Integrate Tilopay into your Adobe Commerce or Magento store
Official Tilopay extension for Adobe Commerce and Magento Open Source 2.4. Process card payments right inside your checkout, without sending the customer away from your store, and handle captures, refunds and voids from the Magento admin itself.
Direct download
tilopay-payment-magento-1.0.1.zip
Version 1.0.1 · Size 92 KB
Compatible with Adobe Commerce and Magento Open Source 2.4.6 or later (PHP 8.1 to 8.5). Released on September 10, 2026.
SHA-256 checksum
0408aab30c33183d663d53300b07a4262750cdb0a14e38c7e4637afe0814c92b- •Embedded checkout with tokenization: the customer never leaves your store.
- •3DS challenge in an overlay when the issuer requires it, without breaking the purchase.
- •Cards, 0% interest installments, SINPE Móvil, Yappy and Apple Pay in a single payment method.
- •Capture, full or partial refund and void from the Magento admin.
- •Compatible with Adobe Commerce and Magento Open Source 2.4.6+ (PHP 8.1 to 8.5).
- •Encrypted credentials, with card data always redacted from logs.
Start getting paid today
Sign up with Tilopay and activate your integration with Adobe Commerce / Magento.
Download the extensionView the setup guideOfficial links
Get your credentials in the Tilopay dashboardSupported payment methods
Credit or debit card
Embedded form with tokenization and live brand detection; 3DS challenge in an overlay when the issuer requires it.
0% interest installments
Same card form; the plan is chosen in the checkout payment method selector.
SINPE Móvil
No fields to fill in: when the order is placed, the destination number, the exact amount and the description code are shown, and the order confirms itself as soon as the deposit is detected.
Yappy
Redirect to the Tilopay Hosted Payment Page.
Apple Pay
Native Apple Pay button in Safari on Apple devices, with the charge verified server-side.
Saved cards
Available when the merchant account has them enabled.
Available methods are read dynamically from your Tilopay account: the checkout only offers what your account has enabled.
Requirements
- Platform
- Adobe Commerce or Magento Open Source 2.4.6 or higher
- PHP
- 8.1 to 8.5, depending on what your Magento line supports
- Credentials
- A Tilopay account with API Key, API User and API Password (Admin dashboard → Platform integrations)
- Version
- 1.0.1 (released on September 10, 2026)
- License
- OSL-3.0
- Access
- Shell access on the store server to run the bin/magento commands
Installation
Download the extension with the button above. The current installation method is manual in app/code: the package is not yet published on the Adobe Commerce Marketplace. Once it is published, Composer installation will be composer require tilo/module-payment (vendor tilo). In the commands, <locales> is the list of locales used by your store views, separated by spaces (for example: es_CR en_US).
Manual installation in app/code
mkdir -p app/code/Tilopay/Payment
# (extraer el ZIP dentro de app/code/Tilopay/Payment)
bin/magento module:enable Tilopay_Payment
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f <locales de la tienda, ej. es_CR en_US>
bin/magento cache:flushIn production mode the setup:static-content:deploy -f step is mandatory and must explicitly include every locale used by your store views (for example: es_CR en_US). If you skip it, the payment method simply does not appear at checkout.
Updating the module on Magento 2.4.7 or higher
bin/magento maintenance:enable
rm -rf pub/static/frontend/* pub/static/adminhtml/* pub/static/deployed_version.txt
rm -rf var/view_preprocessed/* var/cache/* var/page_cache/*
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f <locales>
bin/magento cache:flush
bin/magento maintenance:disableMagento 2.4.7 or higher emits integrity attributes (SRI) for its static files. When updating the module in production mode you must regenerate the static content from scratch —deleting pub/static/frontend/*, var/view_preprocessed/* and pub/static/deployed_version.txt before deploying— because deploying over existing files can block the checkout JavaScript. Also purge Varnish or your hosting cache if you have one.
