SHIFT4 UTG Troubleshooting Guide

Card terminal not responding? Nine times out of ten the problem is not the card reader and not Stayflexi — it is the Shift4 Universal Transaction Gateway (UTG), a small Windows program that sits between the two. This guide takes you from “the terminal is dead” to a working $1 test charge, and tells you exactly when to stop and call Shift4.

Who does what:
Front desk steps need no admin rights and no training.
Stayflexi Ops steps need Windows admin access on the property’s PC.
Shift4 only steps must not be attempted by us — Shift4 owns them.

---

1. How the Shift4 integration actually works

Understanding this one diagram resolves most tickets, because it tells you which link in the chain is broken.

Key consequences of that design:

• The UTG runs on the property’s own PC. If that PC is off, asleep, or off the network, card payments stop — even though Stayflexi itself is perfectly healthy.
• Stayflexi talks to the UTG by IP address. That address is stored in Stayflexi Meta as the Shift4 UTG URL. If the PC’s IP changes, the stored URL becomes wrong and every transaction fails.
• The connection is HTTPS with a self-signed certificate. The browser must trust that certificate, and the certificate must have been generated for the IP the browser is calling.
• The UTG routes to a specific PIN pad using the API Terminal ID. That ID must match on both sides — in the UTG and in Stayflexi Meta.

---

2. Symptom → cause quick reference

---

3. Front desk: the five-minute check Front desk

Work through these in order before raising a ticket. Most “terminal is dead” reports are resolved by step 4 or 5.

Step 1 — Look at the PIN pad screen

• Blank / no lights: it is a power or cable problem. Go to step 2.
• “This Lane is Closed”: the PIN pad is alive but the UTG is not talking to it. Skip to step 4.
• Shift4 splash screen / idle logo: the PIN pad is healthy. The problem is further up the chain — skip to step 5.

Step 2 — Reseat the cables at both ends

Unplug and firmly re-plug the Ethernet (or USB) cable at both the PIN pad and the network switch or PC. Confirm the switch port shows a link light.

Step 3 — Reboot the PIN pad

Hold the yellow key + # together until the device shuts down, then let it restart. If that key combination does nothing, unplug the power cable, wait ten seconds, and plug it back in. Wait for the Shift4 splash screen.

Step 4 — Confirm the UTG computer is awake and online

Find the property PC that Shift4 installed the UTG on (usually the back-office or front-desk workstation). Confirm it is powered on, logged in, not asleep, and has network/internet. If that PC has been shut down, switched to Wi-Fi, or moved to a different network, card processing will not work.

Step 5 — Restart the Shift4 UTG service

1. On the UTG computer, press Windows + R, type services.msc, press Enter.
2. Find Shift4 UTG2 (it may appear as Universal Transaction Gateway).
3. Right-click it → Restart.
4. Confirm Status = Running and Startup Type = Automatic.
5. Wait 2–3 minutes for it to fully initialise. Do not test before that.

If Restart throws an error, open Task Manager, end the task named Shift4 Gateway, then restart the service again.

Step 6 — Run a $1 EMV test

From the Stayflexi folio, run a $1 card transaction. The PIN pad should light up and display the amount. If it does, void or refund the test and you are done.

If it still fails, do not keep retrying. Capture the error as described in §4 and raise a ticket with that screenshot attached.

---

4. Investigating a case, end to end Front desk Ops

A case almost always arrives looking like this: a red message in the Perform EMV transaction window, and nothing else to go on. The message is passed through from the UTG word for word, so it is a real clue — but on its own it rarely says whose problem it is.

The whole method fits in one sentence: whatever the UTG holds must match what Stayflexi Meta holds. Everything below is how to see both sides, and how to decide who owns the problem once you have.

The two values that have to match

The UTG URL is normally the same for every terminal at a property, because one UTG serves them all. The API Terminal ID is different for each PIN pad. A property with two readers has one URL and two terminal IDs.

Step 1 — Open the card terminal diagnostics

Start here. Every failed terminal attempt is now recorded against the folio, and the word FAILED is a link.

1. Open the booking’s folio and find the failed payment attempt.
2. Click the FAILED label. The Card terminal diagnostics panel opens.
3. Read it top to bottom. It shows the gateway and Terminal ID used, the endpoint that was actually called, the error text, the exact request sent and the exact response received.
4. Click Copy diagnostics and paste the result into the ticket — or hand it straight to Shift4 if they are on the call.

Step 2 — Read the Network tab

Use this when you need more than the diagnostics panel, or when the attempt is older than the diagnostics feature.

1. In Chrome, on the Stayflexi tab, press F12 (or Ctrl + Shift + I on Windows, Cmd + Option + I on Mac).
2. Click the Network tab and tick Preserve log.
3. Run the $1 EMV transaction again and watch the rows appear.

Which row is which

One charge produces four or five rows. Only one of them is the actual card transaction — knowing which saves a lot of wasted reading.

