No. The API behavior, request and response formats, authentication, and all transaction data remain the same. This is a URL-only change.

It depends on how you access Shift4 services.

If your systems connect directly to Bambora/Beanstream API endpoints (typically handled by an internal developer, IT agency, or third-party software provider), those integrations must be updated. Pass this document along to the appropriate technical team.

Yes. If you link customers directly to our hosted checkout solution, that URL needs to be updated.

Only the first part of the URL (the domain) needs to change. Everything after it — your merchant ID, amount, order details, and any other parameters — stays exactly the same.

Before: https://web.na.bambora.com/scripts/payment/payment.asp?merchant_id=123456789&trnAmount=19.99...

After: https://checkout.bam.shift4api.net/payment/payment.asp?merchant_id=123456789&trnAmount=19.99...

In other words, replace: https://web.na.bambora.com with: https://checkout.bam.shift4api.net.

The rest of the URL, the path (/scripts/payment/payment.asp) and all the parameters after the question mark do not change.

If your checkout link is hardcoded in a website, invoice template, email, or button, pass this to your developer or IT provider and ask them to swap out the domain portion only.

Forward this document and the original migration email to your software provider or plugin vendor. Ask them to confirm whether their product requires an update and when they plan to release it.

You should also confirm with them before the December 31, 2026 deadline that the update has been applied.

Firewall allow-list updates may be required. New IP addresses will be provided in a follow-up communication. Ensure your network or IT team reviews and updates firewall rules before the December 31, 2026 go-live date.

If your firewall currently allows traffic by domain name rather than IP, you will need to add the new *.bam.shift4api.net domain to your allow list.

As a technical implementer acting on behalf of a merchant, you are responsible for:

• Updating all API endpoint URLs in the merchant's integration from the legacy Bambora/Beanstream domains to the new Shift4 domain convention.
• Reviewing and updating firewall allow-lists once new IP addresses are provided.
• Testing the updated integration in staging before deploying to production.
• Completing the migration before December 31, 2026.

Refer to the full endpoint mapping list here for all impacted URLs.

The update process depends on how your integration is built, but the steps are generally:

• Locate all references to Bambora/Beanstream domains in your codebase, configuration files, environment variables, and infrastructure (e.g., DNS, load balancer, firewall rules).
• Replace all occurrences of with the corresponding endpoint. Refer to the full endpoint mapping list here.
• Update any TLS/SSL certificate pinning or validation rules that reference the old domain.
• Update firewall allow-lists to permit traffic to new IP addresses (to be provided in follow-up communication).
• Test your integration in a staging or sandbox environment before deploying to production.
• Deploy changes to production before December 31, 2026.

No. Your existing API keys, credentials, and authentication methods remain valid. No re-authentication or credential rotation is required as part of this migration.

No. All API request structures, response formats, error codes, and data schemas remain identical. Your existing integration logic does not need to change beyond the URL update.

We recommend the following preparation steps:

• Review the endpoint mapping list now and identify which URLs your system uses.
• Audit your codebase, CI/CD pipelines, environment configs, and infrastructure-as-code for hardcoded Bambora/Beanstream URLs.
• Update your staging/development environments first and validate end-to-end functionality.
• Plan your production deployment ahead of the December 31, 2026 deadline to allow time for testing.
• Coordinate with any third-party vendors or plugins to confirm they will be updated in time.
• Watch for the follow-up communication with new IP addresses and update firewall rules accordingly.

After December 31, 2026, legacy endpoints will be permanently disabled and all requests to legacy URLs will start to fail. You should completing migration before December 31, 2026 to avoid disruption.