=== General PayPal Card Bridge for WooCommerce ===
Contributors: rachidattia
Tags: woocommerce, paypal, payments, credit-card, checkout
Requires at least: 7.1.2
Tested up to: 7.1
Requires PHP: 8.2
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept eligible PayPal-hosted card payments in WooCommerce Checkout Blocks through the secure GPCB Pay SaaS Payment Core.

== Description ==

General PayPal Card Bridge for WooCommerce is an open-source payment connector for WooCommerce Checkout Blocks.

The plugin connects an authorized WooCommerce store to the external GPCB Pay SaaS Payment Core, which coordinates eligible PayPal-hosted card payment operations.

The plugin is free to install. Access to the external GPCB Pay service is managed separately and may require an eligible trial or paid subscription.

GPCB Pay provides substantive payment infrastructure, including:

* Authenticated WooCommerce-to-SaaS communication.
* Secure merchant PayPal credential management.
* Server-controlled PayPal Order creation.
* Server-verified PayPal Capture.
* Durable payment lifecycle records.
* Payment idempotency and recovery controls.
* Merchant and store authorization.
* Subscription entitlement management.

WooCommerce remains authoritative for its own orders, amounts, currencies, and payment completion.

The external SaaS coordinates PayPal operations and maintains durable payment state.

The plugin cannot independently process payments when the required GPCB Pay SaaS service is unavailable.

GPCB Pay is independently developed and is not affiliated with, sponsored by, or endorsed by PayPal or WooCommerce.

= Supported Payment Modes =

Guest Card

Provides an eligible PayPal-hosted guest card payment experience.

Availability depends on PayPal requirements, merchant eligibility, country, account configuration, and checkout context.

Advanced Card

Provides eligible PayPal-hosted Advanced Card Fields.

Advanced Card requires the relevant PayPal merchant capabilities and approval.

Not every PayPal Business account is eligible for Advanced Card Payments.

The plugin cannot override PayPal eligibility restrictions.

Version 0.1.0 supports separately configured Guest Card and Advanced Card modes.

Automatic switching between payment modes is not included in this release.

= Main Features =

* WooCommerce Checkout Blocks integration.
* PayPal JavaScript SDK v6 integration.
* Guest Card payment adapter.
* Advanced Card payment adapter.
* Sandbox and Live environments.
* HMAC-authenticated SaaS Connector.
* Server-authoritative payment initialization.
* Server-controlled PayPal Order creation.
* Server-verified Capture.
* Durable SaaS payment lifecycle.
* Idempotency and duplicate Capture protection.
* Payment recovery support.
* Browser-safe PayPal initialization.
* WooCommerce-native checkout presentation.
* Clean, Compact, and Premium Advanced Card layouts.
* Administrator connection diagnostics.
* Provisioning-store Connector verification.
* DNS-based store ownership verification.
* Secure SaaS-managed merchant onboarding.

= Payment Security Architecture =

GPCB Pay separates several independent security requirements:

* Merchant authentication.
* Store ownership verification.
* Connector authentication.
* PayPal merchant eligibility.
* Payment authorization.
* Subscription authorization.

Completing one requirement does not automatically satisfy another.

Creating a merchant account does not prove ownership of a WooCommerce store.

Possessing Connector credentials does not independently establish domain ownership.

Activating a store does not automatically start a subscription trial.

A successful connection diagnostic does not establish a successful payment.

The browser is not the final authority for payment completion.

The WooCommerce Connector derives commercial information from trusted WooCommerce server-side state.

The private SaaS coordinates eligible PayPal Order creation and Capture operations.

WooCommerce payment completion requires successful server-side Capture verification.

Creating a PayPal Order or receiving browser approval does not independently establish a completed payment.

Durable payment records and idempotency controls support recovery from uncertain payment outcomes.

Existing payment attempts may require recovery or reconciliation after network, provider, or processing failures.

These protections reduce payment risks but cannot eliminate every possible operational, security, or provider failure.

= Card Data Handling =

Card entry uses PayPal-hosted payment components.

The plugin is not designed to collect or store raw card numbers, CVV values, or complete card expiration details.

