# Payment Stack Detector - Gateway, BNPL, Wallets & Fraud Tools (`tomwang/payment-stack-detector`) Actor

Find out how any online store takes payments: gateway (Stripe, Adyen, Shopify Payments, Braintree...), BNPL (Klarna, Clearpay, Affirm), wallets, subscription billing, fraud tools and agentic-checkout (UCP) readiness. Unofficial; not affiliated with any provider named.

- **URL**: https://apify.com/tomwang/payment-stack-detector.md
- **Developed by:** [Tom](https://apify.com/tomwang) (community)
- **Categories:** E-commerce, Lead generation, Developer tools
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$20.00 / 1,000 domain analyzeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Payment Stack Detector - Gateway, BNPL, Wallets & Fraud Tools

Find out how any online store takes payments. Give it a list of domains and get back, per store:

- **Payment gateway / PSP** - Stripe, Adyen, Checkout.com, Braintree, PayPal, Worldpay, Shopify Payments, Square, Mollie, Opayo, Cybersource, Authorize.net, Razorpay and more
- **Buy now, pay later** - Klarna, Clearpay/Afterpay, Affirm, PayPal Pay Later, Zip, Sezzle, Scalapay, Laybuy, Alma
- **Wallets** - Apple Pay, Google Pay, Shop Pay, Amazon Pay
- **Subscription billing** - Recharge, Skio, Ordergroove, Bold, Loop, Chargebee, Recurly, Paddle, Lemon Squeezy
- **Fraud prevention** - Signifyd, Riskified, Forter, Sift, Kount, ThreatMetrix, NoFraud, SEON, Fingerprint
- **Platform** - Shopify, WooCommerce, Magento/Adobe Commerce, Salesforce Commerce Cloud, BigCommerce, Wix, Squarespace and more
- **Agentic checkout readiness** - whether the store publishes a Universal Commerce Protocol (UCP) profile, its payment handlers, accepted card brands and MCP endpoint
- **Sales signals** - ready-made flags such as `NO_BNPL_DETECTED`, `NO_FRAUD_TOOL_DETECTED`, `PAYPAL_ONLY_GATEWAY`, `MULTIPLE_GATEWAYS`, `SELLS_SUBSCRIPTIONS`

Every detection comes with a **confidence level** and the **evidence** (the script URL, markup or public profile field it came from), so you can check it yourself.

### Who uses it

- **Payments sales teams** (PSPs, BNPL providers, fraud vendors, ISOs, payfacs): build lists of stores using a competitor, or stores with no BNPL / no fraud tool.
- **Agencies and consultants**: audit a prospect's checkout before a pitch.
- **Market researchers and investors**: measure gateway and BNPL share across a segment.
- **AI agents**: call it as a tool to answer "how does this store take payments?"

### How it works

1. Fetches the homepage, one product page and the cart page over plain HTTP.
2. Reads the store's public UCP profile at `/.well-known/ucp` (published for agentic checkout). For most Shopify stores this reveals the real gateway - e.g. Shopify Payments - which is otherwise hidden.
3. In `auto` mode, if no gateway or BNPL was found, opens the pages in a headless browser and records every network request, which catches payment SDKs that load with JavaScript.
4. Matches 70+ provider signatures (plus 30+ gateway IDs from Google Pay / UCP configs) and reports what it found, with evidence.

It only reads public pages, respects `robots.txt` by default, sends an identifying user agent, never logs in, never adds items to a cart and never submits a payment. It does not collect personal data.

