Payment Stack Detector - Gateway, BNPL, Wallets & Fraud Tools

Find out how any online store takes payments. Give it a list of domains and get back, per store:

• Payment gateway / PSP - Stripe, Adyen, Checkout.com, Braintree, PayPal, Worldpay, Shopify Payments, Square, Mollie, Opayo, Cybersource, Authorize.net, Razorpay and more
• Buy now, pay later - Klarna, Clearpay/Afterpay, Affirm, PayPal Pay Later, Zip, Sezzle, Scalapay, Laybuy, Alma
• Wallets - Apple Pay, Google Pay, Shop Pay, Amazon Pay
• Subscription billing - Recharge, Skio, Ordergroove, Bold, Loop, Chargebee, Recurly, Paddle, Lemon Squeezy
• Fraud prevention - Signifyd, Riskified, Forter, Sift, Kount, ThreatMetrix, NoFraud, SEON, Fingerprint
• Platform - Shopify, WooCommerce, Magento/Adobe Commerce, Salesforce Commerce Cloud, BigCommerce, Wix, Squarespace and more
• Agentic checkout readiness - whether the store publishes a Universal Commerce Protocol (UCP) profile, its payment handlers, accepted card brands and MCP endpoint
• Sales signals - ready-made flags such as NO_BNPL_DETECTED, NO_FRAUD_TOOL_DETECTED, PAYPAL_ONLY_GATEWAY, MULTIPLE_GATEWAYS, SELLS_SUBSCRIPTIONS

Every detection comes with a confidence level and the evidence (the script URL, markup or public profile field it came from), so you can check it yourself.

Who uses it

• Payments sales teams (PSPs, BNPL providers, fraud vendors, ISOs, payfacs): build lists of stores using a competitor, or stores with no BNPL / no fraud tool.
• Agencies and consultants: audit a prospect's checkout before a pitch.
• Market researchers and investors: measure gateway and BNPL share across a segment.
• AI agents: call it as a tool to answer "how does this store take payments?"

How it works

1. Fetches the homepage, one product page and the cart page over plain HTTP.
2. Reads the store's public UCP profile at /.well-known/ucp (published for agentic checkout). For most Shopify stores this reveals the real gateway - e.g. Shopify Payments - which is otherwise hidden.
3. In auto mode, if no gateway or BNPL was found, opens the pages in a headless browser and records every network request, which catches payment SDKs that load with JavaScript.
4. Matches 70+ provider signatures (plus 30+ gateway IDs from Google Pay / UCP configs) and reports what it found, with evidence.

It only reads public pages, respects robots.txt by default, sends an identifying user agent, never logs in, never adds items to a cart and never submits a payment. It does not collect personal data.

Input

{
  "domains": ["allbirds.com", "www.huel.com", "www.notonthehighstreet.com"],
  "renderMode": "auto",
  "maxPagesPerDomain": 3
}

Field	Default	Notes
domains	-	Domains or full URLs, one per line
renderMode	auto	http = fastest, auto = browser only when needed, browser = always
maxPagesPerDomain	3	Homepage + product page + cart
checkUcpProfile	true	Read /.well-known/ucp
respectRobotsTxt	true	Skip pages disallowed for bots

Output (one item per domain)

{
  "domain": "www.kyliecosmetics.com",
  "platform": "Shopify",
  "paymentGateways": [
    { "name": "Shopify Payments", "confidence": "high", "evidence": ["UCP profile: Google Pay tokenization gateway \"shopify\""] }
  ],
  "bnpl": [{ "name": "Klarna", "confidence": "high" }, { "name": "Clearpay / Afterpay", "confidence": "high" }],
  "wallets": [{ "name": "Google Pay", "confidence": "high" }, { "name": "Shop Pay", "confidence": "high" }],
  "fraudTools": [{ "name": "Forter", "confidence": "medium" }],
  "agenticCommerce": {
    "ucpVersion": "2026-08-25",
    "paymentHandlers": ["com.google.pay", "dev.shopify.card", "dev.shopify.shop_pay"],
    "cardBrands": ["visa", "mastercard", "amex", "discover", "diners"]
  },
  "salesSignals": ["UCP_AGENTIC_CHECKOUT_ENABLED"]
}

Confidence: high = the provider's code or a machine-readable profile field was found; medium = provider-specific widget or an enabled payment method on the storefront; low = only a logo or label.

Pricing

Pay per event: $0.02 per domain analyzed ($20 per 1,000). You are not charged for domains that fail, time out or are blocked by bot protection.

Limits (read this)

• Some gateways only load on the checkout page, which the Actor does not open (that would need a cart and personal details). Those stores show GATEWAY_NOT_CONFIRMED.
• Sites with strong bot protection may block the Actor. They are reported with an error and not charged.
• "Not detected" means not seen on the pages checked, not proof that the store doesn't use it.
• Results reflect the pages as served to a US visitor at run time.

Disclaimer

This Actor is unofficial and is not affiliated with, endorsed by or sponsored by any of the companies named above. All trademarks belong to their owners. Use the results in line with applicable law and the target sites' terms.