Shopify THC Payment Gateway Case Study:Authorize.Net & PCI Compliance

The Authorize.Net gateway was connected to Shopify using the merchant's API Login ID and Transaction Key from the AHG merchant portal. Shopify's third-party gateway setup requires these credentials to be entered in the Payment Providers section under Settings. The gateway was configured with the correct transaction mode (live, not sandbox) and tested with a small authorization to confirm end-to-end payment flow before the site went live to customers.

West Town Payments required PCI DSS compliance to be completed within 90 days of gateway approval via Security Metrics. The PCI compliance questionnaire (SAQ A for merchants using a hosted payment page) was completed, confirming that no cardholder data was stored, processed, or transmitted on the merchant's own servers, all payment data flows through Authorize.Net's hosted environment. Completing the SAQ A is a straightforward process for Shopify merchants using a third-party gateway, but it must be explicitly completed, non-completion results in monthly non-compliance fees from the processor.

The existing AVP age verification app was reconfigured from an 18+ popup to a 21+ gate specifically on Serenité collection and product pages. The compliance review with the processor confirmed that self-certification (user clicks "I am 21+") was acceptable at this stage, provided the disclaimer was clearly displayed and logged. The alternative, identity-based verification via AgeChecker.Net ($25/mo), was noted as an option if the processor's requirements changed or if the brand scaled into states with stricter verification requirements.

A complete end-to-end order flow test was conducted covering: product add to cart → age verification gate → checkout → Authorize.Net payment processing → order creation in Shopify → ShipHero fulfillment trigger → Klutch Cargo pick/pack notification → tracking number sync back to Shopify → customer notification email. Each step was verified to confirm that the payment gateway did not interrupt the downstream fulfillment flow.

Attempting to process THC product sales through Stripe, Square, or Shopify Payments results in account termination, often mid-transaction, leaving orders unfulfilled and customer data in limbo. Starting with a specialized processor (West Town / AHG) that understands and underwrites THC merchants eliminated this risk entirely. The underwriting process is more involved than a standard merchant account, but it's the only route to a stable, long-term payment solution for hemp-derived THC products.

Most Shopify merchants using a third-party gateway don't realize that PCI compliance is a contractual requirement with a 90-day deadline from approval. Missing the deadline results in monthly non-compliance fees charged by the processor. For Shopify merchants using a hosted payment page (SAQ A), completing the questionnaire takes less than an hour. Treating it as a priority task rather than a deferred administrative item saves real money.

Payment gateway integration can fail at multiple points outside of the payment step itself: the age gate can block users from reaching checkout; the ShipHero integration can fail to pick up orders created through a non-native gateway; tracking sync can break. Testing the full flow, not just "does the payment go through", prevented a series of post-launch fulfillment issues that would have created customer service problems at the worst possible time.