← Back to all articles • E-commerce & CMI • ⏱️ 9 min • 📅 10 novembre 2025

Integrating a CMI payment gateway with WooCommerce in Morocco

Step-by-step engineering guide to connect the Centre Monétique Interbancaire (CMI) to WooCommerce: Moroccan merchant contracts, SHA-512 hashing, IPN webhooks, and sandbox testing.

Ali Ouarzazi

Freelance WordPress & full-stack developer

In Morocco, accepting domestic and international credit cards via the Centre Monétique Interbancaire (CMI) is critical to reducing reliance on Cash on Delivery (COD) and boosting customer trust. However, connecting CMI to WooCommerce requires specific security standards, SHA-512 callback verification, and formal banking certification. Here is your definitive practical guide.

1. How the CMI payment architecture operates on WooCommerce

The CMI acts as the unified interbank payment hub for Moroccan banks (Attijariwafa, BCP, BMCE, CIH, SGMB, CDM). The flow uses a hosted payment gateway model: the customer checks out on WooCommerce, gets redirected to CMI's encrypted portal, validates payment through bank 3D Secure v2 (OTP SMS), and CMI sends an authenticated server-to-server webhook (IPN) confirming payment.

💡 Required VAD merchant agreement

To obtain CMI production credentials, your business must have a registered Moroccan legal entity (RC, IF, ICE, Patente) and an approved remote merchant contract (VAD) from your Moroccan bank.

2. Technical prerequisites and hosting requirements

Before configuring your module, your server must meet stringent technical requirements set by CMI security audits: valid TLS 1.3 SSL certificate, PHP 8.1+ with curl, openssl, and hash extensions enabled, open server IPN endpoints without firewall challenges, and native Moroccan Dirham (MAD) currency support.

✓ Valid TLS 1.3 SSL certificate across canonical www domain.
✓ WooCommerce store default currency set to Moroccan Dirham (MAD).
✓ Full legal pages (Terms, Return policy, Privacy, Legal notice with company ICE).
✓ Firewall rules allowing incoming POST webhooks from CMI IP blocks.

3. Configuring merchant keys and SHA-512 hash calculation

Transaction integrity relies on bidirectional SHA-512 cryptographic signing. At checkout, WooCommerce concatenates order parameters (client ID, amount, currency, return URL, order ID) with your CMI Store Key, producing a base64 SHA-512 signature. If a single character or decimal formatting mismatch occurs, CMI triggers an authentication error.

CMI parameter	Expected format	Example	Technical function
clientid	10-digit integer	6000012345	Unique CMI merchant account ID
amount	2-decimal float with dot	450.00	Total transactional order value
currency	CMI ISO numerical code	504 (MAD)	Interbank Moroccan Dirham code
storeKey	Alphanumeric secret string	AbC123XyZ!987...	Private salting key for SHA-512 hash
callbackUrl	Direct HTTPS URL	https://www.site.com/?wc-api=cmi_ipn	Direct server webhook validation

4. Banking certification protocol and production launch

The CMI enforces a sandbox testing cycle. You will be provided with test credit cards simulating successful 3D Secure authentication, card decline (insufficient funds), and user cancellation. Once test transactions match CMI logs, an official compliance certificate is signed, enabling live production credentials.

💡 Critical post-certification rule

Remember to switch gateway endpoints from sandbox (testpayment.cmi.co.ma) to live (payment.cmi.co.ma), paste your production Store Key, and conduct a real 10 MAD verification transaction with your own bank card.

Conclusion & Action Plan

Integrating the Moroccan CMI gateway elevates your WooCommerce store into a modern, trusted e-commerce platform. Eliminating delivery return risks and streamlining order flows makes it a high-return investment for any Moroccan merchant.

Frequently Asked Questions

What are the typical transaction fees with Moroccan CMI ?

Commissions are negotiated with your acquiring Moroccan bank under the VAD contract. Typically, rates range from 1.5% to 2.5% ex. VAT for Moroccan domestic cards, and up to 3.0% to 3.5% for international Visa and Mastercard cards.

Can a store combine CMI online payment with Cash on Delivery ?

Yes, this is the benchmark hybrid setup in Morocco. Shoppers can choose between secure upfront card payment (often incentivized with free shipping) or traditional cash upon delivery.

Why do CMI payment notifications occasionally fail ?

The most frequent cause is a security plugin or WAF (Wordfence, Cloudflare) blocking the incoming server-to-server POST webhook from CMI. Whitelisting CMI IP blocks resolves this immediately.

About the Author: Ali Ouarzazi

E-commerce engineer and WordPress specialist based in Marrakech, focused on Moroccan CMI gateways, Stripe setups, and conversion-first checkout flows.

View full author profile & career → • LinkedIn • Direct Contact

✨ Professional services