How Do I Require a Prescription Before Checkout?
How an online pharmacy requires a valid prescription before checkout completes, holds the card during review, and captures or voids the payment.
Article summary
TL;DR
Make the prescription a condition of the order, not of the payment. Collect it at checkout (upload, or a request to the prescriber), authorize the card without capturing, and have a pharmacist verify it. Capture only once it's approved; void the authorization if it isn't. A card hold usually lasts 7 days online, so review fits inside that window.
- The FDA lists sites that "allow you to buy medicine without a prescription from your doctor" as a sign of an unsafe online pharmacy.
- Stripe restricts "Card-not-present prescription-only products and pharmaceuticals" (updated September 22, 2026); Shopify Payments doesn't support prescription drugs.
- On Stripe, an online card authorization is valid 7 days for customer-initiated Visa, Mastercard, Amex and Discover payments.
- Stripe's 30-day extended hold on Visa doesn't apply to transactions related to healthcare.
- Shopify's Acceptable Use Policy excludes uploading Protected Health Information subject to HIPAA.
On this page
This guide is part of our hub on online pharmacy payment processing. The general guide, for any business: high-risk merchant accounts. If you sell prescription treatment as a brand, Tagada Rx puts storefront, doctors, pharmacy and payments in one stack, by application.
Why the prescription check comes before the money
A pharmacy that sells prescription medications without a valid prescription is, for regulators and processors, the textbook illegal pharmacy. The FDA tells consumers a safe online pharmacy "requires a prescription from a licensed healthcare professional"1FDA, BeSafeRx: Frequently Asked Questions, content current as of September 21, 2020.
FDA
Among the signs of an unsafe site, it "allow[s] you to buy medicine without a prescription from your doctor"1FDA, BeSafeRx: Frequently Asked Questions, content current as of September 21, 2020.
Controlled substances
Federal law bars dispensing them "by means of the Internet without a valid prescription"221 U.S.C. § 829(e), read November 2, 2026.
Processors
Stripe reviews online pharmacies before accepting them3Stripe, Prohibited and restricted businesses, last updated September 22, 2026; Shopify Payments lists prescription drugs among the products it can't support4Shopify Help Center, Shopify Payments eligibility, read November 2, 2026.
Your checkout is the first thing an underwriter tests. If an anonymous visitor can pay and receive a prescription-only product, the account review usually ends there. The full rule set: online pharmacy merchant account compliance.
The three ways to gate checkout
Pick the gate by where the prescription comes from. Most pharmacies combine the first two.
| Gate | How it works | Strength | Limit |
|---|---|---|---|
| Upload at checkout | The patient attaches a file; the order goes on hold for pharmacist review | Simple; works for new patients | A photo isn't verification: the pharmacist still confirms with the prescriber |
| Prescriber sends it | The patient names the prescriber; the pharmacy requests or receives the prescription directly | Strongest evidence | Slower; the order waits on a third party |
| Account gate | Prescription-only products are visible but can't be added to the cart until the account holds a verified prescription | Clean for refills | Friction on the first order |
Merchants still ask for this on Shopify. A November 2024 Community thread looking for an app that "requires prescription approval" before checkout ended with no confirmed solution9Shopify Community, Seeking Checkout App with Prescription Approval Feature for Pharmacy, November 28, 2024. WooCommerce plugins exist: one blocks checkout on the server until a file is attached and holds the order for review, and states it "does not replace local pharmacy rules"10WordPress.org, Prescription for WooCommerce by DevDiggers, version 1.0.0, read November 2, 2026.
Fig. 1A prescription-gated checkout, step by step
approved declined or closed routing step
- CartPrescription-only product
- thenPrescriptionUpload, prescriber, or verified account
- thenCard authorizedA hold, not a charge
- waits forPharmacist reviewPrescriber, patient, product, quantity, validity
- approvedCapture and shipOr void if rejectedApproved
Nothing is charged and nothing ships before the pharmacist clears the order.
Authorize at checkout, capture after verification
The cleanest payment pattern is authorize-then-capture, also called a pre-authorization hold. The bank reserves the amount; you take it only when the order is cleared.
- Authorize only at checkout (on Stripe,
capture_method=manual)5Stripe Docs, Place a hold on a payment method, read November 2, 2026. - Hold the order in a "pending prescription" status. Nothing ships.
- Verify the prescription: prescriber, patient, product, quantity, validity.
- Capture the authorized amount on approval. You can capture less, which releases the rest5Stripe Docs, Place a hold on a payment method, read November 2, 2026.
- Void the authorization if the prescription is rejected or never arrives5Stripe Docs, Place a hold on a payment method, read November 2, 2026.
On Stripe, the hold lasts 7 days for most online card payments.
How long the hold lasts on Stripe, for online card payments5Stripe Docs, Place a hold on a payment method, read November 2, 2026:
| Card brand | Customer-initiated | Merchant-initiated |
|---|---|---|
| Visa | 7 days | 5 days (exactly 4 days and 18 hours) |
| Mastercard | 7 days | 7 days |
| American Express | 7 days | 7 days |
| Discover | 7 days | 7 days |
If you don't capture in time, "the funds are released and the payment status changes to canceled"5Stripe Docs, Place a hold on a payment method, read November 2, 2026.
7 days
Stripe hold for a customer-initiated online card payment, on all four brands
4 days 18 h
Visa merchant-initiated hold on Stripe
30 days
Stripe extended authorization, which doesn't apply to Visa healthcare transactions
When verification takes longer than the hold
Plan your review to finish well inside 7 days. Extended authorizations won't save you on Visa.