The applicable PayPal payment experience handles cardholder payment information.

Merchants remain responsible for applicable privacy, security, and payment-processing obligations.

== Requirements ==

* WordPress 7.1.2 or newer, subject to supported-version verification.
* PHP 8.2 or newer.
* WooCommerce 11.1.2 or newer, subject to compatibility verification.
* WooCommerce Checkout Blocks.
* HTTPS-enabled WooCommerce website.
* Active GPCB Pay merchant account.
* Authorized WooCommerce store.
* Valid Connector Key ID.
* Valid Connector Signing Secret.
* Verified store domain ownership.
* Verified Connector connection.
* Completed SaaS store activation.
* Merchant PayPal credentials securely configured in GPCB Pay.
* PayPal eligibility for the selected payment mode.
* Valid authorization to use the external GPCB Pay Payment Core.

The plugin requires the external GPCB Pay SaaS service for payment processing.

Version 0.1.0 is designed for WooCommerce Checkout Blocks.

Classic shortcode checkout is not advertised as supported.

== Installation ==

Follow the onboarding steps in order.

Do not enable customer-facing Live payment acceptance until the required store, PayPal, and SaaS authorization conditions have been satisfied.

= Step 1: Prepare WooCommerce =

1. Install and activate WooCommerce.
2. Configure your WooCommerce store.
3. Confirm that your website uses HTTPS.
4. Configure WooCommerce Checkout Blocks.
5. Install and activate General PayPal Card Bridge for WooCommerce.

= Step 2: Create Your GPCB Pay Account =

6. Open the GPCB Pay Merchant Dashboard:

https://app.gpcbpay.com/

7. Register or sign in.
8. Complete the required email verification.
9. Open the store management section.

A merchant account does not automatically authorize payment processing.

Account registration does not automatically start a subscription trial.

= Step 3: Add Your WooCommerce Store =

10. Select the available action for adding a WooCommerce store.
11. Follow the Merchant Dashboard onboarding instructions.
12. Save the assigned SaaS Store ID.
13. Securely copy the Connector Key ID.
14. Securely copy the Connector Signing Secret.

The Connector Signing Secret is sensitive authentication material.

It must not be published, included in screenshots, or shared through ordinary support communications.

The secret may only be displayed once during provisioning.

If the secret is lost, use the authorized credential recovery workflow when available.

Credential recovery may rotate the Connector credential and invalidate the previous signing secret.

Do not rotate credentials merely because a network request timed out.

The initial Pro offering is intended for one authorized WooCommerce website per merchant account.

Provisioning or suspended stores may continue to occupy the available store slot.

Do not create replacement stores to bypass onboarding or subscription restrictions.

= Step 4: Configure the WooCommerce Connector =

15. Open your WordPress administration dashboard.
16. Go to WooCommerce > Settings > Payments.
17. Open General PayPal Card Bridge settings.
18. Enter the Connector Key ID.
19. Enter the Connector Signing Secret.
20. Select the intended Sandbox or Live environment.
21. Select Guest Card or Advanced Card according to the intended payment configuration.
22. Save the gateway settings.

Connector credentials are different from PayPal API credentials.

Do not enter a PayPal Client Secret into the WooCommerce Connector credential fields.

PayPal merchant credentials are managed separately through the secure GPCB Pay SaaS.

Saving Connector credentials does not independently prove that the SaaS has verified or activated the store.

= Step 5: Verify Domain Ownership =

23. Return to the GPCB Pay Merchant Dashboard.
24. Select your provisioning store.
25. Follow the available domain verification workflow.
26. Enter the actual hostname of your WooCommerce website.

Example:

shop.example.com

Do not enter a URL scheme or checkout path.

Incorrect example:

https://shop.example.com/checkout/

27. Generate the DNS TXT verification challenge.
28. Open your domain's DNS management interface.
29. Create the TXT record using the exact hostname and value provided.
30. Allow time for DNS propagation.
31. Return to the Merchant Dashboard.
32. Complete the available DNS verification action.

The GPCB Pay SaaS independently verifies the DNS evidence.

A browser message or manually entered value does not independently establish domain ownership.

