Fintoc for WooCommerce

Fintoc for WooCommerce lets your store accept account-to-account bank transfers and card payments through Fintoc. When a customer places an order, the plugin creates a Fintoc Checkout Session and redirects the customer to Fintoc's secure hosted checkout, where they pick their payment method and authorize the payment. The order is then confirmed in the background through webhook events; each event triggers a lookup against the Fintoc API, which is the source of truth for payment status. Features

• Hosted, redirect-based checkout — no card data ever touches your server.
• Works with both the classic checkout shortcode and the new Blocks (Store API) checkout.
• HPOS (High-Performance Order Storage) compatible.
• API-verified webhooks — no webhook secret to configure — with replay protection and idempotent processing.
• Refunds initiated directly from the WooCommerce order screen.
• Separate test and live API keys, with an explicit test-mode toggle.
• Supports Chilean Pesos (CLP) and Mexican Pesos (MXN).

1.2.4

• Orders are no longer cancelled while Fintoc is still validating the payment: a bank transfer that takes longer than the hold-stock window (60 minutes by default) now waits in On hold, with its stock reserved, instead of being cancelled after the money was already collected.
• Stock reserved by a validating payment is restored when the payment fails.
• A validating payment is polled against the Fintoc API as a fallback, so an order whose confirmation webhook was never delivered still resolves on its own.
• An expiring checkout session no longer cancels an order that has another payment still being validated.
• A second payment succeeding for an order that was already paid now leaves an order note and emails the store admin, so the duplicate can be refunded.
• Customers receive WooCommerce's standard order on-hold email when their payment enters validation. It can be turned off under WooCommerce > Settings > Emails.

1.2.3

• Fixed checkout failing with "Unrecognized request: POST /v2/checkout_sessions" on Fintoc organizations pinned to an API version older than 2026-02-01: requests now send the Fintoc-Version header.

1.2.2

• A payment made in an earlier Fintoc checkout session is no longer lost when the customer goes back to the checkout and a second session is created.
• An expiring checkout session no longer cancels an order whose payment is still being confirmed by Fintoc.

1.2.1

• Two Fintoc webhooks arriving at once for the same order can no longer confirm it twice, which duplicated the stock reduction, the order notes and the customer emails.
• A payment that WooCommerce fails to complete is now retried instead of being acknowledged, so the order no longer stays unpaid after the money was captured.
• The order-received page no longer says the payment is still being confirmed when the webhook already confirmed it.
• The gateway icon now matches the payment methods enabled for the organization, at a readable size, on both the classic and the Blocks checkout.
• Checkout sessions no longer send the customer object.

1.2.0

• SmartCheckout: sessions no longer pin bank_transfer — the Fintoc-hosted checkout offers every payment method enabled for the organization (bank transfer, cards).
• Test mode now defaults to off.
• Refund hardening: settings now instruct subscribing to refund.* events; reverting a failed refund reverses restocked inventory and restores the order's real pre-refund status; the customer is notified when a refund is reverted; Dashboard-created refunds are reconciled into WooCommerce; canceled refunds revert like failed ones; refund webhooks validate that the refund belongs to the order; permanent API errors no longer cause endless webhook retries; cross-mode refunds and over-precise partial amounts fail early with clear messages.

1.1.0

• Webhooks are now verified against the Fintoc API instead of an HMAC signature: the payload only locates the order and every state change comes from an authenticated API lookup. The webhook endpoint secret settings were removed — no secret to configure.
• Checkout sessions are created with payment_method_types: bank_transfer, skipping Fintoc's method selector so the checkout matches what the gateway promises.
• Embedded payments are now read from the documented payment_resource.payment_intent shape of the checkout session, fixing immediate confirmation on return and the checkout_session.finished safety net.
• Refund outcomes are reconciled asynchronously: refund.succeeded confirms the refund, and refund.failed reverts the WooCommerce refund, restores the order status and emails the store admin.

1.0.0

• Initial release: hosted checkout, webhooks, refunds, Blocks support, HPOS compatibility.