The Shift4 Marketplace API enables third-party integrations to seamlessly connect with the Shift4 ecosystem. Build applications that can be discovered and installed by merchants, manage location data, implement custom onboarding experiences, and receive real-time notifications about installation lifecycle events.

Getting started

To integrate with the Shift4 Marketplace, you'll need to register your application and choose an installation flow that fits your use case. The Marketplace API supports multiple authentication methods including OAuth 2.0 for merchant authorization, HMAC-SHA256 for webhook security, and Bearer token authentication for API requests. All data exchanges occur in JSON format.

Key features

Locations

Access comprehensive restaurant location data including merchant IDs, timezone information, country codes, currency settings, and brand references. Location IDs are used across most API endpoints to scope operations to specific merchant locations.

Link Token Flow

Create custom onboarding experiences with the Link Token Flow. When merchants initiate installation, they're redirected to your application with a link token that provides access to merchant and location information, sales representative details, and dealer contacts. This enables you to build tailored onboarding flows and take immediate control after installation.

Installation Request Flow

Receive webhook notifications when merchants request to install your application. The Installation Request Flow provides comprehensive merchant data through a prefilled form, allowing you to retrieve installation details, manage onboarding states, and finalize installations through API callbacks.

Lighthouse Token Flow (OAuth 2.0)

Implement OAuth 2.0 authorization to allow merchants to grant your application permission to make API calls on their behalf. The Lighthouse Token Flow provides standard OAuth authorization code flow with access tokens (24-hour expiration) and refresh tokens for seamless re-authentication.

Subscriptions

Subscribe to real-time webhook events for installation lifecycle management. Receive notifications when apps are installed, uninstalled, or when installation requests are created or cancelled. All webhooks use HMAC signatures for security and payload validation.

Brands

Access brand information including names, logos, login URLs, and unique brand references. The Brands API helps you display brand-specific information during installation flows and ensures compatibility with SkyTab POS, the go-forward platform for new integrations.