Open source · MIT · Secured by Lifted Payments 3-D Secure

Drop live shipping into your own checkout.

Lifted ShipKit is the open shipping toolkit. Import one drop-in widget — or the tiny SDK — and your app compares live multi-carrier rates, buys the label in one call, and takes a card payment authenticated by 3-D Secure, so fraud chargeback liability shifts to the issuer. Self-host it free, or create a free account and go live with a single script tag.

Read the quickstart Open in Postman Star on GitHub

10+Carriers via EasyPost

0PCI scope on managed

MITFree, open source

app.yourstore.com/checkout Lifted Payments

Everything a store needs to ship.

Real carrier functionality on the backend. A clean, accessible widget on the front. One tasteful, secure checkout.

Address verify

Validate and normalize the recipient address before you quote — fewer failed deliveries, fewer surprises.

Live rate compare

Pull real-time rates and delivery estimates across carriers and services. Cheapest first, ranked and readable.

Label & QR

Buy the label and get a printable PDF plus a scannable QR for paperless drop-off — instantly.

3-D Secure payment

The issuer authenticates the cardholder before authorization. Fraud liability shifts. Approvals go up.

Drop-in widget

Dependency-free, framework-agnostic, themeable with CSS variables. One <script> and you're live.

Yours to own

MIT-licensed Kotlin backend and vanilla-JS front. Read it, fork it, ship it. No lock-in.

Three ways to run ShipKit.

Start free and self-hosted, bring our 3-D Secure processing to your own stack, or hand us the whole thing. Every tier is powered by Lifted Payments 3-D Secure — pick your level of control.

Tier 1

Self-host

Total freedom, heaviest lift. Clone the repo and plug in your own payments and your own EasyPost.

$0 forever · MIT You run the backend and own everything.

Full Kotlin + Javalin source, deploy anywhere
Bring your OWN payments + OWN EasyPost
Your infrastructure, data and rate agreements
Full control — the most developer work

Clone on GitHub

Need a hand? support@liftedholdings.com

Tier 2

Your 3-D Secure account

Our 3-D Secure processing on your own merchant account. Bring your own EasyPost — you host or we host, both free.

3.75% + 15¢ / transaction plus $25 / month — the merchant account only. Hosting is free either way.

Surcharge the 3.75% + 15¢ to the buyer with a built-in toggle — net-zero processing cost to you.

OUR 3-D Secure account — forced 3DS, liability shift
Bring your own EasyPost account and rates
Self-host it OR let us host it — both free
Apply once — the account stays yours

Apply for 3-D Secure

Apply at liftedholdings.com/payments

Tier 3 Most popular

Fully managed

No application, no infra — sign up, drop in one script tag, done. Our 3-D Secure account and our EasyPost.

$0 setup · free hosting We earn only on a small, configurable markup of the shipping rate.

No merchant-account application. Create a free account and get your managed key + JS snippet instantly.

Create a free account — JS snippet + managed key instantly
OUR 3-D Secure account + OUR EasyPost — nothing to wire
No keys to manage, no PCI scope, free hosting
Best for "just make it work"

Create your free account → get the JS

Custom integration & software development

Want ShipKit woven into your custom framework, or a bespoke build from the ground up? Our team does that — tell us what you need.

support@liftedholdings.com

Checkout speed

Frictionless checkout & saved cards — on our rails

3-D Secure is forced by default, and self-host stays that way — it is the fraud and chargeback protection that makes ShipKit safe to ship. Merchants on Lifted Payments (tier 2 or 3) or enterprise custom-dev can opt into a faster path: skip the challenge on low-risk orders and keep cards on file for one-tap repeat charges. It is an account-level, server-side capability — never a client toggle.

Forced 3-D Secure Default · all tiers

The only mode for self-host & bring-your-own-payments.

Every charge authenticated — liability shifts to the issuer.
No card-on-file. Maximum fraud & chargeback protection.
Self-host cannot disable 3DS — by design.

Frictionless on our rails Tier 2 / 3 · enterprise

Opt-in, tied to your Lifted account & tier.

3ds:false on low-risk orders — fewer checkout drop-offs.
Saved cards on file (tokenized vault) → one-tap repeat charges.
Server-side & account-gated — never exposed to the widget.

