// blog
A Shopping Cart Is Easy. Checkout Is Where the Law Lives.
Adding items to a cart is the easy part. A real checkout holds stock and tells customers the moment it runs out, as the FTC mail-order rule requires. It collects sales tax by the ship-to address in every state where you have nexus, which since South Dakota v. Wayfair (2018) includes states where you only sell. It takes each payment method on its own terms, from cards and PayPal to Alipay, ACH, checks and purchase orders. And it turns cancellations and returns into refunds to the original payment method. The company in the case study is fictional.
A case study in building a store’s cart and checkout, from the first click to the last refund.
Every developer has built a shopping cart in a weekend. A list of items, a quantity, a total. Done.
Then the real questions arrive. What if the last chair sells while someone is typing their card number? Do we owe sales tax in Texas when our only warehouse is in Ohio? A school district wants to pay with a purchase order. A visitor from Shanghai asks for Alipay. A customer wants to cancel, and the box has already left.
I built a case study around Kestrel Supply, a fictional supplier with exactly these questions, to show how we answer them.
Open the full case study, with the flowcharts →
Start with the order states
Before any screen gets drawn, agree on the states an order can be in: cart, checkout, placed, picking, shipped, delivered, plus awaiting payment, backordered, cancelled and returned. Every arrow between two states is one piece of code, one email and one test. Most checkout bugs I’m asked to fix are a missing arrow.
Out of stock is a legal question
Hold stock for a few minutes when checkout starts, commit it when payment is accepted, and say so the moment it runs out. When you oversell anyway, the FTC’s Mail, Internet, or Telephone Order Merchandise Rule applies. Ship when you said, or within 30 days if you said nothing. If you can’t, give the customer a new date and the choice to wait or cancel. If they cancel, refund within seven working days. Store credit doesn’t count.
Sales tax follows the customer
In South Dakota v. Wayfair (2018), the Supreme Court let states make out-of-state sellers collect their sales tax. South Dakota’s law covered sellers with more than $100,000 of sales or 200 transactions there a year. Every state sets its own threshold; California’s is $500,000. Rates stack state, county, city and district, and whether shipping or clothing is taxed changes from state to state. Business buyers who resell hand you an exemption certificate instead of paying tax.
My advice: let a tax engine keep the rates, keep the nexus and exemption rules yourself, and store the tax per line and per jurisdiction. You’ll need it for every return and every filing.
Six ways to pay, six different ship dates
| Method | When the box can ship |
|---|---|
| Visa, Mastercard, American Express, Discover | Authorize at order, capture when it ships |
| PayPal | Same: authorize now, capture later |
| Alipay | Charged at order (through Stripe); refund if you cancel |
| ACH bank debit | Once the debit settles |
| Paper check | Once it clears |
| Purchase order | Right away, on approved credit, invoice at net 30 |
Keep card numbers off your servers. Hackers go where the card numbers are. Our default is the payment provider’s own off-site payment page: the customer clicks Pay, pays on the provider’s page, and comes back to a thank-you page. The store keeps only a payment ID, the card brand and the last four digits, which is still enough to refund a return. A break-in then yields no cards, and the store can validate with the shortest PCI self-assessment, SAQ A. Handling card numbers yourself can mean more than 300 security controls. Put an idempotency key on every payment call so a double click charges once, and trust the provider’s webhooks, not the browser, for what was actually paid.
Cancel before it ships, return after
Before shipping, a card that was only authorized gets voided: no charge, no fee, no refund to wait for. After shipping, it’s a return: a label, a return number, an inspection, then a refund to the original payment method, including the tax on what came back.
The full case study has seven drawings: the order states, the data model, a sequence diagram of checkout, a chart of when each payment method’s money arrives, and flowcharts for stock, sales tax and returns. Read it here →
Building a store, or adding checkout to an existing site? Get in touch.
Kestrel Supply is fictional. This is how we build stores, not legal or tax advice.