What to show when hosted checkout sends someone back
Show the result from the checkout session or from the webhook your integration recorded, not from the fact that a browser opened a page. Stripe's success URL is where the buyer is sent after a successful payment or subscription creation. The cancel URL is where Checkout sends a buyer who uses the back button to cancel and return. Stripe also says a buyer can pay and never reach the success page. A session can be complete while payment is still processing, and payment_status unpaid means the funds are not yet available. The page copy has to follow those fields. Describe the work you need. Prism will confirm scope, responsibilities, fees, and terms before work begins.
For: An owner or authorized representative of a research-use-only peptide business whose site uses a hosted checkout page and a return or cancel address.
Updated 2026-09-21
The browser and the payment are different events
Hosted checkout sends the buyer to the provider's page and later may send the browser back. The return is navigation. The payment result is the session and the events the provider sends to the integration. This page is about that return. It is not the earlier choice of whether to use a hosted page.
Stripe Checkout, for a hosted page, has a success URL and a cancel URL. The success URL is where the customer is directed after the payment or subscription creation is successful. If a cancel URL is set, Checkout displays a back button and sends the customer there if they decide to cancel and return to the site. Those are two configured destinations. Opening one of them tells you which destination the browser loaded. It does not replace the session.
What each Stripe session state allows you to say
Retrieve the session, or read the event your integration stored, before you choose the sentence on the page. Stripe's session status open means the session is still in progress and payment processing has not started. complete means the session is complete and payment processing may still be in progress. expired means the session has expired and no further processing will occur.
payment_status is separate. paid means the payment funds are available in the account, aside from the zero-amount trial case Stripe describes. unpaid means the funds are not yet available. no_payment_required covers a setup-mode session or the no-proration billing case Stripe states. Stripe says you can use payment_status when deciding whether to fulfill the order.
Stripe's fulfillment guide says you cannot rely on triggering fulfillment only from the landing page, because the customer is not guaranteed to visit it. Its example is a customer who pays and then loses the connection before the page loads. For subscriptions and payment methods with a delayed success notification, Stripe says automatic fulfillment with webhooks is required because later state changes happen after the session completes. A success page that always says the payment succeeded will be wrong for a buyer who never reaches it, and it can also be wrong for a completed session whose payment_status is still unpaid.
Copy that matches the state you retrieved
If the browser loads the success URL and the retrieved session is paid, the page can say the payment funds are available, in Stripe's words, and point the buyer to the store order reference your integration saved. If the browser loads the success URL and payment_status is unpaid, or the session is complete while processing continues, say that the return happened and the payment is not finished. Do not say it succeeded.
If the browser loads the cancel URL, Stripe's description of that URL is a buyer who chose to cancel and return. Say the checkout was cancelled and the order is not paid, unless a retrieved session for that same attempt says otherwise. Do not show the success message on the cancel URL.
If the buyer does not come back, you have no browser event. Stripe's own example is a lost connection after a successful payment. The integration's webhook, not a hit on the success page, is what Stripe says should fulfill the order. The buyer-facing page cannot honestly describe a return that did not happen. The store order and the provider event are where that payment is recorded.
Closing the window is not defined by Stripe as a visit to the cancel URL. Unless you retrieved a session that expired or remained open, write that the return was not observed. Do not label it a cancellation only because the success page has no visit.
What you can change, and what you ask
You can decide whether each return page's sentence matches the session states above, and you can ask the integration owner which event creates the store order. You cannot treat a theme's thank-you page as the provider result.
The provider decides the session status and whether the funds are available. The integration has to retrieve the session or verify the webhook. Prism can discuss a return page that contradicts the provider record. Confirm any checkout implementation scope separately; the provider decides whether the account can process.
Another hosted checkout's return parameters are unknown until that provider's current document is read. Do not reuse Stripe's success_url and cancel_url names for it.