Need frictionless mode or a custom vault flow for your enterprise checkout? Our team wires it to your account.

Talk to us · support@liftedholdings.com

Import ShipKit into your own checkout.

One mount point, one import. The widget renders address entry, live multi-carrier rates and the 3-D Secure card step right inside your app — framework-agnostic, dependency-free, themeable with CSS variables. Point it at your own backend, or at our managed rails. Copy, paste, ship.

Add a mount point

Any element — <div id="ship">. ShipKit owns its own subtree inside it and inherits your layout.

Import & init

Talk to your own backend with endpoint:'/api' + a publishable pk_live_… key, or hand it a managed key for our rails.

Listen for the label

Subscribe to onPurchase for the tracking code, label URL and QR. That is the whole integration.

Full React, Vue & plain-HTML examples ship in the repo under /examples.

Checkout.jsx

// Drop the widget straight into your checkout route.
import ShipWidget from './ShipWidget';

export default function Checkout() {
  return (
    <ShipWidget
      endpoint="/api"
      apiKey="pk_live_…"
      theme="dark"
      onPurchase={(label) => router.push(label.trackingUrl)}
      onError={(err) => toast.error(err.message)}
    />
  );
}

<script setup>
import ShipWidget from './ShipWidget.vue';
</script>

<template>
  <ShipWidget
    endpoint="/api"
    api-key="pk_live_…"
    theme="dark"
    @purchase="(label) => (window.location = label.labelUrl)"
    @error="(err) => notify(err.message)"
  />
</template>

<!-- One mount point -->
<div id="ship"></div>

<script src="/js/shipkit.js"></script>
<script>
  ShipKit.init({
    mount: '#ship',
    endpoint: '/api',
    apiKey: 'pk_live_…',
    theme: 'dark',
    onPurchase: (label) => { window.location = label.labelUrl; },
    onError: (err) => console.error(err.stage, err.message)
  });
</script>

Built to be integrated in an afternoon.

A machine-readable OpenAPI spec, a rendered API reference, and a ready-to-run Postman collection — every endpoint authenticated with a single ShipKit-Api-Key header.

OpenAPI 3.1 spec

The full contract for every route — schemas, error shapes, and the tier & surcharge fields. Import into any codegen or client.

GET /openapi.yaml openapi.yaml

API reference

A self-contained, dependency-free reference page — browse every endpoint, parameter, and example without leaving your network.

GET /docs Open reference

Postman collection

Every endpoint pre-built with example bodies and {{baseUrl}} / {{apiKey}} variables. Import and send in seconds.

shipkit.postman_collection.json

Open in Postman Import JSON

Live in three lines.

Drop the widget anywhere. Point it at your self-hosted backend, or at Lifted with a managed key. Style it with CSS custom properties.

index.html — managed

<!-- Managed: no backend, no keys -->
<div id="ship"></div>
<script
  src="https://cdn.liftedholdings.com/shipkit.js"
  integrity="sha384-…"
  crossorigin="anonymous"
  data-managed-key="pk_live_…"
  data-mount="#ship"></script>

app.js — self-host

// Self-host: talks to your own backend
ShipKit.init({
  mount: '#ship',
  endpoint: '/api',
  apiKey: 'pk_live_…', // publishable widget key → ShipKit-Api-Key header
  onQuote: rates => console.log(rates),
  onPurchase: label => {
    window.location = label.labelUrl;
  },
  onError: err => console.error(err)
});

// Retheme with CSS variables:
// .sk { --sk-primary:#7C3AED; }

Full config table, callback reference, and React / Vue / plain-HTML snippets in docs/integration.md.

Why 3-D Secure

Authenticated payments, on the merchant's side.

Liability shift. On authenticated transactions, fraud-related chargeback liability shifts from the merchant to the card issuer.
Fraud reduction. The issuer authenticates the cardholder — biometric, OTP, or risk-based — before authorization.
Compliance. Meets SCA / PSD2-style strong-customer-authentication expectations, with a frictionless flow for low-risk transactions.
Better approvals. Issuers approve authenticated transactions at higher rates.

Get a 3-D Secure merchant account

ShipKit's payment layer is Secured by Lifted Payments · 3-D Secure. Apply for an account to self-host, or get a managed key to skip the infrastructure entirely.

Apply at liftedholdings.com/payments