DNS challenges may expire.

If verification evidence expires, follow the authorized workflow for obtaining fresh evidence.

= Step 6: Verify Your New Store Connection =

33. Return to WordPress.
34. Open General PayPal Card Bridge gateway settings.
35. Locate GPCB Pay — Store Connection Setup.
36. Find Step 1 — Verify Your New Store Connection.
37. Select Verify New Store Connection.

This action is intended for a new store that remains in provisioning status.

The WordPress server sends an authenticated HMAC-signed request to the private GPCB Pay SaaS.

The SaaS verifies possession of the current Connector signing credentials.

Successful verification records short-lived Connector connection evidence.

This evidence is separate from DNS domain verification.

The pending Connector proof expires within 15 minutes.

Complete the remaining store activation requirements while the applicable evidence remains valid.

If the proof expires, repeat the explicit verification step when appropriate.

Do not automatically rotate credentials or recreate the store because the proof expired.

This action does not:

* Verify domain ownership.
* Activate the store.
* Start a subscription trial.
* Grant payment-processing access.
* Create or Capture a PayPal payment.

= Step 7: Complete Store Activation =

38. Return to the GPCB Pay Merchant Dashboard.
39. Select the provisioning store.
40. Confirm that the required DNS and Connector verification steps are complete.
41. Complete the available verified-store activation workflow.

Store activation is authorized by the private SaaS.

The SaaS independently evaluates the applicable requirements, including:

* Authenticated merchant ownership.
* Verified merchant identity.
* Store lifecycle status.
* Valid DNS ownership evidence.
* Valid Connector verification evidence.
* Current Connector credential.
* Applicable payment-admission requirements.

The browser cannot independently authorize store activation.

Store activation does not automatically create a subscription payment or begin a trial.

If an activation action is unavailable, follow the Merchant Dashboard instructions or contact GPCB Pay support.

Do not bypass disabled controls or attempt unauthorized activation requests.

= Step 8: Test Your Active SaaS Connection =

42. Return to WooCommerce gateway settings.
43. Locate GPCB Pay — Store Connection Setup.
44. Find Step 2 — Test Your Active SaaS Connection.
45. Select Test SaaS Connection.

This diagnostic is intended for an existing active store.

It verifies authenticated communication with the private SaaS.

It is different from the provisioning-store verification performed in Step 6.

A successful active-store connection test does not establish PayPal eligibility or subscription authorization.

Neither connection diagnostic creates or Captures a payment.

= Step 9: Configure Merchant PayPal Credentials =

46. Open the GPCB Pay Merchant Dashboard.
47. Locate the available PayPal merchant connection settings.
48. Follow the secure credential configuration workflow.
49. Enter the required PayPal Business account credentials when the authorized form is available.
50. Save the configuration through the secure SaaS process.

Merchant PayPal credentials are managed by the private GPCB Pay SaaS.

The WooCommerce Connector does not require merchants to enter PayPal Client Secrets into WordPress.

The private SaaS is responsible for protected merchant credential storage and authorized PayPal operations.

Never place PayPal Client Secrets in:

* Public JavaScript.
* Browser-visible configuration.
* WordPress Connector credential fields.
* Screenshots.
* Public repositories.
* Ordinary support emails or messages.

PayPal Business account eligibility remains subject to PayPal requirements.

Advanced Card Payments requires the applicable merchant approval and capabilities.

Guest Card availability is also subject to PayPal requirements and checkout context.

GPCB Pay cannot override PayPal merchant eligibility decisions.

= Step 10: Confirm Payment Readiness =

51. Confirm that the connected store is active.
52. Confirm that the intended payment environment is configured.
53. Confirm that the selected PayPal payment mode is available to the merchant.
54. Complete the applicable payment-readiness requirements.
55. Use the administrator diagnostics appropriate to the configured environment.

Connection authentication, PayPal eligibility, payment readiness, and subscription authorization are separate conditions.

A successful Sandbox payment does not independently establish Live eligibility.

A successful Connector diagnostic does not establish that a PayPal payment has been Captured.

Do not enable customer-facing Live payment acceptance until the applicable requirements are satisfied.

