2026 · Reverse engineering
Squarespace Checkout Client
A headless checkout client for Squarespace stores. It skips the browser, replays checkout as seven HTTP requests, and finishes a full order in 2 to 5 seconds.
- Stack
- Node.js, plain HTTP, Stripe's API
- Requests
- Seven per order, no browser
- Speed
- 2 to 5 seconds, end to end
The log lines follow the client's own output. The store and product are samples, and the card is Stripe's test card.
Seven requests
In a browser, checkout is a few pages of forms and scripts. Underneath, it comes down to seven HTTP requests:
- Load any store page for the session cookies and the crumb, Squarespace's CSRF token.
- Add the item to the cart and keep the cart token.
- Load the checkout page and parse its bootstrap JSON for the store's Stripe key, the cart, and the shipping setup.
- Send the shipping address and get back the delivery options.
- Pick the cheapest rate.
- Create a Stripe PaymentMethod for the card.
- Submit the order.
Card details go straight to Stripe with the store's public key, the same way they do in a browser, so they never touch Squarespace's servers.
Finding the product
Add ?format=json to almost any Squarespace page and it returns structured data. The client uses that to scan a store's navigation, find the collections that sell things, and poll for a keyword until the product appears. It can run several checkouts in parallel from saved profiles.
Where it stops
Some checkouts need a real browser: cards that trigger 3D Secure, Apple Pay and Google Pay, PayPal, and the few stores that turn on reCAPTCHA. The client doesn't try to fake those.