Kyvero has released an OpenCart extension that adds gift-card balance checks, expiry controls and a report of unspent voucher obligations. Its changelog dates the initial release to September 20 [S01], followed by reporting and integration updates through October 3.
The extension works with OpenCart’s existing gift vouchers. Holders can check a balance and spending history using the card code and recipient email address, without creating a customer account. Merchants get card balances on the order screen and an outstanding-liability report.
The current settings documentation, checked on October 18, specifies two simultaneous limits for that public balance page: 10 attempts from one source address and five attempts against one card in a 15-minute window. Either limit can cause a refusal. These are documented control parameters, not observed attack counts or evidence of fraud reduction. Kyvero also warns that a proxy which does not pass on visitor addresses can cause legitimate holders to share the same source-address allowance. [S03][S04]
Documented balance-lookup attempt limits
Current Kyvero documentation, October 18, 2026. Both fixed limits apply simultaneously over a 15-minute window.
Attempts per 15-minute window
Tap or hover for details. All values are also available in the data table.
Source
Different grouping keys for two simultaneous controls, not alternative service plans or measured fraud outcomes. A shared proxy address can aggregate requests from multiple legitimate cardholders. These are current documented limits, not independently tested launch-day performance.
Show data tableHide data table
| Category | Attempts per 15-minute window |
|---|---|
| Per server-seen source address | 10 Attempts per 15-minute window |
| Per gift card | 5 Attempts per 15-minute window |
Kyvero’s product documentation [S02] says changing the configured validity period does not retroactively move dates already assigned to cards. Expired balances remain visible and included in the amount reported as owed, rather than disappearing from the report when redemption stops.
The September 29 update added expiry dates to supported voucher emails, suggested dates for manually issued cards and filtered CSV exports. An October 2 release introduced a read-only API for balances, expiry and reporting classifications. It excludes redemption codes and sender or recipient details, and starts disabled.
An October 3 fix keeps expiry enforcement active when the module’s storefront display is switched off, including after an update. Removing the extension still removes that enforcement.
Compatibility remains narrow: the module targets OpenCart 4.0.2.x and refuses installation on 4.1 or later. Its published limitations [S03] also state that refunds do not automatically void cards. The liability total covers the whole installation at the current time, without historical-date or individual-store breakdowns.
In this article
Daniel Brooks
Daniel Brooks covers payment networks, financial technology, payment security, gift card fraud and PCI DSS for Gift Card News.