From add to cart to refund

Kestrel Supply sells office and workshop supplies to households and businesses across the US, from one warehouse in Ohio. Its old store takes cards only and charges one tax rate everywhere. Business buyers want to pay by purchase order and check, visitors from China ask for Alipay, and the accountant has a question about sales tax in other states. This is how we would build the new cart and checkout, one decision at a time.

Before any screen is drawn, we agree on the states an order can be in and the moves between them. Cards pass straight through; checks, bank debits and purchase orders wait for payment; a shortage sends the order to backorder; every path can end in a cancellation or a return.

• Money in whole cents. Store $19.99 as 1999, never as a floating-point number, so totals never drift by a cent.
• A cart is not an order. Carts are cheap and get abandoned. Guests get a cart tied to a cookie; when they sign in, the two carts merge.
• Show the price, re-check it at checkout. If a price changed while the item sat in the cart, say so before payment, not after.
• Freeze the order. At checkout, copy each price, tax amount and the ship-to address onto the order. A placed order is never recalculated from today’s catalog.
• Limits belong on the server. Maximum quantity, minimum order and who may buy on account are checked by the API, whatever the browser sends.

The FTC’s Mail, Internet, or Telephone Order Merchandise Rule says you must have a reasonable basis to ship when you say, or within 30 days if you say nothing (50 days when the buyer applies for credit with you to pay). If you can’t, you must tell the customer the new date and let them agree to the delay or cancel. If they cancel, refund within seven working days, or within one billing cycle when you extended the credit yourself.

Since March 31, 2025, an online store that sends all card data to a provider’s hosted fields or payment page validates with the January 2025 version of SAQ A, which adds one condition: the merchant confirms its site isn’t open to script attacks that could affect its e-commerce systems. In practice that means our strict Content Security Policy and no third-party scripts on the checkout page.

Hackers go where the card numbers are. If they never reach Kestrel’s website or server, a break-in yields order history and addresses, not cards. There are three ways to take a card, and we recommend the first: send the customer to the payment provider’s own page, the way PayPal and Alipay already work, and bring them back to a thank-you page when it’s paid.

• What we store: the provider’s payment ID, the card brand, the last four digits and the expiry date. Enough for receipts, support calls and refunds.
• What we never store: the full card number or the security code. Saved cards for repeat buyers live in the provider’s vault, behind a token.
• Refunds still work: a return or cancellation refunds by payment ID through the provider’s API. Nobody needs the card again.
• The order is paid when the provider says so: by a signed webhook, never because the customer landed on the thank-you page.

Per Stripe’s integration security guide, a business that handles card numbers itself may have to meet more than 300 PCI DSS security controls, while the card brand, last four digits and expiry date that come back from a payment are outside PCI scope and safe to store.

In South Dakota v. Wayfair (June 21, 2018, 5–4), the Supreme Court overruled the old physical-presence rule. A state may now require a seller with no office or warehouse there to collect its sales tax. South Dakota’s law, which the Court upheld, covered sellers with more than $100,000 of sales or 200 separate transactions into the state a year. Each state sets its own threshold: California’s is $500,000 of sales of goods a year.

The rate isn’t one number per state. It stacks state, county, city and special district, and what is taxable changes too: some states tax shipping, some don’t; clothing, food and services each have their own rules. Business buyers who resell what they buy, and many nonprofits, give you an exemption certificate instead of paying tax, and you keep it on file in case of an audit. Orders placed through a marketplace are usually taxed by the marketplace, not by you.

Rounding each line gives $24.32; rounding the whole invoice ($324.10 × 7.5% = $24.3075) gives $24.31. Pick the method your states allow, use it everywhere, and store the tax per line and per jurisdiction: returns and tax filings both need it.

One payment provider can carry cards, wallets and foreign methods behind a single integration: per Stripe’s documentation, Alipay works for Stripe accounts in the US and many other countries, and customers see the amount in Chinese yuan. We turn on only the methods Kestrel’s customers actually ask for: every method is another refund path to test. PayPal Checkout is added on its own, with its own button and webhooks.

• Before it ships. Cancel at once. A card that was only authorized is voided: no charge, no refund to wait for. Stock goes back on the shelf.
• After it ships. The customer asks for a return; we email a label and a return number (RMA), so the warehouse knows what is coming.
• When it arrives. Inspect it. Resellable items go back into stock; damaged ones go to a vendor claim or a write-off.
• The refund. Back to the original payment method, including the sales tax charged on the returned items. Shipping and restocking fees follow the written policy.
• When we cancel. If we can’t ship, the refund is real money: under the FTC rule, store credit can’t replace it.

1. Every payment call carries an idempotency key. A double click, a retry or a dropped connection charges the customer once.

2. Trust webhooks, not the browser. The payment provider tells our server when money is captured, refunded or disputed; a closed tab changes nothing.

3. Keep card numbers off your servers. Send customers to the provider’s payment page, or use its card fields: nothing to steal, and the shortest PCI self-assessment (SAQ A).

4. Let a tax engine do the rates. Thousands of local rates change through the year. We keep the rules for nexus, exemptions and what we sell; the engine keeps the rates.

5. Write the policy before the code. Return window, restocking fee, who pays return shipping, how cancellations work. The code follows the page the customer reads.

6. Test the unhappy paths. A declined card, a webhook that arrives twice, stock that vanishes mid-checkout, half an order returned.