We use necessary cookies to make this site work. With your permission we also use Google Analytics to understand how the site is used and Google Ads cookies to measure which of our ads lead to purchases. You can accept all cookies, reject the optional ones or choose which ones to allow. Cookie policy
Choose which cookies you allow. Necessary cookies are always on because the shop cannot work without them. You can change your choice at any time with the "Cookie settings" link.
Needed for the basket, checkout, login and security. They do not track you.
Google Analytics: how many people visit, which pages they read and how they found the site. It sets the _ga cookies and sends usage data to Google.
Google Ads: measures which of our ads lead to a purchase. It sets the cookies _gcl_au and _gcl_aw (90 days) and, when you buy, sends Google the order details and a hashed form of your contact details for matching. See our cookie and privacy policies.
Accept cards through iyzico's hosted Checkout Form, with verified payment results, installments, payment recovery and online refunds.
Free
No payment needed, with 12 months of updates.
Add it to your cart and complete the free checkout. Your ZIP downloads and Composer access will be in your account.
No subscription or automatic renewal. Keep using the versions included in your update period. Update and licence details
Composer package commercegears/module-iyzico-payment
Let customers complete card payment on iyzico's hosted form after placing an order. Choose a redirect or an embedded payment-page frame. Magento retrieves and validates the payment result from the API before recording a successful payment, and supports the provider's fraud-review workflow.
Requires an iyzico merchant account and API/secret keys. Choose sandbox or live mode, payment-page layout and currency restrictions, then test success, decline, callback recovery and refunds. Luma and Hyvä payment-page templates are included; this is a hosted Checkout Form integration.
Install with Composer using composer require commercegears/module-iyzico-payment, then run bin/magento setup:upgrade. Composer installs the required CommerceGears dependencies: commercegears/module-core ^2.0.
No direct card form, pre-authorisation/later capture, sub-merchant marketplace flow, multishipping or admin-created orders. Installment charges are not added to Magento totals, and installment availability depends on iyzico. If a multi-item refund partly fails, reconcile the completed refund using an offline credit memo.
Release 1.0.0; Magento ; PHP . Read the included user guide and test your own theme, checkout and integrations before production use.
The store asks iyzico's API for the result and registers a payment only when the status, order number, currency, amount and response signature all match the order.
When a card is declined, 3-D Secure fails or the customer comes back without paying, the order is cancelled, the basket restored and a clear message shown, so they can try again.
Every 5 minutes a cron job asks iyzico about orders still waiting: paid ones are invoiced, unpaid ones cancelled, payments still under way kept.
All features
Live demo
A full Magento store with the module installed, on Luma and on Hyvä. The admin demo signs you in with one click.
Compatibility
| Magento | 2.4.7 – 2.4.9 |
|---|---|
| Platforms | Magento Open Source and Adobe Commerce |
| Storefront themes | Luma Blank Hyvä |
| PHP | 8.2 – 8.5 |
| Latest version | 1.1.0 |
| composer.json requires | php ~8.2.0||~8.3.0||~8.4.0||~8.5.0 ext-json * magento/framework ~103.0.7 commercegears/module-core ^2.0 free, installed by Composer with this module magento/module-backend * magento/module-catalog * magento/module-checkout * magento/module-config * magento/module-customer * magento/module-directory * magento/module-payment * magento/module-quote * magento/module-sales * magento/module-store * magento/module-ui * |
Installation
Get it free, create a Composer key in your account, then in the root of your Magento project:
01Add the repository and your key (once per project)
composer config repositories.commercegears composer https://repo.commercegears.com composer config --auth http-basic.repo.commercegears.com PUBLIC_KEY PRIVATE_KEY
02Install the module
composer require commercegears/module-iyzico-payment
03Enable it
bin/magento setup:upgrade bin/magento setup:di:compile bin/magento setup:static-content:deploy bin/magento cache:flush
The last three are only needed in production mode.
Prefer a zip? Every version you are entitled to can be downloaded from My modules. More about Composer access
User guide
The user guide has its own page: how to install iyzico Payment, what each option does and how to use it in your store. Written for version 1.1.0; a copy ships with the module.
Changelog
New: German translation of the checkout and payment texts.