= Step 11: Start Your Eligible Trial =

GPCB Pay offers an eligible one-time seven-day service trial.

The trial is managed by the private SaaS.

Trial activation is a separate authorized operation.

Registering an account or activating a store does not automatically begin the trial.

Trial eligibility and activation depend on the applicable verified readiness requirements.

When an authorized trial begins, it lasts 168 consecutive hours.

The SaaS controls the recorded trial start and end timestamps.

The trial does not automatically pause after activation.

Review the subscription information in the Merchant Dashboard for the recorded service-access status.

The trial governs access to the external SaaS service.

It does not lock or unlock premium functionality inside the open-source WordPress plugin.

= Step 12: Maintain Pro Subscription Access =

The initial GPCB Pay commercial offering is Pro.

* Monthly: USD $19.
* Yearly: USD $190.
* Eligible one-time trial: 7 days.
* Trial duration: 168 consecutive hours.
* Renewal: Manual.
* Store allowance: One authorized WooCommerce website.

The subscription provides access to the external GPCB Pay SaaS payment infrastructure.

The subscription fee is separate from PayPal payment-processing fees.

Selecting a subscription plan does not independently establish payment.

Creating a PayPal Order does not independently grant paid service access.

Browser approval does not independently establish a successful subscription payment.

Paid access requires the applicable independently verified payment evidence and authorized SaaS entitlement.

When commercial entitlement enforcement applies, new payment initialization requires valid trial or paid service access.

Existing durable payment attempts retain separate recovery and Capture handling.

Subscription availability and enrollment are governed by the external GPCB Pay service.

For current commercial information, visit:

https://gpcbpay.com/

= Setup Troubleshooting =

If onboarding cannot continue:

* Confirm that your merchant account is verified.
* Confirm that the store belongs to your account.
* Confirm that Connector credentials were saved correctly.
* Confirm that the store is provisioning before running new-store verification.
* Confirm that DNS ownership verification succeeded.
* Confirm that Connector verification evidence has not expired.
* Confirm that store activation has completed before running the active-store connection test.
* Confirm that PayPal merchant credentials are configured through the authorized SaaS workflow.
* Confirm that the selected PayPal mode is supported for the merchant.
* Confirm that the applicable service-access requirements are satisfied.

Do not repeatedly create stores, rotate credentials, generate DNS challenges, or repeat financial operations after uncertain responses.

Use the recovery workflow appropriate to the original operation.

For support:

https://gpcbpay.com/

support@gpcbpay.com

Never include passwords, cardholder data, Connector Signing Secrets, PayPal Client Secrets, or OAuth tokens in ordinary support messages.

== SaaS Subscription and Fees ==

General PayPal Card Bridge for WooCommerce is distributed as an open-source WordPress plugin under the stated GPL-compatible license.

The external GPCB Pay SaaS is a separate managed payment service.

The initial commercial offering is:

* Plan: Pro.
* Monthly subscription: USD $19.
* Yearly subscription: USD $190.
* Eligible one-time trial: 7 consecutive days.
* Trial duration: 168 hours.
* Renewal: Manual.
* Store allowance: One authorized WooCommerce website.

A three-website or multi-store subscription tier is not included in version 0.1.0.

The subscription is for access to the external SaaS payment infrastructure.

It is not a license fee for unlocking functionality inside the WordPress plugin.

Store activation, trial activation, and paid entitlement are separate server-authorized operations.

When commercial entitlement enforcement is enabled, an expired trial without valid paid access does not authorize new payment initialization.

Existing durable payment attempts retain their applicable recovery and Capture handling.

GPCB Pay subscription fees do not include PayPal payment-processing fees.

Commercial enrollment and service availability are subject to the current GPCB Pay service configuration and published terms.

Current information:

https://gpcbpay.com/

== External Services and Data Disclosure ==

This plugin depends on external services for its core payment functionality.

The external services are:

* GPCB Pay SaaS.
* PayPal.

These services are necessary for the supported payment workflows.

Merchants should review the applicable privacy policies and service terms before connecting a store or processing payments.

