Getting hands on with Drupal Commerce 2 - Onsite payments and Sales Tax

By John Locke on December 29, 2017

We're nearing launch of two new Drupal Commerce sites, one of them being this one. It turns out Freelock.com has some relatively sophisticated commerce needs: some taxable products, some non-taxable products. Recurring subscriptions. Arbitrary invoice payments.

We previously blogged about Commerce 2 Price Resolvers. Now, let's get into some of the details of payment gateways and taxes.

This post is going to be more high-level, less code, because there are some critical concepts that are fundamental to how Commerce 2 currently works that site owners need to understand.

Onsite Payment Gateways always store credit card info

Payment gateways have different capabilities. Some support storing a user's card in the gateway. Others have an "offsite" flow, sending you to their site to collect card info and then returning you back to the commerce site when done.

An "Onsite" payment gateway is one that keeps the visitor on the site, collects the card numbers and posts it from the site to the gateway. In Drupal Commerce 2, the payment flow for onsite gateways is completely different than in Commerce 1, Ubercart, or many other shopping carts: it now stores the credit card in the gateway first, and creates a "Payment Method" associated with the user that contains the token from the gateway. It can then use that token for any future charges (as long as the gateway continues to honor it).

This is a fundamental change that makes recurring transactions and "card on file" functionality pretty much built into Commerce 2!

This means that the Commerce EPN Gateway module we created has full support for recurring functionality out of the box.

One other thing of note: Each gateway can declare its capabilities in its code, and Commerce then automatically exposes that functionality to the store admins. One thing that confused me slightly was "Voids" -- in most payment gateways, you can void a transaction up until the batch closes (which usually happens once per day). However, in Commerce 2, "Void" is used to cancel an authorization, not void a transaction. If you use "authorization only" transactions, and capture the payment after the order is fulfilled, then you can use Void to cancel the authorization (or Capture to process it).

The Tax system needs help to recognize taxable vs non-taxable products

Out of the box, the tax system is extremely smart about zones and tax registrations. You can define, per store, which taxes you need to collect, and Commerce will automatically charge tax to customers in a taxable zone. However there is no built-in distinction for taxable vs non-taxable products.

There are tax rules coming, but in the meantime if you have both taxable and non-taxable sales, you need a custom tax resolver to do the right thing. These are relatively easy to create. We borrowed heavily from another tax module the configuration settings that allow you to define on a tax type which product variation(s) it applies to.

One other gotcha we found while testing recurring payments -- if you use the "Include tax in product price" option, recurring billing adds the tax again each time the purchase recurs -- be sure to uncheck these boxes and keep the tax separate, and then it works fine.

If you're in Washington State and need to collect sales tax, this module works fine today -- check it out here. However note that it's not yet possible to create a tax report -- we do store the location data with each transaction, and will be sure to have this report available by April, when we need it!

 

Working with Drupal Commerce 2 is really refreshing. It feels like you're working on a robust, well-oiled system with a very nice user experience right out of the gate. It is still missing some bits and pieces around the edges, and customizing it does involve turning to code more quickly than previous versions, but overall we're finding it really straightforward to work with. Stay tuned for our coming sites, and if you need a Commerce site, reach out to us!

Topic

Add new comment

The content of this field is kept private and will not be shown publicly.

Filtered HTML

  • Web page addresses and email addresses turn into links automatically.
  • Allowed HTML tags: <a href hreflang> <em> <strong> <blockquote cite> <cite> <code> <ul type> <ol start type> <li> <dl> <dt> <dd> <h1> <h2 id> <h3 id> <h4 id> <h5 id> <p> <br> <img src alt height width>
  • Lines and paragraphs break automatically.

Drupal Canvas — Block HTML (locked)

  • Allowed HTML tags: <strong> <em> <u> <a href> <p> <br> <ul> <ol> <li>

Drupal Canvas — Inline HTML (locked)

  • Allowed HTML tags: <strong> <em> <u> <a href>

More Like This

Washington state map with tax symbol over Seattle skyline.
🕑Sep 19, 2025 🖋John Locke 💬0

Upcoming Sales Tax changes for Washington

Starting next month (October 2025), Washington businesses and residents will be paying sales tax on a slew of new services -- including custom web development, IT services, digital advertising, and even temporary workers.

New year
🕑Jan 15, 2018 🖋John Locke 💬0

New Year, New Website!

It's only taken two years since the release of Drupal 8 for us to get our own site updated... Cobbler's children and all. But finally, we are proud to unveil our shiny new site!

But wait, don't you tell your clients you don't need a new site?

Locks
🕑Jan 11, 2017 🖋John Locke 💬0

2017: The year of encryption

January 2017

Starting this month, Chrome users are going to start seeing a lot more sites flagged as insecure. Google is firmly on the technologist side of the encryption war, and it wants to make encryption something regular people care about. Why?
Not using encryption is like sending everything you visit/everything you do, scrawled upon postcards, with stops in all sorts of places, passing by people you would not want seeing everything.

Cryptography: the foundation of e-commerce


Money is the very definition of motivation for many criminals. At least in the movies... In real life, there are plenty of criminals looking for ways to drain money out of bank accounts, buy stuff on other people's credit cards, intercept bank transfers, and more.

Read More