Build a credit card payments extension with UI extensibility

In this tutorial, you'll learn how to do the following tasks:

• Create a Checkout UI extension
• Create a credit card payments extension with extensibility
• Explore the payment, refund, void, reject and capture session flows, and how to implement them yourself
• Submit your payments extension for review

• Install Shopify CLI
• Create a Shopify Partner account and apply to become a payments partner
• Create a development store
• Create an encryption certificate

To build an extensible credit card payments extension, you will need to create a new credit card app or use an existing credit card app with extensibility features turned on by Shopify.

If you opt to create a new app, begin by using the Shopify CLI to set up your app. As a first step, we recommend deploying a skeleton app to establish a base for customization.

After creating your app, generate a Checkout UI extension and deploy your app to Shopify. This extension will be used to collect additional information that's required to process a payment.

1. Use the Shopify CLI to scaffold a Checkout UI extension for your app.
2. Name your extension and choose to work in TypeScript React.

1. After you generate the extension, deploy your app to Shopify Partners. This will allow you to link the Checkout UI extension with your payments app extension in the next section.
2. Navigate to your app in Shopify Partners (Apps > Your App).

Your Shopify app becomes a payments app after you've created and configured your payments extension.

1. Run the following command to start generating your payments extension:

2. When prompted, choose your organization and create a new app.

3. When prompted for Type of extension, select Payments App Extension > Credit Card and name your extension.

Configuration of an extensible credit card payments app extension is similar to a Credit Card payments app extension.

Your payments app extension configures the following fields:

The UI extension generated in Create a Checkout UI extension will determine what fields, validation, and form submission behavior is presented to buyers during checkout.

This is where you link the checkout extension you previously built with your new payment app extension to tie them together.

Specify the fields your UI extensions should collect to ensure the payment method validates and receives the correct data from the front end.

After you've configured your payments extension, you have to submit it for review in order to test or use your extension. You can use this same process to submit new versions of your payments extension. Any changes that are made after publishing need to be approved by Shopify as a new version of the payments extension.

To submit your extension for review, you first need to create an app version.

1. From the Partner Dashboard, go to Apps.

2. Select your app from the list.

3. Click Versions.

4. From the Versions page, click Create version.

5. Optional: enter a name and message for the version.

6. Click Create version.

Follow these steps to submit your app version for review:

1. From the Partner Dashboard, go to Apps.

2. Select your app from the list.

3. Click Versions.

4. Select the version that you want to submit for review.

5. Click Submit for review.

After Shopify has reviewed and approved the app version you can release it to merchants.

1. From the Partner Dashboard, go to Apps.

2. Click Release to release the new app version to users.

Once this version has been released, follow these steps to install your app on your development store:

1. From the app splash page, enter an account name.

2. Select Ready > Unstable and click Submit.

3. In the banner, click Return to Shopify.

4. Enable test mode.

5. Click Activate.

6. You can select Resolve to complete the payment, or Reject to cancel and go back.

The payments app functions similarly to the credit card payment method, allowing you to gather additional information from the buyer at the outset to facilitate payment processing. The primary distinction is that Checkout UI extension data is included in the start_payment_session body.

Outlined below is a comprehensive diagram depicting the potential flow for processing an extensible credit card payment. It's important to note that the pending state is optional; you can directly proceed to either resolve or reject the payment if there is no need to place it in a pending state. For further details on processing credit card payments, please refer to this resource.

Once we start the payment session with your payments app, that initiation will also contain the metadata in a shape similar to what was specified within the field definitions. A sample payment session payload of what is to be expected can be seen below.

Payments with payments apps are processed asynchronously. When the buyer completes their checkout, a request will be sent from Shopify to the Payment session URL defined in Configure your payments app extension, with the checkout and payment details. The Payments app should respond with HTTP 2xx to indicate that the payment session was started, and should begin processing the extensible credit card payment at this point.

The new metadata we are passing through payment session would be contained within the payment_method request parameters under attributes:

For certain countries that require additional fields on orders, localized_fields are included in the payload inside the transaction_metadata object. In the case of Brazil, localized_fields contains the CPF value. As a result of this, payment app developers won't need to manually add a CPF field to the payments app.

