SHIFT4 Troubleshooting Guide

Card terminal not responding? Nine times out of ten the problem is not the card reader and not Stayflexi — it is the Shift4 Universal Transaction Gateway (UTG), a small Windows program that sits between the two. This guide takes you from “the terminal is dead” to a working $1 test charge, and tells you exactly when to stop and call Shift4.

Who does what:
Front desk steps need no admin rights and no training.
Stayflexi Ops steps need Windows admin access on the property’s PC.
Shift4 only steps must not be attempted by us — Shift4 owns them.

---

1. How the Shift4 integration actually works

Understanding this one diagram resolves most tickets, because it tells you which link in the chain is broken.

Key consequences of that design:

• The UTG runs on the property’s own PC. If that PC is off, asleep, or off the network, card payments stop — even though Stayflexi itself is perfectly healthy.
• Stayflexi talks to the UTG by IP address. That address is stored in Stayflexi Meta as the Shift4 UTG URL. If the PC’s IP changes, the stored URL becomes wrong and every transaction fails.
• The connection is HTTPS with a self-signed certificate. The browser must trust that certificate, and the certificate must have been generated for the IP the browser is calling.
• The UTG routes to a specific PIN pad using the API Terminal ID. That ID must match on both sides — in the UTG and in Stayflexi Meta.

---

2. Symptom → cause quick reference

---

3. Front desk: the five-minute check Front desk

Work through these in order before raising a ticket. Most “terminal is dead” reports are resolved by step 4 or 5.

Step 1 — Look at the PIN pad screen

• Blank / no lights: it is a power or cable problem. Go to step 2.
• “This Lane is Closed”: the PIN pad is alive but the UTG is not talking to it. Skip to step 4.
• Shift4 splash screen / idle logo: the PIN pad is healthy. The problem is further up the chain — skip to step 5.

Step 2 — Reseat the cables at both ends

Unplug and firmly re-plug the Ethernet (or USB) cable at both the PIN pad and the network switch or PC. Confirm the switch port shows a link light.

Step 3 — Reboot the PIN pad

Hold the yellow key + # together until the device shuts down, then let it restart. If that key combination does nothing, unplug the power cable, wait ten seconds, and plug it back in. Wait for the Shift4 splash screen.

Step 4 — Confirm the UTG computer is awake and online

Find the property PC that Shift4 installed the UTG on (usually the back-office or front-desk workstation). Confirm it is powered on, logged in, not asleep, and has network/internet. If that PC has been shut down, switched to Wi-Fi, or moved to a different network, card processing will not work.

Step 5 — Restart the Shift4 UTG service

1. On the UTG computer, press Windows + R, type services.msc, press Enter.
2. Find Shift4 UTG2 (it may appear as Universal Transaction Gateway).
3. Right-click it → Restart.
4. Confirm Status = Running and Startup Type = Automatic.
5. Wait 2–3 minutes for it to fully initialise. Do not test before that.

If Restart throws an error, open Task Manager, end the task named Shift4 Gateway, then restart the service again.

Step 6 — Run a $1 EMV test

From the Stayflexi folio, run a $1 card transaction. The PIN pad should light up and display the amount. If it does, void or refund the test and you are done.

If it still fails, do not keep retrying. Capture the error as described in §4 and raise a ticket with that screenshot attached.

---

4. Capturing the real error (Chrome Network tab) Front desk Ops

This is the single most valuable thing a front desk agent can do before escalating. The browser knows exactly why the call failed; the PMS screen does not show it.

1. In Chrome, on the Stayflexi tab, press F12 (or Ctrl + Shift + I / Cmd + Option + I).
2. Click the Network tab at the top of the panel that opens.
3. Tick Preserve log.
4. Now run the $1 EMV transaction again.
5. Look for a row named sale with a path like /api/rest/v1/transactions/sale. It will usually be highlighted in red.
6. Screenshot the whole panel. Then click the sale row → Headers tab, and screenshot the Request URL as well.

Two things to read off that screenshot:

• The Status column — this is the error code you will match in §5.
• The Request URL — this is the IP and port Stayflexi is calling. It must match the property PC’s actual IP address.

---

5. Error decoder

Browser / network errors

UTG error codes returned by Shift4

---

6. Ops procedures Stayflexi Ops

Procedure A — Stop the service and open TuneUp

TuneUp is the UTG’s configuration editor. It will refuse to start while the service or the Stand Alone app is running.

1. Press Windows + R → services.msc → Enter.
2. Find Shift4 UTG2 → right-click → Stop.
3. Open Task Manager and confirm Shift4 Gateway is no longer running. End it if it is.
4. Launch TuneUp: Start → Shift4 (or Shift4 Payments) → UTG (v2) TuneUp.

