Open checkout terms and privacy links

Follow this guide to use optional configured links with safe new-tab behaviour. The guide then takes you through the correct route, the checks to complete before making changes, the workflow in order, and the evidence to review afterwards.

What you’ll accomplish

Use optional configured links with safe new-tab behaviour. This section documents identity fields, payment choices, mandatory terms, rate limiting, order tokens, native invoices and branded email.

Follow these steps

1. Go to /shop/checkout and open the workflow that matches “Open checkout terms and privacy links”. Confirm the page or record context before making a change.
2. Check the cart.
3. Go to Checkout.
4. Sign in when guest checkout is disabled or native invoice payment is required.
5. Complete name, email, phone, shipping address and notes.
6. Select an available payment method.
7. Accept terms and place the order once.
8. Use the public order page and, for native invoice checkout, the secure host invoice payment URL.

Fields and options to review

• Guide focus: Use optional configured links with safe new-tab behaviour.
• Name, email, phone, shipping address and notes
• native_invoice, bank_transfer or cash_on_delivery
• Mandatory terms acceptance
• Checkout idempotency key
• Client/contact IDs for signed-in users
• Public order reference and token
• Invoice ID and payment URL
• Email templates and internal recipient

Rules the system enforces

• Checkout is limited to 20 attempts per hour per IP.
• Name and valid email are required.
• Terms acceptance is always required.
• native_invoice is available only to an eligible signed-in client when enabled and host payment modes exist.
• Guest users can use bank transfer or cash on delivery when guest checkout is enabled.
• Order token is stored as a hash.

How to confirm it worked

• The specific outcome described by this guide is visible and remains tenant-scoped.
• One public order is committed and shown through its tokenised URL.
• Eligible native-invoice orders have an invoice/payment URL.
• Enabled email notifications are sent through the host mail system.

Safety checks and troubleshooting

• Do not expose token hashes or reuse public links in public logs.
• Do not enter payment-card data into notes or bank fields.
• Check the existing order before resubmitting after a network interruption.

Continue with related guidance