From $199/mo
The buyer sees your brand at the URL bar. The theme inspector sees obfuscated JavaScript with no gateway name in it. Shop Pay, Apple Pay and Google Pay express buttons are hidden so buyers land in the cascaded checkout instead of a wallet flow. HTTP headers are stripped so the checkout page does not identify its host stack. The whole cloak is on by default from the moment your store goes live — nothing to configure.
The checkout page is served from a subdomain of your brand — checkout.your-brand.com. Buyer's URL bar shows your brand. TLS certificate is issued to your brand's domain. The gateway that actually captures the card (NMI reseller, offshore acquirer, Whop, PXP, custom HTTP) is never visible to the buyer. Descriptor on the buyer's card statement is your merchant descriptor from your MID, not a marketplace or third-party descriptor.
The loader snippet that goes into your Shopify theme is a single <script src> line. The loader body itself is processed through Terser plus javascript-obfuscator on the moderate config. The shipped JavaScript contains no readable references to CascadeCheckout, no gateway names, no endpoint paths beyond the loader URL. A leak audit runs on every deploy against a 22-marker fingerprint including dusto, cascadecheckout, shopify-payment, apple-pay, shop-pay, STORE_ID, REDIRECT_BASE, TRACKING_ENDPOINT — all confirmed absent in the shipped bundle before production activation.
Native Shopify express buttons — Shop Pay, Apple Pay, Google Pay, dynamic checkout, buy-it-now — are hidden at page-render time by the loader IIFE. If the buyer's browser somehow renders one during the brief window before the loader fires, the delegated click-intercept catches the click and re-routes into the cascaded checkout instead of letting the click resolve to the native wallet flow. No native Shopify Payments express button ever completes a checkout on stores running the cloak.
X-Powered-By: Next.js stripped. Server header normalized. Checkout responses do not identify Vercel, Cloudflare or any specific hosting infrastructure by name. Combined with the own-domain URL, HTTP headers reveal nothing about the checkout's underlying architecture beyond "this is a TLS-served page under the merchant's brand."
Operator brand privacy. Buyers, competitors and casual theme-inspectors see the merchant's brand end-to-end. No "powered by X" giveaway.
Category-flag scoring. Because payment traffic no longer routes through Shopify Payments, Shopify Payments' payment-side risk model has no signal from your store. See hide from Shopify Payments for the deep-dive.
Buyer-facing consistency. The domain the buyer clicked in the ad is the domain they check out on and receive their receipt from. No third-party marketplace URL, no gateway-branded wallet flow.
What the cloak does NOT do. It does not misrepresent your product category to your acquirer. Your MID contract with your gateway describes your true product category and MCC — that is between you and the gateway. The cloak operates on what the buyer, the theme inspector and the network see, not on what the acquirer receives in the authorization message.
checkout.your-brand.com with TLS. DNS pointed to our infrastructure but URL under your brand.
Single line into theme.liquid. Cloak layers 2-4 active from first buyer session.
Your gateway API keys. Cascade behind it for backup MID rotation.
Four layers. (1) Buyer-facing gateway brand — the checkout page shows your brand, not the processor's. (2) Theme inspector brand — the loader snippet in your Shopify theme is Terser + javascript-obfuscator processed so nothing in the shipped JS reads as CascadeCheckout or the underlying gateway. (3) Express-wallet buttons — Shop Pay, Apple Pay, Google Pay hidden by the loader so buyers land in the cascaded flow. (4) HTTP header signals — X-Powered-By stripped, checkout page URL served under your subdomain.
The loader that goes into theme.liquid is one line of obfuscated JS. Pasting that into Shopify's theme code editor and inspecting the shipped source reveals no CascadeCheckout brand, no gateway names, no endpoint URLs beyond the loader script src. A leak audit runs on every deploy against 22 marker strings.
Loader is served with defer, so it does not block first paint. Obfuscated payload is 34 KB gzipped. First-obfuscation call is cached for subsequent requests. No measurable impact on Core Web Vitals in production tests.
Yes. Individual cloak layers are toggleable per store. Some operators disable the theme-inspector cloak for developer debugging and re-enable before going live. All cloak layers on by default.
Four cloak layers on by default. Your brand, your MID, your survival.
Hide from Shopify Payments → · Brand cloak checkout → · Anonymous checkout →