store raw webhook payloads?
No. Raw payloads are not stored by default. The webhook event table stores only a minimized, sanitized summary for idempotency and troubleshooting.
Where can I see payments?
Open HelloAsso Checkout > Payments to view sandbox and production records.
Can I customize amount, item, and metadata?
Yes. Use shortcode attributes or configure checkout defaults in Settings.