Activate Swish Handel and renew the certificate

Take payments with the standalone payment method Swish Handel and keep the connection's certificate up to date.

Before you begin

The guide applies to Swish Handel in Abicart Go, Plus, and Pro. You need a Swish Handel agreement via your bank and permission for Swish Certificate Management. Read about Swish for e-commerce and ask your bank to confirm you have the correct agreement.

A private Swish number or Swish Företag is not the same connection. Swish offered inside, for example, an external checkout uses the checkout provider's connection instead.

This payment method uses SEK and the Swedish market. Swish's TLS client certificate is separate from the HTTPS/SSL certificate for the store's domain.

1. Add and save the payment method

Go to Settings → Payment methods → Add new payment method, select Swish and save the new payment method. Leave it inactive until the details are complete.

If it says that the payment method must be saved before you can continue, go back and save it with Add. Do not create multiple copies as troubleshooting attempts.

2. Create a CSR in Abicart

Open the Swish payment method and the link How to?.

Select Generate CSR when you intend to create a new certificate connection.

Do not generate a new CSR as a harmless test. This creates a new private key in Abicart. A previous certificate cannot then be used with the new key. Plan a replacement of a working connection so that you can complete the entire process.

Copy the entire CSR text. The CSR is a certificate signing request, not the finished TLS certificate. The private key must remain in the connection; do not send it to support or paste it into other services.

3. Create the correct certificate in the Swish portal

Open Swish Certificate Management and log in with the authorized person's BankID for the correct organization and Swish Handel number.

The images show a previous portal interface. Check which certificates are in use before you revoke anything. Revoking a working certificate can stop payments; only do it when the portal requires it for the planned replacement and you know which connection is affected.

Choose to create a new certificate for the correct Swish number.

You have already created the CSR in Abicart. Therefore, skip the portal's instruction to create a separate CSR file and use the existing request.

Paste the entire CSR text from Abicart into the designated field in the portal.

Generate the certificate according to the portal's instructions. If a format needs to be selected, use PEM. Complete the step.

4. Download and save the TLS certificate

Open the new certificate in the portal, for example with the View/eye icon.

Copy the entire TLS certificate text, including the beginning and end. You can also open the downloaded PEM file and copy the certificate from there. Do not copy the CSR text again.

Go back to Settings → Payment methods → Swish. Paste the certificate into TLS certificate, enter the agreement's Swish Handel number and save. The number is the recipient number for the agreement, not the buyer's mobile number.

5. Check a complete payment flow

Activate the payment method only when the connection is complete. Then open the store and follow the test procedure that applies to your environment.

Check the shopping cart, customer details, total amount, and that the correct Swish recipient is displayed.

A loading image or Swish opening only shows that part of the flow has started. To verify the entire flow, an intended payment needs to be completed and the same order must be correctly paid in Abicart. Also check the result with Swish/the bank. A live test means a real payment; use the provider's designated test environment when available.

Settings that affect the checkout

• Active: controls whether the payment method can be displayed.
• Default: suggests the payment method when it is available.
• Only specified customers/customer groups: limits availability. Customer groups require support in the store's subscription.
• Customer type and personal/organization number: limits the checkout and what information is required. It is not in itself an identity or address check.
• Do not allow other delivery address: limits alternative delivery addresses. It does not mean that Swish verifies the address against the population register.
• Payment status email: can send information to the store owner when the order is paid.
• Gift card products: can be excluded from purchase with the payment method.

Account

Enter the correct Swish Handel number and the TLS certificate that belongs to the CSR you created for this payment method. Only enter a password if the certificate format you are using requires it; do not guess a password in case of a connection error.

Name and description

The default name can be replaced with a custom name. The detailed description is optional and should describe what the customer should do.

Currency

Use SEK. The fact that other currencies are active in the store does not make them allowed for this Swish connection.

Amount limits

If the store supports amount limits, the payment method can be hidden based on the order's total amount.

• No limit: no extra amount limit is used.
• Hide if order total is zero: the option is hidden at 0.
• Hide if order total is greater than zero: the option is hidden for positive total amounts, not the other way around.
• Hide outside range: check both the minimum and maximum amounts and that another payment method remains available.

The image shows an example with a minimum limit. Check the conditions that are actually saved in your store.

Renew the certificate and troubleshoot the connection

Check the certificate's actual expiration date in the portal and plan the renewal before that date. Do not assume that all certificates have the same five-year validity. Follow the entire chain new CSR in the correct Abicart payment method → new certificate in the Swish portal → the entire certificate back in the same payment method.

In case of an error, check the correct Swish number, the certificate's validity, that it has not been revoked, the entire PEM text, the match to the latest CSR, and that test/production environments have not been mixed up. Then, check the actual status of the order and payment before trying again.

Cancellation and refund

When you cancel a paid Swish order, Abicart requests a refund of the payment. Therefore, do not cancel a paid order as a harmless test. Refunds via this connection apply to the entire payment; there is no optional partial amount in Abicart's Swish action.

A requested refund is not the same as a confirmed result. Wait for the payment status and check the transaction with Swish/the bank. Do not make a manual refund in the bank and a refund in Abicart at the same time. If the response is unclear, you should first check the existing request.

Quick start

1. Confirm the Swish Handel agreement and save an inactive payment method.
2. Create a CSR in Abicart and use it in the correct Swish portal connection.
3. Save the entire TLS certificate and the correct Swish number in the same payment method.
4. Check the entire payment flow and monitor the certificate's actual expiration date.

Subscription: Swish is supported in Go, Plus, and Pro. The bank's Swish Handel agreement and fees are separate. Additional limit features may depend on the store's activated subscription features.