How to Accept Credit Cards on an Online CBD Store

Card payments online have three parts, and each one answers a different question:

All-in-one options like Shopify Payments bundle all three and approve you in minutes because nobody reviews your products first. That's why they tend to exclude CBD. With a merchant account, a bank's underwriter reviews your products, COAs (certificates of analysis: lab reports showing what's in each batch) and website before you take a payment. For more on how gateways and merchant accounts work in riskier industries, see our guide to choosing a high risk payment gateway.

Each platform has its own rule. Here's what each one's own help pages say, checked on September 27, 2026:

Sell CBD on Shopify

Shopify allows hemp and CBD stores in the US. Its requirements say products can't contain more than 0.3% THC on a dry weight basis "or such lower percentage as required by applicable state and local law," and can't be marketed with medical or therapeutic claims unless the FDA has approved them.

Shopify Payments won't process those sales. Shopify says you need a third-party payment provider that supports hemp, names DigiPay and Bankful as examples, and warns that "not all of the third-party payment providers partnered with Shopify are compatible with hemp sales." Authorize.Net is one of the payment apps in Shopify's admin. Two costs to plan for: Shopify charges a third-party transaction fee when you don't use Shopify Payments (2% on Basic, 1% on Grow, 0.6% on Advanced and 0.2% on Plus, per its pricing page), and that's on top of your processing costs.

Note that Shopify's 0.3% wording reflects today's federal hemp definition. That definition changes on December 11, 2026 (pending), when hemp will be measured by total THC with a 0.4 mg per container cap for final products. Our guide to the 2026 hemp law change explains what that means for your catalog.

CBD WooCommerce payments

WooCommerce is free software you run on your own hosting. Its CBD guidelines say you can use the open-source WooCommerce software "to power a store that sells CBD or other hemp-derived products using a different payment processor," and that Jetpack and WooCommerce.com subscriptions are fine if products have "less than 0.3%" THC. WooPayments is out: CBD "cannot be sold using WooPayments due to restrictions put in place by our payments processor."

Stores hosted on WordPress.com or Pressable have a stricter rule. WooCommerce requires them to use one of two named gateways, and in the US that's Square. Square told sellers in August 2026 that CBD must be removed from Square catalogs by October 15, 2026, so check with WooCommerce before you rely on that path. Self-hosted stores can use an Authorize.Net extension instead.

BigCommerce

BigCommerce's acceptable use policy doesn't mention CBD by name. It says you're responsible for making sure your products comply with local, state and federal law. It also runs a CBD solutions page.

Authorize.Net is available on BigCommerce, but it isn't on the "Embedded Payment Provider" list. That means stores on self-serve plans pay an Open Payment Provider fee on those orders: 2.0% on Core, 1.0% on Growth and 0.6% on Scale, per BigCommerce's pricing page. Contracted Performance plans pay 0%. Build that into your pricing.

Wix and Squarespace

Wix allows US businesses to sell hemp and hemp-derived CBD after they submit a hemp declaration. It excludes businesses located in Hawaii, Idaho, Iowa, Mississippi, New Hampshire and South Dakota, and requires you to limit shipping to states that allow the products. Wix lists four CBD payment partners (Square, Bankful, Priority Payments and Evergreen Payments Northwest), so you can't bring any gateway you like. Squarespace's help center doesn't publish a CBD rule; it points sellers to its acceptable use policy and to each payment processor's rules. Check which processors you can connect before building a Squarespace store.

Amazon

Amazon doesn't allow CBD listings on Amazon.com. Its seller policy on drugs, as quoted by sellers on Amazon's own seller forums, says "Listings for products containing cannabidiol (CBD) are prohibited," including full-spectrum and "rich" hemp oil. The page needs a Seller Central login, so check the current version there. It's a listing rule, so no payment setup changes it.

