Checkout FAQs

What is Checkout?

Checkout is a suite of online payment integration options. It gives merchants two ways to accept card payments: a fully hosted checkout page they redirect customers to, or secure card fields they embed directly into their own checkout form. Both are backed by the same integration foundation, so merchants can start with one and switch to the other without rebuilding their back-end.

Who is Checkout for?

Any merchant accepting card payments online. Checkout Redirect suits teams that want to launch quickly without building a payment UI. Custom Components suit merchants who want full control over their checkout design but need Shift4 to handle PCI-safe card data capture.

What are the two integration paths?

• Checkout Redirect: Your customer is redirected to a secure, Shift4-hosted payment page. You create a checkout session on your server and send the customer to the URL in the response. Shift4 handles the UI, authentication, card processing, and payment confirmation.
• Custom Components: You build your own checkout form and embed Shift4's card input fields (card number, expiry, CVV) inside it. Your design, your layout — Shift4 secures the card data and processes the payment. To initiate a payment process, you create a checkout session and use it to power your form.

Do I need to rebuild my integration if I switch from Checkout Redirect to Custom Components, or vice versa?

No. Both integration paths use the same back-end call to create a checkout session. Switching is a front-end change only — your server-side code stays the same.

Which payment methods are supported?

Checkout supports cards and digital wallets (Apple Pay, Google Pay). Alternative and local methods, such as BLIK in Poland, iDEAL in the Netherlands, and others, may be considered based on business needs. Checkout will automatically surface the most relevant options based on the customer's location and configuration.

I know I have full control over branding in Custom Components, but can I also brand Checkout Redirect?

Yes. In the Customer Hub, you can customize several settings for the hosted payment page: logo, page title and subtitle, background color, button color, font, wallet visibility (enable/disable), and your business's terms and conditions. No redeployment necessary.

What's the difference between integrating via Checkout Session API and using Payment Links? 

They serve different use cases. Checkout Redirect and Custom Components are used as elements of the payment flow embedded on your own website — the session is short-lived, and the customer is expected to move directly from your cart into it and complete payment immediately. Payment Links, by contrast, are designed to live independently of any on-site payment flow: a single link can be reused multiple times, and can remain active indefinitely. Payment Links can also be shared directly with customers via email, SMS, or QR code.

How does Checkout handle 3D Secure and strong customer authentication? 

Automatically. Checkout analyzes each transaction and handles any required authentication challenge inline — the 3DS step is presented to the customer directly within the checkout flow without any additional developer logic. SCA and PSD2 compliance requirements are built in.

Does Checkout offer any anti-fraud protections? 

Yes. As part of the broader Platform4 initiative, Shift4 is building Shift4 Defense — a unified, gateway-agnostic fraud and decisioning service. Shift4 Defense and Checkout are two of several components within Platform4, and Shift4 Defense will be fully integrated into Checkout, providing merchants with centralized, real-time scoring, dynamic 3DS orchestration, and self-service rule authoring through Customer Hub. While Shift4 Defense is still under development, every merchant is protected by a default set of fraud rules — so protection is in place from day one, but merchants can't yet fine-tune these rules themselves and will need to reach out to support for any adjustments. This will change once Shift4 Defense is ready for merchant-facing use.

What does Checkout take off my PCI compliance plate? 

Checkout is SAQ-A compliant by design. Card numbers, CVV, and expiry data never pass through your servers or code. For Checkout Redirect, Shift4 handles the entire payment page. For Custom Components, the card inputs are isolated components that capture data securely within Shift4's environment — not yours.

Can I add, enable, or disable wallets without redeploying my code?

 For Checkout Redirect, yes — enabling a wallet is a configuration change within Customer Hub, and it appears automatically on the checkout page with no code changes or redeployment required. For Custom Components, enabling a wallet requires a small amount of frontend code. Additionally, enabling Apple Pay requires registering your domain. In both integration paths, you can enable both wallets or only one, depending on your preference.

Are there other integration options coming for Checkout?

Yes. Checkout is expanding to include additional integration paths. These will give merchants more flexibility in how they present the payment experience without requiring a full page redirect. These integration paths are on the roadmap and are not yet available for release. Contact your Shift4 representative for the latest on timing.