# Checkout

Shift4 Checkout allows you to securely collect payments using a hosted payment form.
A checkout session is used to initialize Shift4 Checkout. It represents a server-created configuration that defines what the customer is paying for and how the Checkout form behaves.
Sessions must be created using a secret API key and then passed to `checkout.js` to render the payment form. This server-side creation model allows Shift4 to enforce rate limiting and prevent abuse scenarios such as automated card testing.
Each session contains a `clientSecret` attribute which needs to be passed to the client side to open the Checkout. Once created, a session is immutable and cannot be modified. If changes are required, a new session must be created.
There is also a legacy integration model based on signed checkout requests. Checkout requests are deprecated and will be removed in the future — all new integrations should use checkout sessions. See the [Checkout Request guide](/docs/checkout/checkout-request) for details.

 - [POST /checkout-sessions](https://matterhorn-api.redocly.app/docs/api/shift4-gateway/checkout/createcheckoutsession.md): Creates a new checkout session. Sessions must be created using a secret API key. Pass the returned `clientSecret` to the `checkout.js` script to render the payment form, or use the returned `url` for
 - [GET /checkout-sessions](https://matterhorn-api.redocly.app/docs/api/shift4-gateway/checkout/listcheckoutsessions.md): Lists checkout session objects. Results are sorted by creation date, with the most recent objects first.
 - [GET /checkout-sessions/{checkoutSessionId}](https://matterhorn-api.redocly.app/docs/api/shift4-gateway/checkout/getcheckoutsession.md): Retrieves an existing checkout session object.