WordPress and WooCommerce run a good share of Cameroon's online shops. Adding Mobile Money to one takes no development: an extension, four settings, a test payment. Here is the order to do it in, and above all the two settings that sink most first attempts.
Before you start
You need three things: a WooCommerce shop that already works, a merchant account, and WordPress admin access with the right to install a plugin. You do not need your host, a developer, or an approved identity file - all the setup happens in test mode.
Step 1 - Set the currency to CFA francs, with no decimals
This is the setting that breaks the most integrations, and it lives nowhere near the payments page: WooCommerce - Settings - General.
Set the currency to CFA franc (XAF) and the number of decimals to zero. The CFA franc has no sub-unit: a price is written 15000, never 15000.00. Leave two decimals in place and the amounts you send will eventually stop matching the amounts confirmed, leaving your orders stuck on hold with an "amount mismatch" note.
While you are there, check your prices: a shop migrated from another currency often keeps fractional prices that make no sense in francs.
Step 2 - Install the extension
Copy the extension folder into wp-content/plugins/, or make a ZIP archive of its contents and upload it from Plugins - Add New. Then activate WalleoPay for WooCommerce. A Settings link appears under the plugin name and takes you straight to the configuration screen.
The extension has no dependencies to install: it uses the WordPress HTTP API. It needs PHP 7.4 or later, WordPress 5.8 or later and WooCommerce 6.0 or later - in other words, what any up-to-date hosting already runs.
Step 3 - Paste your keys
Under WooCommerce - Settings - Payments - WalleoPay, fill in the mode and the keys. You will find them in your merchant dashboard, under Developers - API keys.
- Leave the mode on Test for the whole setup and paste your
sk_test_...key. - On go-live day, switch the mode to Production and paste the
sk_live_...key.
Remember the rule: the mode follows the key, not the dropdown. The dropdown simply tells the extension which of the two keys to send. A test key cannot collect real money, even if the mode says "Production".
The secret key is shown in the clear only once, when it is created. Keep it in a password manager. And never paste it into a theme, a browser-side script or a public repository: a leaked secret key lets someone create payments in your name.
Step 4 - Declare the notification address
This is the step people skip, and it explains the orders that sit "on hold" while the customer has clearly paid.
The address to declare is shown at the top of the extension's settings screen. It looks like this:
https://your-shop.tld/wc-api/walleopay
In your dashboard, under Developers - Webhooks, create an endpoint with that address and subscribe it to the events payment.succeeded, payment.failed, payment.expired, payment.cancelled and payment.awaiting_confirmation. When it is created, a signing secret starting with whsec_ is displayed: copy it and paste it into the Webhook secret field in the extension settings.
Without that secret, every incoming notification is rejected. That is deliberate: an unsigned notification is just a message from the internet.
Finally, tick Enable WalleoPay payment and save. The payment method only appears at checkout if a key is filled in for the selected mode.
Step 5 - Place a test order
Place a real order on your shop, in test mode, and follow the journey to the end. Then look at three things:
- Did the order move to processing without you touching it?
- Does the WalleoPay panel on the order screen show the payment id, the reference, the mode, the status and the operator?
- Do the webhook deliveries appear in your dashboard with a
200response?
Exercise the paths that do not work, too: the customer cancelling, the request left to expire. Those are the most common cases in production, and this is the moment to see what your shop does with them - while it is free.
How an order gets validated, and why that matters
The extension never marks an order paid on the strength of a notification or a browser redirect alone. Every time, it runs the same sequence: verify the signature, check the timestamp, re-read the status from the API, then compare the amount and currency against the order total. On any discrepancy it adds a note and leaves the order on hold rather than validating it wrongly.
The status mapping is direct: a successful payment completes the order's payment, an awaiting-confirmation payment puts the order on hold with an explanatory note, a failure or an expiry marks it failed or cancelled. Non-final statuses change nothing: as long as the fate of the payment is unsettled, the order does not move.
The handling is replayable: an order already paid is never validated twice, even if the same notification arrives several times.
When it goes wrong
The payment method does not appear at checkout. Is the plugin active, the box ticked, and a key filled in for the selected mode? A test key is not enough if the mode is Production.
Orders stay on hold although the customer paid. The notification is not arriving. Check that .../wc-api/walleopay answers publicly: no HTTP password, no firewall rule, no security plugin filtering it. Deliveries and their responses are visible in your dashboard.
The log says "invalid signature". Either the secret does not match the configured endpoint, or a security or caching module is rewriting the request body. The signature covers the exact bytes: anything that touches the incoming JSON breaks it.
The log says the signature timestamp is out of tolerance. Your server clock has drifted by more than five minutes. Ask your host to resynchronise it.
"Amount mismatch". Nine times out of ten this is the currency or the decimals from step 1. The order is deliberately left on hold: check before you validate it by hand.
For everything else, turn on logging in the settings and read WooCommerce - Status - Logs, source walleopay. Keys are always masked there.
Go-live day
Once your identity file is approved, switching over takes three moves: set the mode to Production, paste the sk_live_... key, and place one real order for a small amount. Nothing else changes - not the notification address, not the secret, not your settings. That is the whole point of having set everything up in test mode from the start.