### Input

```json
{
  "domains": ["allbirds.com", "www.huel.com", "www.notonthehighstreet.com"],
  "renderMode": "auto",
  "maxPagesPerDomain": 3
}
```

| Field | Default | Notes |
|---|---|---|
| `domains` | - | Domains or full URLs, one per line |
| `renderMode` | `auto` | `http` = fastest, `auto` = browser only when needed, `browser` = always |
| `maxPagesPerDomain` | 3 | Homepage + product page + cart |
| `checkUcpProfile` | true | Read `/.well-known/ucp` |
| `respectRobotsTxt` | true | Skip pages disallowed for bots |

### Output (one item per domain)

```json
{
  "domain": "www.kyliecosmetics.com",
  "platform": "Shopify",
  "paymentGateways": [
    { "name": "Shopify Payments", "confidence": "high", "evidence": ["UCP profile: Google Pay tokenization gateway \"shopify\""] }
  ],
  "bnpl": [{ "name": "Klarna", "confidence": "high" }, { "name": "Clearpay / Afterpay", "confidence": "high" }],
  "wallets": [{ "name": "Google Pay", "confidence": "high" }, { "name": "Shop Pay", "confidence": "high" }],
  "fraudTools": [{ "name": "Forter", "confidence": "medium" }],
  "agenticCommerce": {
    "ucpVersion": "2026-08-25",
    "paymentHandlers": ["com.google.pay", "dev.shopify.card", "dev.shopify.shop_pay"],
    "cardBrands": ["visa", "mastercard", "amex", "discover", "diners"]
  },
  "salesSignals": ["UCP_AGENTIC_CHECKOUT_ENABLED"]
}
```

Confidence: **high** = the provider's code or a machine-readable profile field was found; **medium** = provider-specific widget or an enabled payment method on the storefront; **low** = only a logo or label.

### Pricing

Pay per event: **$0.02 per domain analyzed** ($20 per 1,000). You are **not charged** for domains that fail, time out or are blocked by bot protection.

### Limits (read this)

- Some gateways only load on the checkout page, which the Actor does not open (that would need a cart and personal details). Those stores show `GATEWAY_NOT_CONFIRMED`.
- Sites with strong bot protection may block the Actor. They are reported with an error and not charged.
- "Not detected" means not seen on the pages checked, not proof that the store doesn't use it.
- Results reflect the pages as served to a US visitor at run time.

### Disclaimer

This Actor is unofficial and is not affiliated with, endorsed by or sponsored by any of the companies named above. All trademarks belong to their owners. Use the results in line with applicable law and the target sites' terms.

# Actor input Schema

## `domains` (type: `array`):

One store per line, e.g. allbirds.com or https://www.huel.com

## `renderMode` (type: `string`):

Auto uses plain HTTP first and only opens a headless browser when no gateway or BNPL was found.

## `maxPagesPerDomain` (type: `integer`):

Homepage + one product page + cart. BNPL widgets usually live on product pages.

## `checkUcpProfile` (type: `boolean`):

Stores that support agentic checkout publish their payment handlers here. Reveals the gateway for most Shopify stores.

## `respectRobotsTxt` (type: `boolean`):

Skip pages the site asks bots not to fetch.

## `concurrency` (type: `integer`):

Parallel domains

## `requestTimeoutSecs` (type: `integer`):

Request timeout (seconds)

## Actor input object example

```json
{
  "domains": [
    "allbirds.com",
    "www.huel.com",
    "www.notonthehighstreet.com"
  ],
  "renderMode": "auto",
  "maxPagesPerDomain": 3,
  "checkUcpProfile": true,
  "respectRobotsTxt": true,
  "concurrency": 5,
  "requestTimeoutSecs": 20
}
```

# Actor output Schema

## `results` (type: `string`):

Default dataset: one item per analyzed domain (gateways, BNPL, wallets, subscription billing, fraud tools, UCP readiness, evidence).

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "allbirds.com",
        "www.huel.com",
        "www.notonthehighstreet.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("tomwang/payment-stack-detector").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "allbirds.com",
        "www.huel.com",
        "www.notonthehighstreet.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("tomwang/payment-stack-detector").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "allbirds.com",
    "www.huel.com",
    "www.notonthehighstreet.com"
  ]
}' |
apify call tomwang/payment-stack-detector --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,tomwang/payment-stack-detector"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/BE7gcgmrPu9sm4pxh/builds/8PuCYhlaIzNeRaHPH/openapi.json