After the payments app has responded to the initial start payment session request, it should begin processing the payment. Since this is an asynchronous process, the payments app will be performing the next step independently, through the paymentSessionResolve mutation on the Payments Apps GraphQL API. This mutation will resolve the payment session, indicating that the payment was successful.

After this, the payment will be marked as resolved in Shopify.

If a payment was unsuccessful for any reason, then payments app must use the paymentSessionReject mutation.

This section describes the reasons you can use to reject a payment session.

The refund flow begins with an HTTP POST request sent from Shopify to the payments app's refund session URL. Shopify must receive an HTTP 201 (Created) response for the refund session creation to be successful. For more information about refund sessions and how to reject or resolve refund sessions, refer to Explore refund sessions.

Example request body:

After the app has successfully processed the refund request, it's resolved by using the refundSessionResolve mutation. The id argument corresponds to the gid of the refund.

Example GraphQL mutation:

After this, the refund will be marked as resolved in Shopify.

If the app can't process a refund, then it needs to reject it. You should only reject a refund in the case of final and irrecoverable errors. Otherwise, you can attempt to process the refund again.

The refund is rejected using the refundSessionReject mutation.

As part of the rejection, a reason why the refund was rejected must be included as part of RefundSessionRejectionReasonInput.

A capture can only be performed when the payment initiated by Shopify has a kind property with a value of authorization. With an authorization, the app places a hold on funds and then replies to Shopify's capture request.

The capture flow begins with an HTTP POST request sent from Shopify to the payments app's capture session URL. You can read more about capture sessions and how to reject or resolve capture sessions here.

Example request body:

After the app has successfully processed the capture request from Shopify, it's resolved using the captureSessionResolve mutation on the Payments Apps GraphQL API.

Example GraphQL mutation:

After this, the capture will be marked as resolved in Shopify.

If you don't want to process a capture request, then you should reject it. You might want to reject a capture if authorization has expired or if you suspect that the request is fraudulent or high risk. You should only reject a capture in the case of final and irrecoverable errors. Otherwise, you should re-attempt to resolve the capture.

The app rejects a capture using the captureSessionReject mutation.

As part of the rejection, you need to include a reason why the capture was rejected as part of CaptureSessionRejectionReasonInput.

Example GraphQL mutation:

A void can only be performed when the payment initiated by Shopify has a kind property with a value of authorization.

The void flow begins with an HTTP POST request sent from Shopify to the payments app's void session URL. You can read more about void sessions and how to reject or resolve void sessions here.

Example request body:

After the app has successfully processed the void request, it is resolved using the voidSessionResolve mutation on the Payments Apps GraphQL API.

Example GraphQL mutation:

After this, the void will be marked as resolved in Shopify.

If your app can't process a void request, then you should reject it. You should only reject a void in the case of final and irrecoverable errors. Otherwise, you can attempt to resolve the void again.

You can reject a void using the voidSessionReject mutation. As part of the rejection, you need to include a reason why the void was rejected as part of VoidSessionRejectionReasonInput.

Example GraphQL mutation:

Here is a sample of what a Checkout UI extension could look like for a Credit Card payments app with extensibility (this would be within your Checkout.tsx file of your Checkout UI extension):

As part of the extensibility features, we have exposed the BIN number entered by buyers to the Checkout UI extension in order for the extension to be able to make decisions on what to display based on this number. To get the BIN number entered for the credit card on checkout the following code can be used:

As we are still building some features. There are currently some limitations within the system that we're still working on. They are as follows:

• App deployments from the partners UI dashboard only pickup Checkout UI extensions if they have previously been deployed & released. If you want to use the partner dashboard UI to deploy new versions of your app. Make sure you have previously deployed & released the corresponding Checkout UI extension from the CLI first.

• Payments extensions using Checkout UI extensions should not request scopes enabling network access. This will result in the extension being rejected during review. Instead of fetching data using an external network call, consider storing the data using Metafields for your app & accessing the same later.

• Companion app:

  • If access to order data is needed for any reason, a companion app may be used to request and gain access to the data from the merchant by requesting read_all_orders scope for that app. The only scopes that payments app extension should not request for are write_checkout_extension_payments and write_payment_sessions.
  • If the companion app is using web pixels, you will need to request access to the consent feature to ensure that the pixel fires consistently. Please ask partner manager to get you the access.

Congratulations! You set up a credit card payments extension with UI extensibility.