Payments integration
iyzico
What it does
- Takes card payments through iyzico's 3D Secure page, so card numbers never reach your store.
- Shows a live installment table at checkout based on the card BIN and the cart total.
- Stores cards at iyzico for one-click repeat purchases and runs full or partial refunds from the order screen.
Provider based in Turkey
iyzico is one of Kambloo's two primary card gateways, next to PayTR. It covers what a Turkish store needs on day one: 3D Secure card collection, BIN-based installments, stored cards, and API refunds. The adapter is an Internal Module. Kambloo charges nothing for it; iyzico's own commission applies to each transaction.
How it works with Kambloo
When a customer confirms an order, Kambloo creates the order in pending state, reserves stock, and calls iyzico to start the payment. The customer is sent to iyzico's 3D Secure page. The card number and CVV are typed there, not on your storefront. iyzico then posts a signed callback to your store's webhook endpoint. Kambloo checks the signature before it reads a single field of the payload. On success the payment is marked captured, the order is marked paid, and the customer lands on the confirmation page.
Callbacks are idempotent. A second callback for the same transaction hits a unique constraint in the payments table and is treated as already processed. Concurrent duplicates are serialised with a short lock on the conversation ID. If no callback arrives within 10 minutes, a status query job asks iyzico for the result.
Installments work from the card BIN. When the customer types the first six digits, Kambloo requests the installment table for that BIN and amount. The answer, including iyzico's commission per row, is cached for one hour and rendered at checkout. In the admin panel you decide which installment counts are offered, set a minimum cart amount, and choose whether the surcharge is absorbed or added to the order as a separate line.
Stored cards use iyzico's cardUserKey and cardToken. Your database holds the token, the card brand, and the last four digits. When a customer deletes a card from their account, Kambloo also deletes the token at iyzico. Refunds, partial or full, are issued from the order screen and cannot exceed the refundable balance.
Requirements
- An iyzico merchant account with API key and secret.
- Sandbox credentials for testing before go-live.
- A store that has completed the go-live wizard, so iyzico can reach your callback URL.
Setup steps
The short version. The screens in your store admin follow the same order.
- Install the iyzico module from the Market. It is free.
- Open Settings > Payments > iyzico and paste your API key and secret. Kambloo stores them encrypted.
- Start with sandbox keys and place a test order in iyzico's test environment.
- Choose which installment counts to offer and whether the installment surcharge is passed to the customer.
- Switch to live keys. iyzico appears at checkout as soon as configuration is complete.
Questions about iyzico
Does my store need its own PCI certification?
No. Card details are entered on iyzico's hosted page or SDK. Kambloo keeps only a token and the masked last four digits, which keeps your PCI scope at SAQ-A.
What happens if the 3D Secure callback never arrives?
A status query job asks iyzico directly after 10 minutes. The order is then marked paid or failed based on the answer. Payments do not stay in limbo.
Can I run iyzico next to a bank virtual POS?
Yes. Every configured gateway is listed at checkout side by side. You can keep iyzico as the default and add your own bank POS for lower commission.