Return URLs
Configure exact, safe browser destinations after checkout.
Configure these in Dashboard → Settings:
- Allowed redirect domains — hostname allowlist only (not full URLs). Exact hosts, comma-separated. Subdomains must each be listed.
- Success URL and Cancel / Return URL — full HTTPS page URLs whose hosts appear in that allowlist.
Production return URLs must use HTTPS. Wildcards are not supported. The configured URL must not contain user information or a fragment. Local development may use HTTP and explicit ports.
For v2 sessions, checkout appends sessionId and status. For v1 invoices, checkout appends two query parameters to both URLs: invoiceId and lowercase status. These reserved keys replace existing values; other merchant query parameters are preserved.
- Paid invoices navigate automatically to the success URL with
status=paid. - Other statuses use the cancel/return URL via “Return to store” (
pending,expired,cancelled, and rarelyunderpaid/overpaid).
Leaving a pending checkout does not cancel an on-chain transfer. Changes apply only to newly created invoices.
Redirects are untrusted browser input
Never grant goods, credits, or access because a browser reached the success URL. Verify PAID with a signed webhook and/or the authenticated invoice API.
For full redirect behavior and examples, see Success & Cancel Redirects.