Overview

What it does

Fiserv's Carat Global Platform is a payment service processor, providing secure payment collection and management across all of a business's channels. If you're here, you probably already use Fiserv and have a Carat merchant account (formerly First Data Merchant Services).

Carat is a paid service, and will charge monthly and per-transaction fees separate from this extension. Fiserv's fees will vary by your contract, features, and payment processor. Please contact Fiserv for more information.

This extension brings Carat enterprise payment services to Magento 2. This gives you and your customers the convenience of payments and stored credit cards within Magento, with all the security and protection of Carat services.

We know what you want: A proven solution that just works, with all the features you'd expect, from a reputable company that stands behind their product.

Our payment methods are used on thousands of Magento stores, to process billions of dollars a year. We know what we're doing, and we've been doing it a long time. Payment is a fundamental part of your business, and it's a fundamental part of ours too. We'll help you make sure it never becomes a problem.

Full-featured

This module supports all standard payment actions in Magento. It also allows customers to save their payment info for future use. This gives returning customers the convenience of stored credit cards and rapid checkout, without breaking PCI compliance.

The first time a customer checks out, they are given an advanced form to enter their credit card details. If they choose to save the card, next time they check out they can reuse that card with a single click. Your customers can also view, add, edit, and delete any of their stored payment info through a 'Manage My Cards' interface in their account. All frontend features are also available in the Magento Admin Panel.

Pay by credit card
Save credit cards (tokens) for reuse
PCI SAQ A eligibility: Carat collects all credit card data for you
Add, edit, and delete saved payment data
Edit orders and reorder without having to ask the customer for CC info again
Authorize, Capture, or Save CC Info (without charging) at time of checkout
Capture funds even after the authorization expires
Partially invoice orders (including reauthorization on partial invoice)
Partially refund (online credit memo)
Send billing address, shipping address, and more with transactions
Card Verification Number (CVN) Validation
Address Verification (AVS)
Integrate your systems with Magento REST and GraphQL API support
Use a different Carat account for each website (multi-website support)
Supports standard, admin, and multi-shipping checkout
Supports ParadoxLabs Adaptive Subscriptions extension
Supports Hyva Checkout (a separate licensed product)

Carat Payment for Magento 2 allows admin card management

Convenient

Stored payment info is good for your business and customers.

It simplifies checkout.
It encourages customer loyalty.
It streamlines order management and integrations.
It lets your staff quickly process orders and billing changes, without needing customers to repeat their credit card info.

All frontend features are available in the admin panel. This means admins can view, add, edit, and delete customers' stored cards, and place orders using them.

When editing an order, you can reuse the payment info, even for guests.

Secure

Security is everything. We know this. Customer confidence can take years to build up, and a stolen credit card can shatter that in a moment. Nevermind the legal ramifications or fees: Your customers are your business. You can't afford to risk losing them. Using ParadoxLabs Carat will protect you from many forms of credit card scraping hacks.

All communication with Carat is performed using TLS encryption, and no confidential cardholder data ever touches your server (even for a moment). Using secure Hosted Checkout, all credit card forms for this extension are contained within an iframe hosted by Carat.

This means all credit card data is sent directly from your customers to Carat, and none of it is exposed to your website or server at any time. Carat gives us a token to use in place of the actual credit card data, and we use that token for all payment processing. This lets your customers pay with a 'saved' card while the actual card is not on your server at all.

This extension implements Carat iframe payments for all credit card forms, and does not support collecting credit card data by any other means. That makes the ParadoxLabs Carat payment method eligible for PCI v3.2 Self-Assessment Questionnaire A (PCI SAQ A), the simplest possible form and process.

Note that you must have SSL enabled on all checkout and login forms, and that this eligibility only applies to this specific payment method. Any other payment methods or credit card handling your business may perform will have its own SAQ eligibility, and may require you to complete a more stringent SAQ form.

For details on the SAQ types and what eligibility means, see "Self-Assessment Questionnaire Instructions and Guidelines (3.2)" (PDF, by PCI Standards Security Council).

In addition, Fiserv offers a PCI Rapid Comply solution as part of their Merchant Services, which includes guidelines and support to help you complete the annual SAQ.

PWA-Ready

Progressive Web Apps are the future, and we're ready for them.