FAQ
Something else on your mind? The developers who wrote the module answer before and after you buy.
Ask a question →Already installed it? Open a support ticket
A standard iyzico merchant account (not a marketplace or sub-merchant account). You need its API key and secret key from the iyzico merchant panel (Settings > Merchant Settings). Sandbox keys start with "sandbox-"; live and sandbox keys are different. The module does not create iyzico accounts.
No. The customer types the card on iyzico's own Checkout Form, either on iyzico's payment page or in a frame on your page. The store only receives a token and then reads the result from iyzico's API, so no card number ever reaches Magento (PCI SAQ A).
Both show iyzico's own form. Redirect (the default) sends the customer to iyzico's payment page and works with every theme. "On this store's page" shows the same form in a frame between your header and footer (Luma and Hyvä templates); only iyzico's payment page domain is added to the Content Security Policy and no iyzico script runs on your pages.
TRY, USD, EUR, GBP, NOK and CHF. The method is only offered when the basket currency is one of these. Note iyzico's rule for currencies other than TRY: they are only accepted from cards issued outside Türkiye (Turkish cards are refused by iyzico's form), and your iyzico account must be allowed to take foreign cards and that currency.
The store never trusts the browser. After the customer returns, it fetches the result from iyzico's API and registers the payment only when iyzico reports success and the order number, currency, amount and response signature all match. Only then is the invoice captured (transaction ID = iyzico payment ID), the order moved to Processing and the order e-mail sent.
The order is cancelled (stock released), the basket is restored and the customer sees a clear message, for example "Your card does not have enough limit or balance for this payment" or "The 3-D Secure verification was not completed". The raw iyzico code is kept in the transactions grid and the log for you. The customer can pay again with any payment method.
A cron job runs every 5 minutes and asks iyzico about orders still waiting after "Cancel Unpaid Orders After" (default 60 minutes). Paid orders are invoiced, unpaid ones cancelled. Payments still under way (bank transfer, shopping credit) are kept. A card payment left in 3-D Secure is treated as unpaid once the order is 3 hours old. You can also press "Check Status at iyzico" on the order, or run bin/magento commercegears:iyzico:check <order number>.
Yes. Create a credit memo from the invoice and press Refund: full, partial and several partial refunds, including shipping and adjustments, are refunded online at iyzico. A full refund on the day of the payment uses iyzico's cancel, so nothing appears on the card statement. Nothing is recorded as refunded unless iyzico confirmed it.
Yes, through iyzico's form: the customer picks an installment option there. You can limit the counts offered (for example 1, 3 and 6); rates are managed in the iyzico panel. Installments are generally available for TRY payments only. An optional "Installment Options" table on product pages is shown for TRY prices. An installment charge paid by the customer is shown in the iyzico panel and noted on the order; it is not added to Magento's order totals.
iyzico requires the buyer's T.C. Kimlik No. Map the customer or address attribute that holds it in "T.C. Kimlik No Attribute"; only a valid number (11 digits with checksum) is sent. Without a mapping, the number set in "Identity Number When None Is Given" (default 11111111111) is sent, and the admin is told so on each order.
It is recommended. Register the Merchant Notification URL shown in the settings in the iyzico panel and ask iyzico to switch on signed notifications (X-IYZ-SIGNATURE-V3). A notification only makes the store ask iyzico again; nothing in it is trusted. Without notifications the callback and the cron job still finish every order.
Yes. On Hyvä the checkout is the Luma checkout fallback; the payment and result pages have Hyvä templates. Headless stores can place the order and then get a signed payment page URL from the REST API.
Yes, on the demo store: add a product to the basket and choose "Credit / Debit Card (iyzico)" at checkout. The demo uses the iyzico sandbox and GBP, so pay with the sandbox card 4054 1800 0000 0007 (any future expiry date, any CVC) and enter the code the sandbox 3-D Secure page shows. Nothing is charged.
Support
From the blog
With a hosted payment page, the order and the payment live in two systems. Most days they agree. This is about the days they do not, and how to make Magento catch up with iyzico on its own.
Magento was not built around Turkish addresses, volumetric weight or cash on delivery. What goes wrong when you connect it to Aras Kargo or Yurtiçi Kargo, and how to set it up so labels come out right.