Skip to main content

Set a redirect URL for default checkout flows

Set a redirect URL for default checkout flows

Last updated: 18-Jul-2024
Rate this article:


2Checkout supports the seamless transition of shoppers to a web page of your choosing following order completion. Shopper redirect will only happen after the order is placed successfully.


All 2Checkout accounts. 

Analytics tracking

2Checkout bypasses the Thank You page (finish.php) completely and no longer displays it to shoppers. If you use analytics code in finish.php be aware that it will no longer collect data.

AfterSale Messages

Please note that setting up a Redirect URL and effectively redirecting shoppers to a different webpage after they place an order cancels any AfterSale Messages that you might have set up. 2Checkout displays AfterSale Messages in the Thank You page, at the end of the purchase process, but the Redirect URL causes the process to bypass the Thank You page and sends shoppers directly to the web page of your choosing.

Instant Delivery in finish.php

By redirecting shoppers to a different webpage after they place an order effectively cancels Instant delivery (in the Thank you page).

Instant delivery takes place in the Thank you page, at the end of the purchase process, but Redirect URL causes the process to bypass the Thank You page altogether, and sends shoppers directly to the web page of your choosing.

Shopper redirects

2Checkout always redirects shoppers:

  • If they use an instantaneous payment method (including when they purchase paid trials).
  • When payment is not required (order value is 0).

2Checkout does not redirect shoppers when they:

  • Use an offline payment method such as bank/wire transfer.
  • When they order free trials.

Configure the Redirect URL

To configure the Redirect URL, make your way to the Setup area of the Control Panel.

  1. Click Generate Links under Setup, and select the Default flows tab. Alternatively, you can also hit the Get buy links for this product link under the Information tab, just to the right of the Product ID, when editing a product.
  2. Scroll down to the Advanced Options section and locate the Redirect URL field from the Additional options area. Enter the URL for the destination to which shoppers will be redirected once they finalize payments for orders they place through the 2Checkout system.
  3. Once you have entered all the desired details, scroll down to the bottom of the page and click the Generate link button. The Buy Link created will contain a &BACK_REF parameter just as in the example below. The URL following the &BACK_REF parameter is the same as the one entered under the Redirect URL field.

    While you can use the Control Panel to ease the introduction of the Redirect URL into Buy Links for your products, you can also enter it manually. Just introduce &BACK_REF= http%3A// into the Buy Link and replace YourCustomRedirectURL with the actual name of the custom web page where shoppers will be redirected.


In order to increase security and avoid BACK_REF tampering from 3rd party entities (security breaches), we added the possibility to include the parameter SECURE_CART
In order to obtain a more secure and hashed URL, the SECURE_CART parameter must be used and set to value ‘1’ ( SECURE_CART=1) along with the hashed value of the BACK_REF parameter, according to this documentation.
The new URL might look like: &SECURE_CART=1&PHASH=0d5e3ecfe95fd6560e117d1f18b7e7ea
  • The  2Checkout platform will perform this action by default for links generated in the Merchant Control Panel and will generate the PHASH value for you.
  • Parameter BACK_REF should be used in clear (raw, not coded) in the PHASH calculation (ex: &BACK_REF=, but should be encoded when adding it to the URL (ex: &
  • Parameter SECURE_CART should not be taken into consideration when calculating the PHASH.

Validate 2Checkout redirects

2Checkout generates the ctrl parameter automatically and adds it to Buy Links when you use BACK_REF.

ctrl is an HMAC (keyed-hash message authentication code) MD5/SHA code enabling you to validate that the redirect was generated by 2Checkout. The code is generated using the length of the characters of the redirect URL, concatenated with the redirect URL. 


STRING for HMAC_MD5/HMAC_SHA calculation


129 represents the length of the sequence of parameters.

Secret key for this example
Resulting ctrl parameter value*
3ffdce1661e12b0ab33ef28b1bbc8bb5 (MD5)
4cf27f60551b698e44e4b15267beeac9a6995fb583cf398175c4fe211ae6254e (SHA2)
1b70515c126b4942394e4208f22c0402e48525dc2498542b22a52b3a6161f49f (SHA3)
   The hashing algorithm (MD5/ SHA2/ SHA3) will be determined based on an internal system configuration.
Rate this article:

Need help?

Do you have a question? If you didn’t find the answer you are looking for in our documentation, you can contact our Support teams for more information. If you have a technical issue or question, please contact us. We are happy to help.

Not yet a Verifone customer?

We’ll help you choose the right payment solution for your business, wherever you want to sell, in-person or online. Our team of experts will happily discuss your needs.

Verifone logo