= GPCB Pay SaaS =

Service provider: GPCB Pay

Official website:
https://gpcbpay.com/

Merchant Dashboard:
https://app.gpcbpay.com/

Published API domain:
https://api.gpcbpay.com/

WooCommerce Connector API origin used in version 0.1.0:
https://general-payment-bridge-saas-production.up.railway.app/

The Connector API origin is operated as part of the GPCB Pay SaaS infrastructure.

The Merchant Dashboard and WooCommerce Connector may use different published API hostnames.

Privacy Policy:
https://gpcbpay.com/privacy-policy/

Terms of Service:
https://gpcbpay.com/terms-of-service/

GPCB Pay SaaS is used to:

* Authenticate WooCommerce Connector requests.
* Associate requests with an authorized merchant store.
* Support merchant and store verification.
* Manage protected merchant PayPal credentials.
* Coordinate eligible PayPal Order creation.
* Coordinate authorized PayPal Capture operations.
* Maintain durable payment lifecycle records.
* Verify payment outcomes.
* Support payment recovery and reconciliation.
* Evaluate applicable subscription authorization.

The plugin may communicate with the GPCB Pay SaaS when an administrator explicitly performs connection diagnostics or when an applicable checkout, payment, Capture, or recovery operation requires the service.

Depending on the operation, transmitted information may include:

* Connector authentication identifiers.
* Signed request metadata.
* WooCommerce order references.
* Server-authoritative payment amounts and currencies.
* Selected payment mode and environment.
* PayPal Order references.
* PayPal Capture references.
* Payment state and recovery identifiers.
* Technical metadata required for payment processing and verification.

Separate Merchant Dashboard workflows may process:

* Merchant account information.
* Store domain information.
* Authentication and verification information.
* Protected PayPal merchant credentials.
* Subscription and billing information.

The private SaaS maintains the records required for authorized payment operations, security, recovery, and reconciliation.

Applicable data handling, retention, and privacy practices are described in the published GPCB Pay Privacy Policy.

Merchant responsibilities and service conditions are described in the GPCB Pay Terms of Service.

= PayPal =

Payment provider: PayPal

Official website:
https://www.paypal.com/

Privacy information:
https://www.paypal.com/privacy-center/

PayPal provides the eligible hosted card-payment components and payment-processing infrastructure.

During checkout, the buyer's browser communicates with the applicable PayPal-hosted payment components.

Depending on the payment experience, PayPal may process:

* Cardholder payment information.
* Billing information.
* Contact information.
* Payment authorization information.
* Information required for payment processing and risk assessment.

The GPCB Pay SaaS communicates with PayPal APIs to coordinate eligible Orders, authorized Capture operations, and payment verification.

PayPal determines merchant eligibility and payment method availability.

GPCB Pay cannot activate PayPal capabilities that are unavailable to a merchant account.

== Frequently Asked Questions ==

= Is the plugin free? =

Yes.

The WordPress Connector is open-source and free to install.

Payment processing depends on the external GPCB Pay SaaS service, which may require eligible trial or paid subscription access.

= Does the plugin work without GPCB Pay SaaS? =

No.

The plugin depends on the external Payment Core for payment creation, Capture coordination, and verification.

= What does the Pro subscription include? =

Pro provides eligible access to the managed GPCB Pay SaaS payment infrastructure for one authorized WooCommerce website.

The approved pricing is USD $19 monthly or USD $190 yearly.

Applicable PayPal processing fees are separate.

= Can I connect three websites? =

No.

The initial Pro offering is intended for one authorized WooCommerce website per merchant account.

A multi-store subscription tier is not included in version 0.1.0.

= Does uninstalling the plugin release my store slot? =

No.

Store ownership and lifecycle are maintained by the GPCB Pay SaaS.

Uninstalling the WordPress plugin does not independently revoke or release a SaaS store.

= Do I need a GPCB Pay account? =

Yes.

An authorized merchant account and verified store configuration are required for payment processing.

= Why is domain verification required? =

DNS verification establishes evidence of control over the configured website hostname.

It is separate from Connector authentication.

= Why must I verify the Connector connection? =

Connector verification establishes possession of the current Connector signing credentials through an authenticated server-to-server request.