Authorize.Net is a payment gateway, not a bank. It connects your store to the merchant account behind it, and that merchant account decides what you're allowed to sell. So the real question is whether your merchant account allows CBD and runs on Authorize.Net.

The gateway itself is widely supported. It's pre-integrated with more than 1,000 shopping carts, including Shopify, BigCommerce and WooCommerce (through extensions). START has set up more than 60,000 Authorize.Net gateway accounts over 20+ years.

Setup, once you're approved, usually looks like this:

1. Apply with your full product list, website and COAs. See CBD merchant account requirements for the documents.
2. Get your gateway linked to the approved account.
3. Copy your API Login ID and Transaction Key from the Authorize.Net Merchant Interface. Treat them like passwords.
4. Connect your platform. On Shopify, Authorize.net is under Settings › Payments in the list of other providers. Shopify notes that you must turn off Authorize.Net's test mode first.
5. Place a small real order and refund it to test.

Not every CBD account runs on every gateway. Tell us your cart and your products, and we'll tell you whether your CBD account can run on Authorize.Net before you apply.

For a CBD online store merchant account, underwriters review your website as closely as your paperwork. Fix these before you apply:

• ✓A COA linked on every product page. A current third-party lab report for each product or batch, matching what's in the box.
• ✓No health or disease claims. Not on product pages, blog posts or reviews you publish. Shopify and WooCommerce both call this out in their CBD rules.
• ✓An age check where a state requires one. Some states set a minimum age for buying CBD or hemp products. If you ship to one, add an age check at checkout.
• ✓Shipping blocks for restricted states. Block states and products you can't ship to. Wix requires this in its hemp declaration.
• ✓Clear refund, shipping and privacy policies, plus a phone number or email customers can reach.
• ✓Plain subscription terms next to the buy button: price, how often, and how to cancel.

One product that doesn't meet the hemp definition, such as delta-8 or THCA flower, can sink an application. The details are in our CBD payment compliance guide, and you can see what we accept on the main CBD page.

Auto-ship keeps customers ordering, but it's also where many CBD disputes start ("I cancelled"). Build these in from day one:

• Clear consent. A checkbox or clear wording at checkout that says the price, how often you'll charge and how to cancel. No pre-checked boxes.
• Reminders. An email a few days before each charge.
• Easy cancellation. Online, in a couple of clicks, without a phone call.

On the technical side, Authorize.Net has two tools for this: Customer Information Manager (CIM) stores cards as secure tokens, and Automated Recurring Billing (ARB) runs scheduled charges. On Shopify, Authorize.net is one of five gateways Shopify lists for subscription products, though Shopify notes that Apple Pay and Google Pay aren't available with it.

Whether you can bill CBD customers on a schedule depends on the merchant account, not just the software. Ask whether your account allows recurring billing before you launch auto-ship. Our guide to CBD chargebacks covers subscription disputes in more detail.

Some stores add a second way to pay so a processing pause doesn't stop every order. The most common is eCheck (ACH): the customer pays straight from a bank account, and the payment runs through the gateway alongside cards.

eCheck has its own approval, just like cards. Ask whether ACH is available for your CBD products before you add it to your checkout,. Adding a payment method without approval puts the whole account at risk.

Online CBD sales are card-not-present, and fraud and disputes count toward the card networks' monitoring programs. Visa, for example, measures fraud reports plus disputes against settled card-not-present transactions. Keeping both low protects your account.

Turn on the basics before you go live:

• AVS and CVV checks to match the billing address and card security code.
• Velocity filters to stop many attempts from one card, IP address or email in a short time.
• Order review rules for large first orders or mismatched shipping and billing addresses.
• A clear billing descriptor so customers recognize the charge on their statement.

Authorize.Net includes a set of fraud prevention tools you can tune for your store. For how dispute limits work, see chargeback ratio limits.

This article is general payments guidance, not legal advice. Platform policies and fees above were checked on September 27, 2026, and hemp laws and platform rules change often. Read each platform's current terms before you build or move your store.