What's new in version 1.0.1
- •The standard Magento billing address form now displays correctly under the Tilopay method (it honors the "Display Billing Address On" setting); the shipping address is no longer reused as the billing address, which affected store-pickup orders.
- •The billing address and amounts are sent to Tilopay up to date at the moment of the charge.
- •If the Tilopay SDK fails to initialize (for example, wrong credentials or environment), the real error is shown at checkout instead of the generic "No valid payment method was sent" message.
Configuration
Stores → Configuration → Sales → Payment Methods → Tilopay.
- Enabled
- Turns the payment method on at checkout.
- Title
- The name your customer sees when choosing the payment method.
- Environment
- Production or Sandbox/Test. It must match the mode of your credentials, according to your Tilopay account setup.
- API Key, API User and API Password
- Credentials from your Tilopay admin dashboard. They are stored encrypted.
- Payment Action
- Authorize and capture (recommended) or authorize only.
- New Order Status
- The status Magento uses to create the order before charging.
- Accepted Credit Card Types
- Brands displayed at checkout.
- Sort Order
- The position of the method in the checkout list.
- Debug Mode
- Logs API requests and responses to var/log/tilopay_payment.log. Keep it off during normal operation.
- •Credentials and settings support store view scope, so a single Magento install can run several stores with different accounts.
- •The Tilopay API and SDK URLs are hardcoded in the module and are not configurable, so an admin account cannot repoint the script that captures card data to another host.
Operations from the Magento admin
- •Capture: automatic with "Authorize and Capture", or manual by creating the Invoice if you use "Authorize Only".
- •Full or partial refund: an online Credit Memo on the invoice. Available only for orders already captured.
- •Void: available only for authorized orders that have not been captured yet.
- •The order view shows the card brand, the last 4 digits and the authorization code, filled in automatically from Tilopay when the order is opened.
How the payment is confirmed
The extension never trusts return URL parameters to approve a charge.
- •The order is created in Magento before charging, in a pending state, so no charge ever exists without its record.
- •When the customer returns, the transaction is verified directly against the Tilopay API before the order is confirmed.
- •If the payment is declined, the pending order is cancelled, the cart is kept and the reason is shown in the payment step so the customer can retry.
- •Credentials, PAN, CVV and Apple Pay tokens are always redacted before anything is written to a log.
- •The success page and the checkout session are only granted for an order placed by that same session, so the sequential order number in the return URL cannot be used to reach another customer's order.
- •The endpoint that cancels an abandoned order only acts on an order belonging to the session that placed it, and only if it is a Tilopay order.
Before going live
- •If your host uses a WAF or mod_security (Cloudways, for example), request an exemption for the tilopay/response/index route and verify it with a test purchase.
- •Apple Pay only appears in Safari on Apple devices with Wallet set up, and requires Apple Pay enabled on your Tilopay account plus your store domain verified with Apple. Tilopay handles that verification.
- •SINPE Móvil uses whole amounts: the total is rounded up for the transfer.
- •This version does not include recurring payments or subscriptions.
- •Confirmation emails: the module does not change how Magento sends email, but on a store with a slow SMTP relay, synchronous sending can delay order placement with any payment method. If that happens, enable asynchronous sending in Stores → Configuration → Sales → Sales Emails.
Frequently asked questions
Yes. It is the same extension for Adobe Commerce, Adobe Commerce Cloud and Magento Open Source 2.4.6 or higher.
Not with cards, 0% interest installments, SINPE Móvil or Apple Pay: everything happens inside your checkout. Only Yappy redirects to the Tilopay Hosted Payment Page.
Yes. They are issued with an online Credit Memo on the invoice, and are available for orders already captured. Authorized but uncaptured orders are cancelled with a void.
From the download button on this page. It is also available in your Tilopay admin dashboard, under Platform integrations.
Not in version 1.0.1. For recurring payments, use Tilopay's other integrations.
The API Key, API User and API Password from your Tilopay account. You set them in the Magento admin and they are stored encrypted.
Every transaction protected
The highest levels of international security so your customers' money and your payments stay more than safe.
