No. The API behavior, request and response formats, authentication, and all transaction data remain the same. This is a URL-only change.

It depends on how you access Shift4 services.

If your systems connect directly to Bambora/Beanstream API endpoints (typically handled by an internal developer, IT agency, or third-party software provider), those integrations must be updated. Pass this document along to the appropriate technical team.

Yes, but it’s a small change. If you link customers directly to our hosted checkout, you’ll need to update the domain in that URL. Your merchant ID, amount, order details, and all other parameters stay exactly the same.

Before: https://web.na.bambora.com/scripts/payment/payment.asp?merchant_id=123456789&trnAmount=19.99...

After: https://checkout.bam.shift4api.net/scripts/payment/payment.asp?merchant_id=123456789&trnAmount=19.99...

In other words, replace https://web.na.bambora.com with https://checkout.bam.shift4api.net. The path and everything after the question mark can stay as they are. The new domain also accepts the path without /scripts, so either format works.

If your checkout link is hardcoded in a website, invoice template, email, or button, pass this to your developer or IT provider and ask them to swap out the domain portion only.

Our link builder tool now generates links using the new domain.

Forward this document and the original migration email to your software provider or plugin vendor. Ask them to confirm whether their product requires an update and when they plan to release it.

You should also confirm with them before the December 31, 2026 deadline that the update has been applied.

As a technical implementer acting on behalf of a merchant, you are responsible for:

• Updating all API endpoint URLs in the merchant's integration from the legacy Bambora/Beanstream domains to the new Shift4 domain convention.
• Reviewing and updating firewall allow-lists with new domain name (*.bam.shift4api.net) or IP addresses (162.159.142.249 and 172.66.2.245) as required.
• Testing the updated integration in staging before deploying to production.
• Completing the migration before December 31, 2026.

Refer to the full endpoint mapping list here for all impacted URLs.

The update process depends on how your integration is built, but the steps are generally:

• Locate all references to Bambora/Beanstream domains in your codebase, configuration files, environment variables, and infrastructure (e.g., DNS, load balancer, firewall rules).
• Replace all occurrences of with the corresponding endpoint. Refer to the full endpoint mapping list here.
• Update any TLS/SSL certificate pinning or validation rules that reference the old domain.
• Update firewall allow-lists to permit traffic to new IP addresses (162.159.142.249 and 172.66.2.245) and domain name (*.bam.shift4api.net).
• Test your integration in a staging or sandbox environment before deploying to production.
• Deploy changes to production before December 31, 2026.

To update an existing link, replace the domain web.na.bambora.com with checkout.bam.shift4api.net. The path, query parameters, and hashValue stay the same, so you don’t need to regenerate the hash. The new domain accepts the path with or without /scripts.

If your code builds Checkout URLs programmatically, update the base URL in your code or configuration. The rest of your link-generation logic doesn’t need to change.

Old Checkout URL:  https://web.na.bambora.com/scripts/payment/payment.asp?merchant_id=123456789&trnLanguage=eng&...

New Checkout URL:  https://checkout.bam.shift4api.net/scripts/payment/payment.asp?merchant_id=123456789&trnLanguage=eng&...

To generate new link examples, use our link builder tool, which now outputs the new domain.

Firewall allow-list updates may be required. Our new IP addresses are 162.159.142.249 and 172.66.2.245. Please ensure your network or IT team reviews and updates your firewall rules to allow these addresses before the December 31, 2026 go-live date.

If your firewall currently allows traffic by domain name rather than IP address, you will need to add the new *.bam.shift4api.net domain to your allow list.

The endpoint bam.shift4api.net chains up to the ISRG Root X2 root certificate, issued by the Internet Security Research Group (the organization behind Let’s Encrypt). The certificate is attached to this article as ISRG Root X2.crt.

Certificate details

How to use it
If your application or server doesn’t already trust ISRG Root X2, add the attached certificate to your trust store (Java keystore, OS certificate store, or your HTTP client’s CA bundle). Most modern operating systems and browsers already include this root, so many integrations won’t need any action.

Note: Only the root is needed in your trust store. Intermediate certificates are sent by the server during the TLS handshake.

No. Your existing API keys, credentials, and authentication methods remain valid. No re-authentication or credential rotation is required as part of this migration.

No. All API request structures, response formats, error codes, and data schemas remain identical. Your existing integration logic does not need to change beyond the URL update.

Our SDKs are legacy products, and we have not supported this for more than 5 years.

We recommend you to either reintegrate with our REST APIs or connect with our Sales team to discuss switching to the Shift4 Platform.

You can also look for the baseURL in the SDK and replace the URL to https://api.bam.shift4api.net and perform your test payments in your test account before you deploy it to your live accounts.

We recommend the following preparation steps:

• Review the endpoint mapping list now and identify which URLs your system uses.
• Audit your codebase, CI/CD pipelines, environment configs, and infrastructure-as-code for hardcoded Bambora/Beanstream URLs.
• Update your staging/development environments first and validate end-to-end functionality.
• Plan your production deployment ahead of the December 31, 2026 deadline to allow time for testing.
• Coordinate with any third-party vendors or plugins to confirm they will be updated in time.

After December 31, 2026, legacy endpoints will be permanently disabled and all requests to legacy URLs will start to fail. You should completing migration before December 31, 2026 to avoid disruption.