This extension fully supports GraphQL and guest/customer REST APIs, allowing you to build out checkout and customer card management interfaces within your PWA, mobile app, or other 'headless' architecture. Note that adding or updating cards outside of Magento will require fully implementing the secure iframe payment form, or an equivalent solution.

Extensive API documentation and how-tos are available in our user manual.

In production

What the people running it say.

No reviews yet. If you are running this extension, yours would be the first.

Write the first review

Write Your Own Review

You're reviewing: Carat Payments for Magento 2

Your Rating:

Loading...

You submitted your review for moderation.

Fit check

Will it run on your store?

Check your install

Platform

Version

Support matrix
Magento Open Source	2.4, 2.4.9, Mage-OS
Adobe Commerce	2.4, 2.4.9, Cloud
Mage-OS	All versions

Before you spend anything

Two ways to check it yourself.

Nobody should buy an extension on a product page alone. Read the whole manual or drive a real store running it — both right now, without talking to sales.

Read the user manual

The complete manual is public — installation, every configuration option, the event and API reference, and the known limitations. No gate, no email required. If the answer to your question is not in there, that is a bug in our docs.

Open the manual

Some more details

This might be useful later.

Install

Composer, the way your team already deploys.

# credentials are in your account after purchase
composer require paradoxlabs/carat
bin/magento setup:upgrade

Maintenance record

Changelog

Every release we have shipped for this extension, with its notes. A visible maintenance history is the only honest answer to "is this still maintained?"

3.0.0 Sep 15, 2026

WARNING: the payment form has been rebuilt on the Commerce Hub Checkout SDK (SDCv2). Any theme override of the payment templates must be updated.

Changed the payment form to Commerce Hub Checkout SDK 3.8.16 hosted fields, replacing the previous iframe integration.
Changed the payment method to run as a gateway (is_gateway), enabling payment review, accept/deny, and transaction information fetching.
Fixed the fraud/risk taxExempt flag being sent incorrectly, and added transaction-inquiry fraud status updates.
Fixed a stale Checkout session ID surviving stored-card selection and order re-import, which could fail placement.
Fixed voids of an expired or unknown authorization being reported as failures on TokenBase 5.1, which stopped swallowing void errors.

2.0.0 Compatible with 2.4, 2.4.9, Mage-OS

WARNING: PHP 8.1 is now the minimum. Now requires ParadoxLabs_TokenBase 5.0.

Added support up to PHP 8.5; PHP 8.1+ is now required.
Added unit test coverage.
Fixed iframe parameters being set as strings where integers were expected.
Refactored for PHP 8.1+: constructor property promotion, readonly properties, strict types, import cleanup, and `$escaper` usage in templates.

1.1.2 Compatible with 2.3, 2.4, 2.4.8, Mage-OS

Added confirmation prompt before deleting stored payment cards on frontend.
Added feature to auto-load invoice when clicking 'Credit Memo' from an order.
Changed GraphQL to hard dependency, removing compatibility for Magento 2.2.
Fixed card address changes not syncing to gateway on API card save, for applicable gateways. (#12, thanks @damienwebdev)
Fixed card last_use timestamp not being set when saving a new card from My Payment Options.
Fixed gateway API endpoint URLs.
Fixed getTokenDetails potentially returning non-string value in some API requests.
Fixed PHP 8.4 compatibility issue in AbstractMethod. (#11, thanks @richard-t-bermudez)

1.1.1 Apr 22, 2025 Compatible with 2.3, 2.4, 2.4.8, Mage-OS

Added support for Magento 2.4.8.
Fixed customer payment options address input validation.
Fixed CVV tooltip rendering.
Fixed PHP 7.1-7.2 compatibility.
Fixed PHP 8.4 compatibility.

1.1.0 Jun 27, 2024

WARNING: Any customized extension templates or JS in your theme must be updated for compatibility with Magento's new strict CSP blocking on checkout.

Added CSP/SRI secure mode support for 2.4.0+ (2.4.7 checkout compatibility).
Fixed card edit duplicating the card record.
Fixed payment extension attributes holding tokenbase_id values improperly.
Fixed reorder applying the original payment method if a new card was entered.
Fixed undeclared property for PHP 8.2.

1.0.1 Jan 22, 2024

Added Instant Purchase support.

1.0.0 Dec 28, 2023

Initial release

Pairs with

Still deciding?

Send us the awkward edge case and we'll tell you straight whether it's covered — including when the answer is no.

Ask us a question

My Cart

Carat Payments for Magento 2