If the TuneUp shortcut is missing, you can create it — TuneUp is just the UTG executable launched with a flag:

Target:  C:\shift4\utg2\utg2.exe -t

Navigate to C:\Shift4\UTG2, right-click UTG2 → Create Shortcut → Properties → Shortcut tab → append -t to the Target → rename it “UTG TuneUp”.

Procedure B — Verify and fix the UTG IP address

This is the fix for ERR_CONNECTION_TIMEOUT and for “it stopped working after a restart”.

B1. Find the PC’s actual IP address

Open Command Prompt and run:

ipconfig

Note the IPv4 Address of the active adapter — for example 192.168.1.14. This is the true, current address. Everything else must be made to match it.

B2. Check the Express tab

In TuneUp, open the Express tab and look at Host Address. It is a drop-down of the addresses available on this machine.

• If it is empty — this is the classic failure. The old IP disappeared when the machine got a new one, so the setting was blanked out.
• If it shows a different IP than ipconfig reported, it is stale.

Select the correct current IP address from the drop-down.

B3. Check the API Interfaces tab

Open the API Interfaces tab and select the REST interface. Verify:

• Host Address — same current IP as above.
• Port — normally 277. (Stand Alone displays ports in hex, where 277 appears as $0115. That is the same number, not an error.)
• Max Connections — default is 6. On a busy property, ask Shift4 to raise this if you see intermittent refusals under load.

B4. Save and test

Click Save (TuneUp closes). Then continue to Procedure G to verify with Stand Alone before putting the service back.

Procedure C — Verify the API Terminal ID

The API Terminal ID identifies which PIN pad a transaction should go to. It is set per device, not on the interface.

1. In TuneUp, open the Devices tab.
2. Find the PIN pad and read its API Terminal ID exactly — it is 1–32 alphanumeric characters and is case-sensitive. For Stayflexi properties it is usually 0001, but never assume; read it.
3. This value must match the API Terminal ID stored in Stayflexi Meta exactly. A mismatch produces error 9956 TID NO PINPAD.

Procedure D — Update Stayflexi Meta

Meta holds the two values Stayflexi uses to reach the UTG.

Include the https:// prefix and the trailing slash. Save, then have the front desk hard-refresh their browser before retesting.

Onboarding note — access tokens

Before a new install session, confirm the merchant is visible on the Shift4 partner portal and that you hold a valid AUTH token. Generate the access token in Meta using that AUTH token and save it.

If you see AuthToken not valid ENGINE27S7, the auth token is not valid. Use the Reissue token button in the partner portal to generate a fresh one and retry. If reissuing also fails, escalate to Shift4.

Note: merchants under Blisspoint are not visible on the partner portal — request the token from Shift4 directly.

Procedure E — Prove the UTG is actually listening

Do this before blaming certificates or Meta. It isolates “is the gateway alive at all” from everything else.

E1. Shift4’s browser test

With the UTG running (service or Stand Alone), open a browser on the property PC and go to:

https://<UTG-IP>:277/api/rest/v1/

E2. Confirm the UTG owns the port

In Command Prompt:

netstat -n -a -o | find "LISTENING"

Find the line for port 277 and note the PID in the last column. Cross-check that PID in Task Manager’s Details tab — it should belong to the UTG, not some other application.

E3. The negative control

This is the test that catches an impostor. Stop the Shift4 UTG2 service, then test the port again:

Test-NetConnection -ComputerName <UTG-IP> -Port 277

With the UTG stopped, this must fail. If it still succeeds, a different program has taken port 277 and the UTG can never bind to it. Restart the service and the test should succeed again.

Procedure F — Regenerate and reinstall the certificate

Use this for ERR_CERT_AUTHORITY_INVALID, ERR_CERT_INVALID, and ERR_SSL_SERVER_CERT_BAD_FORMAT.

The UTG presents a self-signed certificate. Two separate things must be true: the certificate must have been generated for the IP address the browser is calling, and the PC must trust it. An IP change breaks the first; a fresh PC or a skipped install step breaks the second.

F1. Remove the old certificate first

A stale certificate issued for the previous IP is the most common reason a reinstall “doesn’t help”. Check the Windows trust store (F4 below) and delete any previous Shift4 UTG certificate before importing the new one.

F2. Generate the new certificate

1. Stop the service and open TuneUp (Procedure A).
2. Go to API Interfaces, select the REST interface, and click Generate Certificate.
3. Fill in the property details — Common Name, Organization, Locality, State/Province, Country (USA).
4. Enter both IP addresses the UTG will listen on:
   • the loopback address 127.0.0.1, and
   • the machine’s actual current IP (from ipconfig).

   This field is what binds the certificate to the address. Get it wrong and you will get ERR_CERT_AUTHORITY_INVALID no matter how many times you reinstall.

5. Select SelfSigned.
6. Set the password to 123456 (the value Stayflexi installs use).
7. Leave Embed Key unchecked. This produces two separate files — a certificate file and a key file — which is what the next step expects.
8. Click Generate, choose a save location, and wait for SUCCESS.