Return-page state map
Fill this from the checkout configuration and one real session if you have one. Write the sentence your site shows today, not the sentence you wish it showed. Worksheet entries are not submitted by this worksheet or saved by this site. Use only non-sensitive summaries; do not enter credentials, government identifiers, card or bank-account numbers, private receipt links, or customer details.
Worksheet entries are not submitted by Prism’s worksheet and are not saved by the site. Use record types, availability, anonymized observations, or match/mismatch results. Do not enter government identifiers, customer names or addresses, customer messages, receipt-access links, card or bank details, passwords, or keys. Send sensitive documents only through the provider’s verified secure channel.
Return-page state map. The last column is for temporary notes.
What you observed
What Stripe says that observation means
Message that stays inside that meaning
The sentence your site shows
Browser opened the success URL
What Stripe says that observation meansThat is the URL Stripe uses after a successful payment or subscription creation. Reaching it is not guaranteed, and the visit alone is not the fulfillment record.
Message that stays inside that meaningSay the buyer returned. Confirm paid, unpaid, or still processing from the session before saying the payment succeeded.
Browser opened the cancel URL
What Stripe says that observation meansStripe sends the buyer there from the back button when they cancel and return, if the URL is set.
Message that stays inside that meaningSay checkout was cancelled and do not show the success sentence, unless the retrieved session says the payment was paid.
No return was recorded
What Stripe says that observation meansStripe's example is a buyer who pays and loses the connection before the landing page loads. Closing the window is not documented as a cancel URL visit.
Message that stays inside that meaningDo not invent a success or a cancellation. Use the webhook or the session your server recorded.
Session status complete
What Stripe says that observation meansThe session is complete and payment processing may still be in progress.
Message that stays inside that meaningDo not shorten this to paid. Read payment_status.
payment_status paid
What Stripe says that observation meansStripe says the payment funds are available in the account, with the trial exception it documents.
Message that stays inside that meaningYou can say the funds are available and fulfill from the integration path Stripe requires, not from the page visit alone.
payment_status unpaid
What Stripe says that observation meansThe funds are not yet available.
Message that stays inside that meaningSay the payment is not finished. Do not fulfill from this status.
Session expired or still open
What Stripe says that observation meansExpired means no further processing will occur. Open means payment processing has not started.
Message that stays inside that meaningSay the checkout is no longer active, or that it is still in progress. Do not say it was paid.
These are temporary notes. Leaving or reloading this page may clear them. The consultation form does not include these entries.
Limits
A Prism consultation can help you organize the facts and discuss the website or processing question. The payment provider decides eligibility, pricing, reserves, and whether an account is opened or closed.
Return addresses and session fields on this page are Stripe Checkout's. Another hosted checkout needs that provider's current return document.
A corrected sentence on the site does not prove the webhook is registered or that the provider will approve the account.
Do not send card numbers, session secrets, or customer lists through the public consultation form.
Checkout Session object — checked 2026-09-21. success_url is the destination after a successful payment or subscription creation. cancel_url is the back-button destination when the buyer cancels. Session status and payment_status have the meanings used on this page, and payment_status can be used when deciding whether to fulfill.
Fulfill orders with Checkout — checked 2026-09-21. Fulfillment cannot rely only on the landing page, because the customer may pay and never reach it. Delayed payment methods need webhook fulfillment. When a webhook listens for checkout.session.completed and a success URL is set, Checkout waits up to 10 seconds for that server before redirecting. Stripe says that wait does not apply to organization webhook endpoints, and the CLI redirect is immediate.
Customize the success page — checked 2026-09-21. The success page can look up the session, and Stripe repeats that fulfillment cannot depend on the customer visiting that page.
Prism solutions — checked 2026-09-21. Prism can help with a provider's website questions. A website review does not establish processing eligibility.
Request a consultation
Describe the business and this specific question. Prism follows up by email to discuss fit and scope. An inquiry is not a processing application or an approval.