How WooshPayment works

Checkout architecture, the roles of Shopify, Whop and WooshPayment, and the customer flow from cart to confirmed order.

WooshPayment replaces your store's standard checkout with a branded checkout at {slug}.wooshpayment.com (or checkout.yourstore.com if you map a custom domain), optimized for mobile conversion and Apple Pay.

Architecture in 30 seconds

Customer → "Checkout" on your store (Shopify/Woo)
              ↓ (ScriptTag intercepts the click)
WooshPayment checkout (slug.wooshpayment.com or checkout.yourstore.com)
              ↓ (Whop iframe for payment)
Whop → card / Apple Pay / Google Pay → authorization
              ↓ (HMAC-SHA256 signed webhook)
WooshPayment marks the session COMPLETED
              ↓ (Shopify/Woo API)
Order created on your store → standard fulfillment flow
              ↓
"Order confirmed" email sent by YOUR store (not by us)
Merchant notification email sent by us

Roles

Component	Role
Your store (Shopify/WooCommerce)	Catalog, inventory, fulfillment, customer emails, invoicing
WooshPayment	Checkout UX, branding, order sessions, redirect, analytics dashboard, order sync to your store
Whop	Cards, Apple Pay, Google Pay, anti-fraud, payouts to the merchant's account
Resend	Transactional emails to the merchant (verify, welcome, password reset, Apple Pay required)

Emails to the end customer (order confirmation, shipping, cart recovery) are sent by your store, not by us. See Transactional emails for the complete list of the ones we send (merchant-facing only).

Customer flow step by step

Customer opens your store, adds to cart
Click on "Checkout" → our ScriptTag intercepts and redirects to {slug}.wooshpayment.com/checkout/{token}
Sees your brand (logo, color, font) in mobile-first
Enters email + address + selects shipping + selects payment method
Pays inside the Whop iframe (3D-Secure when required) — optionally Cash on Delivery
Whop → WooshPayment webhook HMAC signed: marks the session COMPLETED
WooshPayment → Shopify/Woo: calls the Orders API, creates the real order with line items + payment_status paid
"Order confirmed" email to the customer is sent by your store (Shopify/Woo handles template and sender)
Merchant notification email is sent by us via Resend

Where the money goes

Whop deposits directly into the merchant's bank account. WooshPayment never touches the money. From the Whop dashboard you'll find:

Settlements: payouts to your IBAN (weekly by default, monthly on new accounts until Whop verifies)
Transaction history with detailed fees
Anti-fraud tools and dispute management

Current Whop fees: 5% + $0.30 per card transaction. WooshPayment is free while we're in beta. For the pricing roadmap see Plans and pricing.

Domains

Free subdomain: {slug}.wooshpayment.com, automatically generated from the store name at signup, automatic Vercel SSL
Custom domain: checkout.yourstore.com (see guide) — available to all merchants without plan gating

Security & compliance

PCI-DSS: handled by Whop (level 1). Cards NEVER pass through our servers: the Whop iframe sends them directly to them.
3D-Secure: enforced by Whop on risky transactions.
Anti-fraud: Whop computes a risk score; high-risk orders are flagged.
Encryption at rest: Whop API key, Shopify accessToken and Woo consumer secret are encrypted AES-256-GCM in our DB.
Rate limit: 10 login / 5 register per IP / 15 min. Signed JWT. bcrypt cost-12 passwords with timing-equalize anti-enumeration.
GDPR: we are data processor, you are data controller. See GDPR.

Who WooshPayment is for

WooshPayment serves dropshippers whose mainstream payment processor (Stripe, Shopify Payments, Airwallex, etc.) disabled or rejected their account. Typical cases:

Stripe account banned after a chargeback spike on a trending product
"Your application has been declined" email from Shopify Payments for a high-risk category
Mollie / Adyen / Airwallex onboarded, processed a few transactions and then closed the account
Brand new store that wants a high-risk-friendly processor from day 1 to avoid the 60-day ban risk

If you're NOT in those scenarios — premium DTC brand with Stripe active for years, low-risk products, marketplace or B2B — mainstream processors work fine for you and WooshPayment is not the right tool.

	WooshPayment	Stripe / Shopify Payments direct
Dropshipping high-risk accepted	Yes (via Whop)	No (systematic ban/reject)
Restart after ban	10 min — connect Whop and you're back	Impossible: a banned account stays banned
Onboarding / KYC	Whop accepts in 24h with EU/HK/UK flexibility	1-4 weeks + high-risk categories rejected
Custom domain + branded checkout	Yes	No (checkout under Stripe/Shopify domain)
WooCommerce supported	Yes	Stripe yes, Shopify Payments no
Typical transaction fee	5% + €0.30 (Whop)	2.9% + €0.30 (but you need an active account)