The official KOMOJU payment gateway plugin for EC-CUBE.
Customers are redirected to KOMOJU's hosted payment page at checkout. Card data never touches your EC-CUBE server (PCI DSS compliant).
This repository contains two plugin packages. Use the one that matches your EC-CUBE version:
| Directory | EC-CUBE Version | Plugin Code | Latest Version |
|---|---|---|---|
komoju-eccube-4-main/ |
4.0 - 4.1 | Komoju |
1.2.0 |
komoju-eccube-4-4.2-main/ |
4.2+ | Komoju42 |
1.3.0 |
Each directory is a self-contained EC-CUBE plugin with its own composer.json. See the README inside each directory for version-specific details (Japanese).
Payment methods enabled in your KOMOJU account are automatically synced to EC-CUBE:
- Credit cards (Visa, Mastercard, JCB, AMEX, Diners, Discover)
- Konbini (convenience store payments)
- Bank transfer
- Pay-easy
- PayPay
- LINE Pay
- Merpay
- Carrier billing
- E-money (WebMoney, BitCash, NET CASH)
- Hosted payment page -- no card data stored on your server
- Authorize & capture or authorize only (manual capture from admin)
- Full and partial refunds from the EC-CUBE order edit page
- Webhook-driven status sync -- order statuses update automatically when payments are captured, refunded, cancelled, expired, or failed
- Admin audit log with search, CSV export, retention policy, and toggle
- KOMOJU dashboard link on every order for quick reference
- Download the ZIP for your EC-CUBE version from Releases (or zip the appropriate directory yourself).
- In the EC-CUBE admin panel, go to Owner's Store > Plugins > Upload and Install and upload the ZIP.
- Enable the plugin and clear the cache (Content Management > Cache Management).
- Go to KOMOJU Payment > Settings and enter your API keys from the KOMOJU dashboard.
- Click Connect to KOMOJU to sync available payment methods.
- Register the displayed webhook endpoint URL and secret in your KOMOJU dashboard's webhook settings.
- Under Shop Settings > Delivery Method, associate KOMOJU payment with your delivery methods.
| Event | Action |
|---|---|
payment.captured |
Order status set to Paid |
payment.refunded |
Refund recorded, order status set to Cancelled |
payment.cancelled |
Order cancelled |
payment.expired |
Order cancelled |
payment.failed |
Order cancelled |
payment.updated |
Status updated based on payment state |
Webhooks are verified using HMAC-SHA256 signature validation.
Plugin installation, enabling, and disabling are done through the EC-CUBE admin panel.
Use KOMOJU test cards in your test environment to verify the payment flow.
- HMAC-SHA256 webhook signature verification
- CSRF protection on all admin operations
- No card data passes through EC-CUBE (PCI DSS compliant)
- Pessimistic locking on refund operations to prevent race conditions
See the individual plugin directories for license details.