=== RedFace Pay ===
Contributors: redfacesa
Tags: payments, africa, commerce, redface, checkout
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept payments through RedFace Pay — a gateway into African commerce infrastructure.

== Description ==

RedFace Pay for WordPress connects your site to the RedFace Platform via Commerce API.

* One login — same merchant identity across every RedFace plugin
* Modular — only Payments loads in this release
* Connection wizard — account, API key, business, ready
* Webhooks — require a configured secret and `x-redface-signature` HMAC verification
* Shortcode — `[redface_pay_button amount="99.00" currency="ZAR"]`

**You are not installing a standalone payment gateway.** Business logic lives on RedFace; this plugin is a thin, secure client.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/redface-pay` or install from WordPress.org (when published).
2. Activate through the Plugins screen.
3. Open **RedFace Pay → Connection** and complete the wizard.
4. Generate an API key at https://www.redfacepay.co.za (Account → Developers).

== Configuration ==

* **Merchant ID** — UUID of your RedFace business
* **API Key** — `rf_live_…` from Account → Developers (never commit to version control)
* **Webhook URL** — copy from Settings into your RedFace webhook dashboard
* **Mode** — Sandbox for testing, Live for production

== External services ==

This plugin connects to the **RedFace Commerce API** to create payment sessions and receive webhooks.

**What is sent and when**

* When a customer pays, the plugin sends your configured **Merchant ID** and authenticates with your **API key** (stored in WordPress options).
* Payment payloads may include amount, currency, customer email, and order metadata.
* A connection test (`ping`) runs when you complete the connection wizard or test settings in wp-admin.

**Default API endpoint**

`https://bpzzgilwlkghgfkvkkxx.supabase.co/functions/v1/commerce-api`

Merchants may override the API base URL in plugin settings (e.g. for staging).

**Service provider**

RedFace (RedFace Pay), African commerce infrastructure.

* Terms of use: https://www.redfacepay.co.za/legal/terms
* Privacy policy: https://www.redfacepay.co.za/legal/privacy

== Frequently Asked Questions ==

= Does this replace WooCommerce? =

No. Use **RedFace Pay for WooCommerce** for Woo checkout. This plugin is for simple pay buttons and custom themes.

= Where is business logic? =

On RedFace Platform — payments, settlement, KYC, and events. The plugin never embeds payment partner secrets in WordPress.

= Does this store card data in WordPress? =

No. Checkout runs on RedFace hosted payment pages.

== Troubleshooting ==

* **API Status offline** — verify API key, merchant ID, and that your key is active in RedFace Account.
* **Webhooks failing** — confirm webhook secret matches Settings and your site is reachable over HTTPS.
* **Pay button does nothing** — complete the Connection wizard and confirm payments scope on your API key.

== Support ==

Email support@redfacepay.co.za or visit https://www.redfacepay.co.za/plugins/redface-pay

== Screenshots ==

1. Connection wizard — Merchant ID and API key setup
2. Overview — payments today and API status
3. Settings — webhook URL and sandbox/live mode

== Changelog ==

= 1.0.2 =
* Plugin Check: prefix admin view variables; sanitize wizard API key input for WordPress.Security rules.

= 1.0.1 =
* Settings: API keys and webhook secrets are sanitized without sanitize_text_field so token characters are preserved.
* Webhooks: require a configured webhook secret and a valid x-redface-signature; reject unsigned requests.

= 1.0.0 =
* Initial release — connection wizard, Commerce API client, pay button shortcode, webhooks, admin logs.
