FedaPay payment
In-house PrestaShop 8 module for Mobile Money and card payments in CFA francs. Validated in FedaPay's test environment; live payments pending.
PHP, PrestaShop 8, FedaPay API
← All work
E-commerce · Web & Mobile
Koutonou Marketplace
Multi-vendor marketplace: payments, sign-in, modules and mobile apps
A multi-vendor marketplace on PrestaShop: a Mobile Money payment module built in-house, Google sign-in, audited and adapted modules, a marketplace theme, and iOS and Android apps.
- Role
- Web & mobile developer
- Period
- 2025 – 2026
- Client
- Bénin Digital
- Status
- Live · payments validated in test mode
- 6modules & theme
- 2test orders paid end to end
- iOS + Androidmobile apps
PHPPrestaShop 1.7 / 8SmartySCSSMySQLREST APIOAuth 2.0FedaPayiOSAndroid
Context
Koutonou is a multi-vendor e-commerce marketplace run by Bénin Digital. It had no online payment suited to Benin, no social sign-in, and several modules that needed hardening and vendor support. I worked on the store itself (PHP, PrestaShop) and on its mobile apps for iOS and Android.
What I built
- koutonoufedapay, a PrestaShop 8 payment module for FedaPay (Mobile Money and card, in CFA francs). The order is created only after the payment is read back from FedaPay, with amount checks, duplicate protection, separate test and live keys, and a signed webhook. It works on the website and in the Android app.
- ps_koutonouauth, an authentication module: Google sign-in (OAuth 2.0 and OpenID Connect with PKCE) and mandatory email verification. It plugs into PrestaShop through hooks, needs PHP 8.1 and has no external dependency.
- Audits and fixes of existing open-source modules, each written up as a report: click-and-collect (security fixes and vendor support), Ever Blog (44 commits) and Cloudflare Turnstile (a patched fork).
- Amazona, a marketplace theme (Smarty, SCSS). I fixed an override conflict when installing its theme-configuration module by moving the logic to a hook.
- The marketplace mobile apps for iOS and Android: store-readiness work (navigation security, signing, Google Play and App Store requirements, tests and CI) and publication guides. They are currently being deployed.
- REST APIs designed and consumed by the apps, database maintenance and performance tuning, plus testing, debugging and code review with the rest of the team.
Payments with FedaPay: where it stands
FedaPay's official PrestaShop module is paid, looked outdated, and the provider did not answer my questions on compatibility, licence and support for six weeks. FedaPay publishes an open API and an MIT-licensed PHP library, so I built the module in-house. On 14 October 2026 it passed end-to-end tests on the production site in FedaPay's test environment: a 28,000 F CFA order from the browser and a 3,500 F CFA order from the Android app, both ending as "payment accepted", with confirmation emails to the customer and the vendor. Not done yet: a first real payment (it needs the production key) and splitting payouts between vendors, since every payment currently lands on one FedaPay account.
Modules & theme
Google sign-in & email check
OAuth 2.0 / OpenID Connect with PKCE, mandatory email verification, built on hooks. The Google provider is shipped, five more are planned, and automated tests are the next step.
PHP 8.1, PSR-4, OAuth 2.0, OIDC
Click & Collect
Based on the open-source Ever PS Click & Collect module. 14 commits: security fixes, then a vendor per store, per-vendor email notifications and hooks for the marketplace.
PHP, Smarty, PrestaShop 1.7 / 8
View RepositoryEverblog
Based on the open-source Ever PS Blog module. 44 commits: Bootstrap 4 compatibility, SQL fixes (reserved words, escaping), 235+ French strings and a redesigned listing.
PHP, Smarty, Twig, PrestaShop
View RepositoryAmazona
Marketplace theme, with a fix for an override conflict in its theme-configuration module.
Smarty, SCSS, JavaScript, PrestaShop
View RepositoryCloudflare Turnstile
Patched fork of the open-source Pixel Open module (v1.1.7 to v1.2.0): auto-injected widget, server-side checks, safe redirect and multi-shop configuration.
PHP, JavaScript, PrestaShop, Cloudflare Turnstile
View RepositoryDecisions & trade-offs
Build the payment module, do not buy it
The paid module cost 4,900 F CFA, but with no answer on maintenance or licence it was a dependency I could not trust. A thin module on top of FedaPay's open API keeps the code under our control and opens the way to vendor payouts. The trade-off is that maintenance is now ours and nobody outside has audited it.
Fork and patch instead of rewriting
For Cloudflare Turnstile I forked the maintained upstream module (Apache 2.0) and added only what a marketplace needs: auto-injection on login, contact and reset forms, server-side hostname and action checks, a safe redirect after failure, and per-shop configuration. Two review findings were left alone on purpose, with the reasons written down.
Secure first, then adapt
The click-and-collect audit started with fixes before any marketplace feature: an XSS in the store notification email, an unvalidated CSV upload and an unchecked date. Only then did I add vendor support: a vendor per store, per-vendor order emails and hooks for the marketplace.
App screens
Links
Let's Connect
I answer within a day, usually faster.