How Bolt Got Inside Shopify’s Checkout — and Why No One Can Do It Again
Bolt built an $11B company on a technical maneuver: injecting a full checkout replacement into Shopify merchant themes before Shopify closed the door. The partnership that was supposed to legitimize it never materialized. Here’s the actual playbook, what it means for the competitive landscape today, and what Krepling can realistically do.
What Bolt Actually Built
Bolt never used Shopify’s Payments Apps API. Their Shopify app injected a JavaScript snippet directly into theme.liquid. When a shopper reached the cart page, Bolt’s JS intercepted the “Checkout” button and opened a Bolt-controlled iframe modal. Shopify’s /checkout route never loaded.
After capturing payment, Bolt called Shopify’s Draft Orders API server-side to create the order and retrieve an order_received_url. From Shopify’s perspective, an order appeared — it just didn’t know how the payment was taken.
The core insight: Bolt owned the entire checkout experience. Shopify’s payment infrastructure was bypassed completely — the Draft Orders API was just the bookkeeping layer at the end.
The Handshake That Never Became a Contract
Bolt’s Shopify strategy depended on a verbal commitment from Harley Finkelstein (Shopify COO) that Bolt would be the exclusive third-party checkout exception — a meaningful carve-out from Shopify’s 2017 prohibition on external checkouts.
Bolt complied: they wound down WooCommerce and other platform integrations to honor their end of the arrangement. Then Shopify went quiet.
theme.liquid approach was already live — grandfathered, not explicitly banned for existing merchants.What’s Locked, What’s Available
Shopify’s checkout stack has five distinct layers, each with different access rules. Understanding which layer is which determines what’s actually buildable.
| Layer | Access | What it means |
|---|---|---|
| Express row | Locked | Shop Pay, Apple Pay, Google Pay, PayPal — the top button row. Requires a direct commercial deal with Shopify. Not accessible via Payments Apps API. Bolt was offered a spot here and declined. |
| Payments Apps API | Invite-only | Payment methods list below the Express row. Requires invite, revenue share agreement, ~$1M GMV on other platforms before going GA. 3–12 month lead time. GraphQL endpoint, mTLS required, 99.95% uptime SLA. |
theme.liquid injection |
Blocked | Bolt’s method. App Store review rejects any submission using JS injection to intercept or replace checkout. Existing apps are grandfathered; new submissions are not. |
| Draft Orders API | Policy grey zone | Technically available, but using it to bypass checkout processing violates Shopify policy. Legitimate use: creating orders from voice/phone flows where the sale originates externally. |
| Products / Catalog API | Available | No restrictions. /products.json is also a public unauthenticated endpoint. This is Kora’s entry point for Shopify catalog access — no plugin required, unlike WooCommerce. |
Why Bolt Still Works for Existing Merchants
Shopify’s prohibition on checkout replacement is enforced at the App Store submission layer, not at runtime. Once an app is approved and installed, Shopify does not audit or retroactively block theme.liquid behavior. They also won’t break a live merchant’s store to enforce policy retroactively — the operational and PR cost is too high.
The practical implication: Bolt’s existing integrations keep running. No new competitor can replicate the approach because the submission gate blocks them before they reach merchants. The window was open for roughly three years; it’s been closed since 2022. This is not a gap worth trying to exploit.
The Sezzle Case
Sezzle (a BNPL provider) filed an antitrust suit arguing that Shopify’s control over the Express row constitutes anticompetitive gatekeeping. The motion to dismiss was denied on May 13, 2026 — the case is proceeding to discovery.
If Sezzle prevails, Shopify could be forced to open the Express row to qualifying competitors on non-discriminatory terms. Minimum timeline: 2–3 years to a final outcome. Long shot, but a structural change to the competitive landscape if it lands. Worth monitoring.
Three Options
Given the above constraints, Krepling has three realistic approaches to Shopify payment integration. They are not mutually exclusive — the right move is to ship C immediately and pursue B in parallel.
theme.liquid; use Draft Orders API to record sales. Technically possible to build; impossible to get approved.Recommended sequence: Ship Kora × Shopify with the Twilio phone call flow (C) to build GMV on Shopify merchants now. Use that traction to qualify for and negotiate a Payments Apps API invite (B). Once inside the API, Krepling Pay lands in the payment methods list with Shopify’s explicit blessing. Monitor the Sezzle antitrust case as a potential Express row opportunity on a longer horizon.