BlinkPay NZ for WooCommerce

BlinkPay NZ for WooCommerce lets your customers pay directly from their New Zealand bank account using BlinkPay open banking.

• Blink PayNow — one-off payments at checkout, via quick payments.
• Refunds — card payments are refunded through the card network in full or in part; bank payments show the customer’s account number on the order screen (fetched live, never stored) for a manual bank transfer.

Customers are sent to BlinkPay’s hosted gateway, choose their bank — or card, when card payments are enabled for your BlinkPay merchant account — and authorise the payment. Card is where BlinkPay surcharging applies; see the Surcharges section below. Both the classic and block-based checkout are supported, as is high-performance order storage (HPOS).

How payments work

1. At checkout the plugin creates a quick payment and redirects the customer to BlinkPay’s hosted gateway.
2. The customer picks their bank and authorises the payment.
3. Back on your site, the plugin confirms the outcome through the BlinkPay API. A completed payment marks the order Processing/Completed; a rejected consent or payment marks it Failed.
4. Anything still in flight parks the order On hold and WP-Cron re-checks it — every minute at first, backing off to every 2 hours — for up to 36 hours, so a payment that settles overnight completes automatically.

The return redirect alone is never treated as proof of payment — the outcome is always confirmed through the API.

Refunds

How the customer paid decides how a refund works. A card payment is refunded through the card network: the plugin requests a full or partial refund and BlinkPay moves the money back — the order notes record the refund’s status, and a refund still processing should be verified in the BlinkPay merchant portal. A bank payment is refunded with BlinkPay’s account-number refund, which does not move money: the bank account the customer paid from is shown in the BlinkPay manual refunds panel on the order screen so you can transfer the refund from your own bank — the panel fetches the number live from BlinkPay each time it renders, so it is never stored in WordPress — and a customer-visible note says the refund will arrive by bank transfer.

WooCommerce’s own Refund manually button is hidden on BlinkPay orders — it would record money as returned without BlinkPay involvement — so every refund goes through Refund via BlinkPay. That button is only offered when your BlinkPay credentials include the refund permissions (create:refund and view:refund); contact BlinkPay if you need them enabled.

Surcharges

If surcharging is enabled for your BlinkPay merchant account, BlinkPay adds the surcharge on top of the order total once the customer selects a payment method on the hosted gateway, and the customer sees and authorises the combined amount there. WooCommerce still records the order total as paid; the amount actually charged and the surcharge are recorded on the order as a note and as metadata for reconciliation. The plugin also verifies the paid amount against the order total before completing an order — an order paid for the wrong amount, in either direction, is placed on hold for you to review rather than completed silently.

Requirements

• WordPress 6.0+ with WP-Cron enabled (used to confirm slow payments)
• WooCommerce 7.0+
• PHP 7.4+
• Store currency set to NZD
• BlinkPay merchant credentials (client ID and client secret) — contact BlinkPay to get onboarded. Sandbox and production credentials are separate.

External service

This plugin connects to the BlinkPay Debit API, a third-party service operated by BlinkPay Limited, to create payments, confirm their outcome and retrieve refund details. Depending on the Sandbox mode setting, requests are sent to https://sandbox.debit.blinkpay.co.nz or https://debit.blinkpay.co.nz. Order amounts, the order number and order ID, your configured bank statement particulars and a SHA-256-hashed customer identifier — the WooCommerce customer ID for registered customers, otherwise the billing email address — are sent to BlinkPay so payments can be attributed to a customer. Hashing keeps the raw value out of the request, but it is not anonymisation: a hash of a known email address can be matched back to that address. Customers complete payment on BlinkPay’s hosted gateway. Use of the service is governed by BlinkPay’s terms of use and privacy policy.

Security

• Define BLINKPAY_CLIENT_ID and BLINKPAY_CLIENT_SECRET in wp-config.php to keep credentials out of the database; constants take precedence over saved settings.
• The plugin never stores bank account details for payments; the customer authorises directly with their bank.
• Debug logging never writes credentials or tokens.