# Merchant URLs explained

Every URL in merchant_urls, who calls it and when, and how the terms URL shows up in the checkout. Use https:// for all of them.

`merchant_urls` tells Kustom where your shop lives and where to call back. Four are required.

**Use `https://` for every URL in `merchant_urls`.**

| Key | Required | Who uses it |
|---|---|---|
| `terms` | yes | Linked inside the checkout |
| `checkout` | yes | Where the checkout snippet is rendered |
| `confirmation` | yes | Browser redirect after purchase. `{checkout.order.id}` is substituted |
| `push` | yes | Server-to-server after purchase |
| `validation` | no | Server-to-server just before purchase |
| `address_update`, `country_change` | no | Server-to-server when the customer changes address or country. Return updated lines and shipping |
| `shipping_address_update` | no | An older name for `address_update`, used only when that's absent |
| `shipping_option_update` | no | Server-to-server when the shipping option changes |
| `notification` | no | Pending-order status changes |
| `upsell`, `upsell_validation`, `upsell_notification` | no | Server-to-server around confirmation-page upsell |
| `cancellation_terms` | no | Linked inside the checkout, beside `terms` |

What each server-to-server URL receives and how to answer it is in
[Server-side callbacks](/checkout/callbacks/).

When you send an order from the live demos on these pages, any `https://` URL you include is
kept. Missing or non-HTTPS values are replaced with the docs' own endpoints so the demo works end
to end.

## The terms in the checkout

`terms` must be your own HTTPS URL. Kustom uses it to add a merchant section to the terms
shown under the **Pay order** button, substituting your merchant name and linking the URL you
gave.

Around that section, Kustom generates the terms needed for data compliance: its own terms of
use and its own privacy notice, localized for the billing country and locale. It's the same two
documents in every market — only the localized file they link to changes. All of this renders
*below* the **Pay order** button, not above it.

`cancellation_terms` takes a URL to your cancellation terms. It's appended to the merchant
terms and updates the Right to Withdrawal link.

Anything the customer must actively confirm, rather than merely be shown, is a required
checkbox *above* the **Pay order** button instead — see [Custom
checkboxes](/checkout/checkout-options/#custom-checkboxes).

## Next steps

- [Confirmation & push](/checkout/integrate/confirmation-and-push/) — the `confirmation` and `push` URLs in action.
- [Answer the callbacks](/checkout/integrate/validation-callback/) — the `validation` URL in action.