F3. Bind it to the REST interface

Still in the REST interface window: Browse to the newly created certificate file, and then the key file. If the files do not appear in the dialog, change the file-type filter to All Files. Enter the certificate password (123456). Click Save.

F4. Install it into the Windows trust store

This must be done at the computer level so it applies to every user on that PC. Local admin rights are required.

1. Press Windows + R → mmc.exe → Enter.
2. File → Add/Remove Snap-in → select Certificates → Add.
3. Choose Computer account → Next → Local Computer → Finish → OK.
4. Expand Certificates (Local Computer) → Trusted Root Certification Authorities.
5. Right-click Certificates → All Tasks → Import.
6. Browse to the new certificate. If it is not listed, change the file-type filter to *.*.
7. On the store page choose Place all certificates in the following store → Trusted Root Certification Authorities.
8. Next → Finish. You should see “The import was successful.”

Close and reopen Chrome completely afterwards — it caches certificate decisions.

Procedure G — Verify with Stand Alone, then hand back to the service

Never go straight from TuneUp back to the service. Stand Alone shows you live status that the service hides.

1. Launch UTG (v2) Stand Alone as administrator: Start → search “UTG” → UTG (v2) Stand Alone → Run as administrator. (Or run C:\Shift4\UTG2\UTG2.exe as admin.)
2. Watch the Devices section at the top. Wait until the device status reads Idle or Listening. A device stuck on Start-Up or Abort Failure signals a misconfiguration — recheck Procedures B and C.
3. Check Global Status reads Ready No Failures. WaitKeyPage or Offline means it has not registered with the data centre yet — give it a moment, then investigate connectivity.
4. Run the browser test from Procedure E1.
5. Run a $1 EMV transaction from Stayflexi with the Chrome Network tab open. The PIN pad should display the amount.
6. Once it works: close Stand Alone via File → Exit → Yes (use Override first if it will not close).
7. Restart the Shift4 UTG2 service and confirm Startup Type is Automatic.
8. Wait 2–3 minutes for the service to initialise, then run one final $1 test.

If you see !UNMANAGED! Running in Stand Alone, it simply means a previous session was closed improperly (via the X or Task Manager). The gateway still works — it is not an error to chase.

---

7. The root cause behind most escalations: IP drift

Most repeat Shift4 tickets trace back to a single omission at install time: the property PC was never given a static IP address.

The failure plays out like this:

1. The PC gets its address automatically from the router (DHCP).
2. Someone reboots the PC, or the router reassigns addresses, or the machine is re-imaged.
3. The PC now has a different IP address.
4. The UTG’s own configuration and Stayflexi Meta both still hold the old address.
5. Every card transaction fails, and the PIN pad shows “This Lane is Closed”.

Shift4’s documentation is unambiguous: an internal static IP address is required on every machine with the UTG installed, and configuring it is the merchant’s responsibility. Where a site will not assign a static address, a DHCP reservation for that machine is an acceptable equivalent.

What to do when this happens

1. Tell the property to contact Shift4 support and ask them to configure a proper static IP on the machine and update the UTG. Shift4 only
2. Once Shift4 confirms the new address, Stayflexi Ops must update Meta (Procedure D) — otherwise transactions will still fail even though Shift4 consider the job done. Ops
3. If the certificate was issued against the old IP, it must also be regenerated (Procedure F).

---

8. Escalating to Shift4

Escalate to Shift4 — do not attempt yourself

• The Shift4 UTG2 service does not exist (UTG was never installed as a service)
• The IP address needs to change after transactions have been processed — the slot requires Shift4 re-activation
• Static IP configuration on the property’s network
• Invalid Serial / Slot activation code errors
• UTG reinstallation, or reinstalling on replacement hardware (a new install generates a new GUID and needs slot reactivation)
• Persistent 9833 / offline errors after connectivity has been confirmed
• PIN pad hardware faults or replacements

Have this ready before you call

Shift4 support contacts

Go to shift4.com/support and choose Chat Support, Phone Support, or Email Support. Selecting phone support prompts you to pick a region. Stayflexi properties on Shift4 are in the United States and Canada only — use the matching line below.

Shift4 operate separate teams: Installations (serial/slot issues and scheduling), Support (IP re-activation and configuration), and Customer Support. Saying which one you need at the start of the call saves a transfer.

---

9. Appendix

Ports

File paths and commands

Reference documentation

• Shift4 — UTG Installation and Configuration Guide
• Shift4 — UTG Error Codes reference
• Shift4 — UTG Stand Alone Guide
• Shift4 — Perform a Browser Test with the UTG
• Shift4 — Start or Stop the UTG Stand Alone
• Shift4 — Start or Stop a Service in Windows
• Shift4 — Troubleshoot a Downed PIN Pad
• Shift4 — UTG FAQs