Creem payments for GoCommerce

What it does

Configuration

Three settings are required: the API key, the webhook’s signing secret, and the placeholder product every checkout is created against. Set them in Config from your own main(), or under Settings › Payment methods.

The module reads its Config struct, not the environment. The variable names are the ones the package’s own example or the reference binary uses; in your own main() you choose where each value comes from. Where a setting has a panel label, the admin’s settings drawer can hold it too, and a value typed there wins over Config.

Setting it up

1. Create the placeholderIn Creem, create one one-time product — any name, any price — and note its id. A subscription product will not take a custom price.
2. Add the webhookPoint a webhook at https://your-api-host/api/checkout/creem/webhook and keep its signing secret. checkout.completed is the event that settles an order.
3. Install and configurePass creem.New to gocommerce.New as below, or run the reference binary with -gateways and fill in Settings › Payment methods. For the sandbox, set BaseURL to https://test-api.creem.io.
4. Take a paymentPOST /api/checkout/creem answers with a redirect intent whose url is Creem’s checkout. A paid checkout.completed marks the order paid.

import (
	"os"

	"github.com/itswadesh/gocommerce/core"
	creem "github.com/itswadesh/gocommerce/ext/payments-creem"
)

app, err := gocommerce.New(cfg,
	creem.New(creem.Config{
		APIKey:        os.Getenv("CREEM_API_KEY"),
		WebhookSecret: os.Getenv("CREEM_WEBHOOK_SECRET"),
		ProductID:     os.Getenv("CREEM_PRODUCT_ID"),
	}),
)

How it works

• Amounts checked first

  Creem takes a custom price from 100 to 99,999,999 minor units. The module checks the order total against that before calling, so an operator reads what is wrong with the order rather than an error about a field nobody filled in.

• Signed, without a timestamp

  creem-signature is a hex HMAC-SHA256 of the raw body, compared in constant time. With no timestamp in it, the claim table is what bounds a replay.

• Each event once

  Creem sends its own event id and the claim is that id. An event without one is refused with a 400 rather than guessed at; a redelivery is answered 200 and changes nothing.

• Only paid settles

  checkout.completed with an order status other than paid is acknowledged and changes nothing. If marking the order paid fails, the claim is released and the webhook answers 500 for Creem to retry.

• Whole refunds, from the admin

  A refund from the admin posts the recorded transaction id to Creem’s refunds endpoint, which returns the full remaining amount. A pending answer is accepted: the engine has recorded the refund, and Creem settles it later.

• Dashboard events reach the log

  refund.created and dispute.created from Creem’s side are logged with the order they concern, so the store is not the last to know.

What it does not do

Read these before an order depends on it. No store is known to run GoCommerce in production yet, so these come from the code, not from anyone’s experience.

• All or nothing refundsCreem’s refund endpoint takes no amount, so a request for less than the whole order is refused, with a message pointing at Creem’s dashboard. Partial refunds are made there.
• Refunds need the webhook firstThe transaction id arrives with checkout.completed. Before it, a refund is refused: no transaction recorded for this order yet.
• A one-time placeholder productOne product in Creem is required, and it must be a one-time product; Creem refuses a custom price on a subscription.
• Price limitsOrders under 100 or over 99,999,999 in minor units are refused before Creem is called.
• No currency is sentThe checkout carries custom_price in minor units and no currency code. Check that Creem charges in the currency your store settles in.
• No failure pathThe module never marks a payment failed, and dashboard refunds and disputes are only logged. An abandoned checkout leaves the order unpaid.