Core capabilities

Hosted checkout

Redirects the buyer to the CorvusPay secure form and returns them to Odoo after payment or cancellation. No card data ever reaches Odoo.

Secure message handling

Signs outgoing data with HMAC-SHA256 and verifies every signed return before it is allowed to change payment state.

Status reconciliation

A manual status action and a scheduled catch-up for pending and authorized payments, including the case where the buyer never returns.

Transaction management

Preauthorization, full or partial capture, void, and full or partial refund, each recorded as a related Odoo child transaction.

IBAN / PIS

Keeps asynchronous bank payments pending until CorvusPay reports a final result, so an invoice is never paid prematurely.

Localization

English source terms with Bosnian, Croatian, Serbian Cyrillic and Serbian Latin translations.

Provider configuration

Credentials and environment

• Use Test Mode with matching test credentials during development and certification.
• Enter the Store ID and Secret Key of the selected Merchant Portal store.
• Upload the matching CorvusPay.p12 client certificate and its password.
• Switch to Enabled only after production credentials and return URLs are verified.

Payment behaviour and availability

• Select the payment journal used for Odoo post-processing.
• Optionally restrict countries, currencies and the maximum amount.
• Keep Capture Amount Manually off for a regular sale and for IBAN/PIS.
• Turn it on only for preauthorization, later capture and void.

Store ID, Secret Key, certificate and password. Odoo masks the secrets.

Methods, manual capture, availability, journal and refund support.

Preauthorization, capture and void

Capture

1. Enable Capture Amount Manually.
2. Complete checkout and verify the transaction is Authorized.
3. Choose Capture Transaction for the full or a partial amount.
4. Review the confirmed child transaction and what remains capturable.

Void

1. Open an unused authorized transaction.
2. Choose Void Transaction.
3. Confirm and review the child transaction.
4. The authorization is released and the invoice stays unpaid.

Reconciliation and monitoring

• Use Check CorvusPay Status for any uncertain transaction.
• A scheduled action revisits pending and authorized payments on its own.
• Reference, amount, currency and state are validated before an outcome is applied.
• Review Pending and Error records first, and compare them with the Merchant Portal rather than forcing a state by hand.

Pending payments are revisited every 15 minutes.

Credentials and client certificate

Where they come from

1. Open the store API settings in the CorvusPay Merchant Portal.
2. Copy the Store ID and Secret Key of that same environment.
3. Generate a private key and CSR, and send only the CSR through the approved process.
4. Bundle the returned certificate and key into CorvusPay.p12 and upload it.

Handling

• Test and production credentials are not interchangeable.
• Keep the private key in a protected directory outside version control.
• Odoo reads the certificate in memory for each API call.
• Monitor the expiry date and plan renewal before it lapses.

Security and go-live checklist

• Production Store ID, Secret Key and certificate come from the same production store.
• Production endpoints are confirmed with CorvusPay.
• The Odoo return URL uses HTTPS and is reachable.
• Journal, methods, currencies, countries and amount limits are reviewed.

• Scheduled reconciliation is enabled and its interval is acceptable.
• Capture, void and refund are restricted to authorized operators.
• A controlled first live payment and refund are verified.
• No test credentials or certificates remain in the production configuration.