Round Pay

Putting a Round Peg in a Square Hole!

Round Pay takes Square payments in Zen Cart: cards, Google Pay and Apple Pay, on the standard checkout and on One Page Checkout. It’s written for Square’s current Web Payments SDK and API, on the engine of SquarePay for WHMCS, our Square gateway that has been taking live payments since August 2026.

Why the name? Every change to Square’s APIs and SDKs has left other payment modules like it putting a square peg in a round hole. So we turned the problem around, wrote ours for Square as it works today, and called it Round Pay.

Built on Square’s Latest

• 3-D Secure the way Square does it now. Buyer verification travels inside the card token, made for the exact amount being charged. That’s the method in Square’s current SDK, which is retiring the older separate verification step.
• A pinned API version (Square-Version 2026-01-22), so a change in your Square dashboard can’t quietly change how payments behave.
• The card is checked when the total is final. On the standard checkout that’s the confirmation page, after coupons and gift certificates; on One Page Checkout it’s the checkout page itself. A charge for any other amount is refused.
• Card details never touch your store. They’re typed into Square’s own secure fields, and your server only ever sees a single-use token.
• Sandbox and Production kept apart. Each has its own application ID, access token and location, so testing never touches your live credentials, and going live is one setting.

Proven Where It Counts

Round Pay’s Square client, its decline handling and its single-use token rule come from SquarePay for WHMCS. That gateway has taken live card, Apple Pay and Google Pay payments, and made refunds, on myZenCartHost.com since August 2026, and it’s approved on the WHMCS Marketplace.

• No double charges. A used card token is refused if it comes back (a double click, the back button, a refreshed page), and every charge and refund carries an idempotency key, so a network retry can’t charge or refund twice.
• Real reasons for a decline. The buyer hears what went wrong (security code, ZIP code, funds) and can fix it and buy. A store-side fault, like an expired access token, is never blamed on the buyer’s card, and it’s emailed to you.
• A decline is explained where the buyer is looking, beside the card fields, not at the top of a long checkout page.
• Refunds, captures and voids from the order page, full or partial, with every Square transaction for the order listed and linked to Square’s receipt (Zen Cart 2.2.0 and later).
• A connection check under Modules > Payment that shows your Square location, its currency and whether it can take cards, before a buyer ever sees the form.

Our Setup Guide Comes with It

Ten pages, written for store owners: getting your Square credentials, every setting, testing in the Square sandbox, going live, Google Pay and Apple Pay (Apple’s domain registration included), refunds, switching from another Square module, and troubleshooting. It opens in your account as soon as your order is placed.

Pair It with Fraud Screen

Square’s own checks won’t stop every stolen card, and the chargeback can arrive weeks after you’ve shipped. Our free Fraud Screen plugin scores every order after payment for the signs of stolen-card fraud and holds the risky ones for you to review before anything ships. We recommend it for every store taking cards with Round Pay.

Want Afterpay and Cash App Pay Too?

Round Pay Plus is Round Pay with Afterpay (Clearpay in the UK) and Cash App Pay added. It’s $200, or $50 to move up from Round Pay later, with your settings and payment history kept.

What It Needs

Zen Cart 2.1.0 through 3.0.0 (the order-page tools need 2.2.0 or later), PHP 8.0 through 8.5, HTTPS, and a Square account. It’s an encapsulated plugin: Plugin Manager installs, upgrades and removes it, and no core file is changed.

Released under the GNU GPL v2: $150 buys the package and one year of updates and support for one store. Renewing is $50 a year and optional; the plugin keeps working either way.

Questions? Contact us; we answer within one business day, usually within a few hours.