It does not independently prove domain ownership.

= Which connection verification button should I use? =

For a new provisioning store, use:

Verify New Store Connection

After the store is activated, use:

Test SaaS Connection

These actions serve different purposes.

Neither action creates or Captures a PayPal payment.

= What happens if the pending Connector proof expires? =

The proof expires within 15 minutes.

Repeat the explicit new-store verification step when appropriate.

Do not automatically rotate credentials or recreate the store.

= Does store activation start my trial? =

No.

Store activation and trial activation are separate authorized SaaS operations.

= When does the seven-day trial begin? =

The trial begins only when the applicable authorized trial activation succeeds.

An eligible trial lasts 168 consecutive hours.

Account registration and store activation do not automatically start the trial.

= Are subscriptions renewed automatically? =

No.

The initial commercial offering uses manual renewal.

Automatic recurring subscription billing is not included in this release.

= Are GPCB Pay fees included in PayPal fees? =

No.

GPCB Pay subscription fees are separate from applicable PayPal payment-processing fees.

= Where do I enter my PayPal Client ID and Client Secret? =

Merchant PayPal credentials are configured through the authorized GPCB Pay Merchant Dashboard workflow.

The private SaaS manages protected merchant credentials.

Do not enter PayPal Client Secrets into WooCommerce Connector credential fields.

= Does Advanced Card work in every country? =

No.

Advanced Card Payments requires applicable PayPal merchant eligibility and approval.

= Is Guest Card available to every merchant? =

No.

Guest Card availability depends on PayPal requirements, merchant configuration, and checkout context.

= Does GPCB Pay override PayPal restrictions? =

No.

PayPal determines eligibility for its payment products.

= Does the plugin support WooCommerce Checkout Blocks? =

Yes.

Checkout Blocks are the intended checkout integration for version 0.1.0.

= Is classic WooCommerce checkout supported? =

Classic shortcode checkout is not advertised as supported in version 0.1.0.

= Does the plugin automatically switch between Guest and Advanced Card? =

No.

Automatic mode selection is not included in version 0.1.0.

= Does the plugin collect raw card information? =

No.

Supported card-entry experiences use PayPal-hosted payment components.

= How does GPCB Pay verify a successful payment? =

The private SaaS verifies the applicable PayPal Capture result server-side.

WooCommerce payment completion requires successful server-side payment verification.

= What happens if payment status is uncertain? =

Durable payment records and recovery controls support verification and safe continuation of existing payment operations.

An uncertain response must not be treated as successful payment.

It must not independently authorize repeating a Capture.

= Does GPCB Pay protect against duplicate Captures? =

The private Payment Core includes durable idempotency and Capture protection controls designed to reduce duplicate Capture operations.

= Does activating a store grant subscription access? =

No.

Store activation, trial activation, and paid subscription authorization are separate operations.

= Is GPCB Pay affiliated with PayPal or WooCommerce? =

No.

GPCB Pay is an independently developed WooCommerce integration using eligible PayPal payment services.

= Where can I get support? =

Official website:
https://gpcbpay.com/

Support email:
support@gpcbpay.com

Never send passwords, cardholder data, Connector Signing Secrets, PayPal Client Secrets, or OAuth tokens through ordinary support messages.

== Changelog ==

= 0.1.0 =

* Initial WooCommerce Checkout Blocks connector.
* Added PayPal Guest Card integration.
* Added PayPal Advanced Card Fields integration.
* Added authenticated external SaaS Payment Core connection.
* Added server-authoritative payment initialization.
* Added server-verified PayPal Capture.
* Added durable payment lifecycle coordination.
* Added payment recovery and idempotency controls.
* Added duplicate Capture protection.
* Added Sandbox and Live environment settings.
* Added Clean, Compact, and Premium Advanced Card layouts.
* Added administrator connection diagnostics.
* Added new-store Connector verification before active-store connection testing.
* Documented DNS-based ownership verification.
* Documented secure merchant PayPal credential configuration.
* Documented separate store activation, trial activation, and subscription authorization.
* Documented the initial one-website Pro SaaS offering.
* Documented external service dependencies and data disclosures.