CMI Morocco Card Payment Gateway
Signed hosted-page checkout, ver3 verification and reconciliation â bring your own CMI keys
Acquire online card payments through CMI (Centre Monétique Interbancaire),
Morocco's interbank card gateway. This connector builds the exact signed
3D_PAY_HOSTING hosted-page form CMI expects, redirects the buyer to the
CMI est3Dgate page for 3-D Secure card entry, then verifies the
ver3 SHA-512 signature on the result before a single Dirham is booked.
Your card data never touches Odoo â PCI scope stays on the CMI hosted page.
Why this module
BYOK â your credentials only
You enter your own CMI clientid and store key. Nothing is bundled, nothing is shared, and the store key never leaves your database. We generate and verify the signed payloads; you remain the merchant of record with CMI.
Tamper-proof by design
Every redirect and callback from CMI is authenticated with the ver3 SHA-512 hash. A result whose signature does not verify is flagged Signature Rejected and is never turned into a payment. No silent trust.
Key features
Signed hosted-page checkout
- Builds the full
3D_PAY_HOSTINGfield set (clientid, oid, amount, currency 504/MAD, okUrl, failUrl, lang, rnd, BillTo fields). - Computes the ver3 hash exactly as the CMI ECOM Integration Kit specifies.
- Renders a ready-to-serve auto-submitting redirect form to the
est3Dgatepage. - Pre-Authorisation or one-step Sale (Auth) transaction types.
ver3 SHA-512 signing & verification
- Case-insensitive natural-order parameter sort, value escaping and base64 raw-digest hashing.
- Honours the returned
HASHPARAMSorder when CMI supplies it. - Constant-time signature comparison.
- 3-D Secure
mdStatusenforcement (1â4 accepted; 0/5/6/7/8 rejected).
Result handling & reconciliation
- Parses the redirect and server-to-server callback into a normalised result.
- Approved + ProcReturnCode 00 + 3-D OK + verified hash â booked payment.
- Optional automatic account.payment, including register-against-invoice.
- Verify-result wizard to replay/inspect a CMI payload (JSON or form).
Audit & control
- Full chatter on every transaction (redirect, result, security rejections).
- Stored TransId, AuthCode, HostRefNum, ProcReturnCode and mdStatus.
- Multi-company and multi-acquirer ready.
- Raw verified payload retained for dispute resolution.
Gateway technical summary
| Item | Value |
|---|---|
| Gateway | CMI (Centre Monétique Interbancaire), Morocco |
| Hosted gate (test) | https://testpayment.cmi.co.ma/fim/est3Dgate |
| Hosted gate (production) | https://payment.cmi.co.ma/fim/est3Dgate |
| Store type | 3D_PAY_HOSTING |
| Hash algorithm | ver3 (SHA-512, base64 raw digest) |
| Currency | Moroccan Dirham â ISO numeric 504 |
| Transaction types | PreAuth, Auth (Sale) |
| 3-D Secure | mdStatus enforced on result |
How it works
- Configure an acquirer with your CMI clientid and store key (BYOK) and your success/failure/callback URLs.
- Create a CMI payment for a customer/invoice; the module assigns a gateway-safe order id and a random nonce.
- Redirect the buyer with the signed hosted-page form to the CMI
est3Dgatepage (card data stays on CMI). - Verify the signed redirect/callback: the ver3 hash is checked before the result is classified.
- Reconcile: a verified approval books an inbound payment, optionally reconciled against the invoice.
Compatibility & support
Odoo Community 18.0 and 19.0. Builds on the standard Accounting app â no Enterprise dependency. For setup help contact support@pokutsoft.com.
This is an independent integration. CMI is a trademark of its owner; this module is not affiliated with or certified by CMI. You connect using your own CMI merchant credentials.
Screenshots
Acquirers
Settings
Payments
Verify Result
Update date: 2026-07-02
| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
•
Discuss (mail)
• Invoicing (account) |
| Lines of code | 1308 |
| Technical Name |
pay_ma_cmi |
| License | OPL-1 |
| Website | https://pokutsoft.com/ |
Odoo Proprietary License v1.0 This software and associated files (the "Software") may only be used (executed, modified, executed after modifications) if you have purchased a valid license from the authors, typically via Odoo Apps, or if you have received a written agreement from the authors of the Software (see the COPYRIGHT file). You may develop Odoo modules that use the Software as a library (typically by depending on it, importing it and using its resources), but without copying any source code or material from the Software. You may distribute those modules under the license of your choice, provided that this license is compatible with the terms of the Odoo Proprietary License (For example: LGPL, MIT, or proprietary licenses similar to this one). It is forbidden to publish, distribute, sublicense, or sell copies of the Software or modified copies of the Software. The above copyright notice and this permission notice must be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Please log in to comment on this module