PSD 2/Strong Customer Authentication

6th August, 2019

We’ve been hard at work over the past few months addressing some much needed improvements to Expresso Store! Currently, the most pressing item is the EU’s Payment Services Directive 2 (PSD 2) and specifically the Strong Customer Authentication (SCA) requirement that officially goes into enforcement on September 14th, 2019. If you’re not familiar with these requirements, we recommend starting here. Otherwise, continue reading to learn about the most recent updates we’ve made to Store in regards to these upcoming requirements and what it means for you.

Current State of the Union Store integrates with its payment gateways through the use of Omnipay, a fantastically helpful and widely used PHP library. Unfortunately, because of legacy ExpressionEngine (and consequently legacy PHP) support, Store 4 is currently running the deprecated V2 of Omnipay which is not widely receiving 3D Secure support. V3 of the library does address these needs but has a minimum requirement of PHP 7. In order to support 3D Secure as well as the most modern features and functionality of our supported payment gateways, we will need to move to Omnipay V3. More on how we plan to do that shortly.

Moving Forward From Here and What It Means For You As mentioned, we are moving both Store to Omnipay V3 and that work has already begun. This transition requires that we have a minimum requirement of PHP 7 and ExpressionEngine 5 to use both Store and CartThrob going forward.

We‘ve heard from a lot of you that you are unable to upgrade from older versions of Store for a variety of different reasons and we have a plan for how to address this for you.

Payment gateway updates (including SCA support for Store) will be privately released as a V5 Beta. The beta will be freely available to V4 license holders by request until each add-on hits a full V5.0 release. At that time an upgrade fee may be required to receive ongoing updates via the EllisLab Addon Store or our respective add-on sites

Want to be on the V5 Beta list? Send us an email at [email protected] with your V4 license code and a quick note stating your desire to receive the V5 Beta and we will put you on our list for releases and updates.

As previously stated, this transition is a significant undertaking and we will be doing a progressive rollout of payment gateway support based on the usage levels of our customers. The following is our implementation roadmap:

  • Dummy & Offsite
  • Stripe
  • SagePay Direct
  • SagePay Server
  • PayPal Express
  • Authorize.net Accepted Host
  • Mollie
  • Authorize.net API
  • PayPal Pro
  • PayPal REST
  • Authorize.net Accept.js

These will make up the entirety of our included payment gateways for the full release of Store V5.0. We intend to make other first-party payment gateways available as purchasable add-ons at a small fee and are still working on a final list for what we intend to offer. We will continue to offer custom gateway development for anyone in need of a gateway that is not in our official first-party gateway list.

Need Support on Your Old Version of Store? We understand not everyone is going to be able to update either at all or in time for the SCA requirement and we may be able to help. Send us a message at [email protected] with your needs and we will do our best to accommodate your request.

Stay in the Loop for What’s Next We’re continuing to plan a roadmap for how we can innovate Store in a way that makes it even more useful to the ExpressionEngine community. We have lots of big ideas and are excited to start sharing them, so make sure to sign up for email updates here. We’ll be sending out announcements on our progress, development roadmap, and releases as they happen. Receiving the email updates will be the best way to stay in the know on all things Expresso Store.