Watch out
Stripe's extended authorization (up to 30 days) is offered on Visa for other merchant categories, but "doesn't apply to [...] transactions related to healthcare"6Stripe Docs, Place an extended hold on an online card payment, read November 2, 2026. It also requires IC+ pricing or a request to Stripe, and Stripe notes that many networks reserve extended windows for cases where the final amount isn't known6Stripe Docs, Place an extended hold on an online card payment, read November 2, 2026.
What to do when a prescriber is slow:
- Tell the patient the order is on hold and why, with the date the hold expires.
- Let the hold lapse or void it, then ask the patient to confirm a new authorization once the prescription is verified.
- Don't charge a saved card without consent to "reserve" stock: a charge the patient didn't expect becomes a dispute.
Void, don't refund
A voided authorization never becomes a sale. A refund is a sale reversed after the fact, with processing costs and a line on the statement.
| Outcome of the review | Payment action | What the patient sees |
|---|---|---|
| Prescription approved | Capture | One charge |
| Prescription rejected | Void the authorization5Stripe Docs, Place a hold on a payment method, read November 2, 2026 | The pending amount disappears |
| Information missing | Keep the hold, ask the prescriber | Pending amount, plus your email |
| Hold about to expire | Void, re-authorize with consent | A new pending amount |
Card statements don't always tell a hold from a charge, which "can sometimes confuse customers"5Stripe Docs, Place a hold on a payment method, read November 2, 2026. Say it on the checkout page: void transaction is the term your support team will use.
Where the prescription file lives
Keep the prescription and any health data in a system built for it, not in your store platform. Shopify's policy says it doesn't support "uploading Protected Health Information subject to HIPAA"7Shopify, Acceptable Use Policy, read November 2, 2026.
- Store platform and payments: order, amount, status, a reference to the prescription record.
- Pharmacy system: the prescription, the patient record, the pharmacist's decision.
- Processor: HIPAA doesn't apply to an entity processing a payment for health care "for, or related to" that activity842 U.S.C. § 1320d-8 (HIPAA section 1179), read November 2, 2026, but that doesn't make your store a safe place for prescriptions.
Fig. 2Three systems, three kinds of data
- Store platform and paymentsOrder, amount, status, a reference to the prescription record
- Pharmacy systemThe prescription, the patient record, the pharmacist's decision
- ProcessorProcesses the payment; HIPAA doesn't apply to that activity
The store keeps a reference, never the prescription.
Checkout copy that prevents disputes
- Before the card field: "Your card is authorized now and charged only after a pharmacist verifies your prescription."
- On the hold: how long it lasts, and that it is released if the order is rejected.
- On approval: a confirmation email with the amount and the shipping date.
- On rejection: a plain email saying the hold is released and why the order can't ship.
- Descriptor: your pharmacy's name, so the final charge is recognized: billing descriptor.
Fig. 3What the patient should read at each stage
- Card
- Authorized now, charged only after verification
- Hold
- Released if the order is rejected
- On approval
- Email with the amount and the shipping date
- Descriptor
- Your pharmacy's name
Illustrative record.
Say hold, not charge, until the pharmacist approves.
For refills and recurring orders, the billing rules are in how to sell prescription drugs on subscription. Building the page itself, fields, order and conversion: checkout optimization for online pharmacies.
How Tagada helps
Hold at checkout, capture on the doctor's approval
Tagada Rx runs this pattern as part of a telehealth stack with storefront, doctors, pharmacy and payments12Tagada, Tagada Rx, read November 2, 2026. It is open by application to a selected group of brands.
- Hold, capture on approval: "The card is only captured once a doctor approves." If the doctor declines, "the card hold is released and the patient pays nothing"12Tagada, Tagada Rx, read November 2, 2026.
- Capture or void, never a refund: approval captures the hold, a decline voids it11Tagada Docs, Tagada Rx introduction, read November 2, 2026.
- Clear checkout copy: Tagada's docs state the hold is not clinical approval and the storefront copy must make that clear11Tagada Docs, Tagada Rx introduction, read November 2, 2026.
- Pharmacy routing to a licensed US pharmacy, and rebilling on the day the pharmacy ships12Tagada, Tagada Rx, read November 2, 2026.
- Health data: "PHI never touches Tagada storage"11Tagada Docs, Tagada Rx introduction, read November 2, 2026.
See how it works on the Tagada Rx page.
Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Frequently asked questions
Can I take payment at checkout and charge only after the prescription is approved?
Is there a Shopify app that holds checkout until a prescription is approved?
Is an uploaded photo of a prescription enough?
What happens if verification takes more than 7 days?
Do I need a BAA with my payment processor for prescription orders?
Sources
Checked November 2, 2026- FDA, BeSafeRx: Frequently Asked Questions, content current as of September 21, 2020
- 21 U.S.C. § 829(e), read November 2, 2026
- Stripe, Prohibited and restricted businesses, last updated September 22, 2026
- Shopify Help Center, Shopify Payments eligibility, read November 2, 2026
- Stripe Docs, Place a hold on a payment method, read November 2, 2026
- Stripe Docs, Place an extended hold on an online card payment, read November 2, 2026
- Shopify, Acceptable Use Policy, read November 2, 2026
- 42 U.S.C. § 1320d-8 (HIPAA section 1179), read November 2, 2026
- Shopify Community, Seeking Checkout App with Prescription Approval Feature for Pharmacy, November 28, 2024
- WordPress.org, Prescription for WooCommerce by DevDiggers, version 1.0.0, read November 2, 2026
- Tagada Docs, Tagada Rx introduction, read November 2, 2026
- Tagada, Tagada Rx, read November 2, 2026
Tagada Rx
No charge before the prescription is verified
Tagada Rx runs the stack behind your brand. Open by selection: every application is reviewed, and we reply to each one.
- 01Tell us about your brand
- 02We review every application
- 03Go live under your brand after review