Reading the sale row

Click the sale row. Headers tells you where we called and what came back; Preview tells you why.

Step 3 — Decide who owns it

---

5. Error decoder

Browser / network errors

UTG error codes returned by Shift4

---

6. Ops procedures Stayflexi Ops

Procedure A — Get into the UTG and open TuneUp

This procedure assumes you have never opened the UTG before. Everything here happens on the property’s Windows PC, over a remote session or in person — never on your own laptop.

A1. Understand the three programs before you start

“The UTG” is not one program. It ships as three, and they all run from the same folder, C:\Shift4\UTG2. Knowing which is which prevents most of the confusion.

A2. Stop the Shift4 UTG2 service

1. Press Windows + R together. A small Run box opens in the bottom-left corner of the screen.
2. Type services.msc and press Enter. The Services console opens — a long alphabetical list of every background program on the PC.
3. Scroll down to the letter S and find Shift4 UTG2. On some installs it is listed as Universal Transaction Gateway. Check the Status and Startup Type columns before you change anything, and note what they say.
   

   

4. Right-click Shift4 UTG2 and choose Stop. Wait for the progress box to finish and the Status column to go blank.

A3. Confirm the gateway has really stopped

Stopping the service does not always kill the underlying process, and TuneUp will still refuse to open if it is alive.

1. Right-click the taskbar at the bottom of the screen and choose Task Manager. If it opens small, click More details.
2. Look through the list for Shift4 Gateway. If it is there, select it and click End task. If it is not there, the gateway has stopped cleanly and you can move on.

A4. Open UTG TuneUp

1. Click the Windows Start button and type TuneUp. In most installs UTG (v2) TuneUp appears straight away.
2. If it does not, open Start and look for a folder named Shift4 or Shift4 Payments, then Universal Transaction Gateway, then UTG (v2) TuneUp.
3. Right-click it and choose Run as administrator. TuneUp cannot save changes without it.

If there is no TuneUp shortcut anywhere, it can be recreated. TuneUp is not a separate program — it is the ordinary UTG executable started with a -t flag:

C:\shift4\utg2\utg2.exe -t

Open File Explorer, go to C:\Shift4\UTG2, right-click UTG2 and choose Create Shortcut. Right-click the new shortcut, choose Properties, and on the Shortcut tab add a space and -t to the end of the Target box so it matches the line above. Rename it “UTG TuneUp”.

A5. Find your way around TuneUp

TuneUp opens on a window with tabs across the top. Only three of them matter for the procedures in this guide.

A6. Verifying configuration without being able to change it

If all you need is to read the settings — which is the case for most investigations — there is a safer route than the full editor. With Stand Alone running, open Tune Up from the menu at the top of its window.

TuneUp opened this way is read-only. Every field is greyed out and the window has only a Close button, with no Save. You can move through Express, API Interfaces and Devices and confirm every value, with no risk of changing something by accident.

Procedure B — Verify and fix the UTG IP address

This is the fix for ERR_CONNECTION_TIMEOUT and for “it stopped working after a restart”.

B1. Find the PC’s actual IP address

Open Command Prompt and run:

ipconfig

Note the IPv4 Address of the active adapter — for example 192.168.1.14. This is the true, current address. Everything else must be made to match it.

B2. Check the Express tab

In TuneUp, open the Express tab and look at Host Address. It is a drop-down of the addresses available on this machine.

• If it is empty — this is the classic failure. The old IP disappeared when the machine got a new one, so the setting was blanked out.
• If it shows a different IP than ipconfig reported, it is stale.

Select the correct current IP address from the drop-down.

B3. Check the API Interfaces tab

Open the API Interfaces tab and select the REST interface. Verify:

• Host Address — same current IP as above.
• Port — normally 277. (Stand Alone displays ports in hex, where 277 appears as $0115. That is the same number, not an error.)
• Max Connections — default is 6. On a busy property, ask Shift4 to raise this if you see intermittent refusals under load.

B4. Save and test

Click Save (TuneUp closes). Then continue to Procedure G to verify with Stand Alone before putting the service back.

Procedure C — Verify the API Terminal ID

The API Terminal ID identifies which PIN pad a transaction should go to. It is set per device, not on the interface.

C1. Read the ID the UTG actually has

1. In TuneUp, open the Devices tab.
2. Find the PIN pad and read its API Terminal ID exactly — it is 1–32 alphanumeric characters and is case-sensitive. For Stayflexi properties it is usually 0001, but never assume; read it.
3. This value must match the API Terminal ID stored in Stayflexi Meta exactly. A mismatch produces error 9956 TID NO PINPAD.

C2. Properties with more than one terminal

Many properties run two or more card readers — for example one at each front desk position. On those, the EMV window shows a Terminal Id(s) drop-down listing entries like Terminal - FD1 - 0001 and Terminal - FD2 - 0002. The number on the end is that terminal’s own API Terminal ID, and whichever entry the agent picks is the ID sent to the UTG for that charge.

Each terminal in Stayflexi carries its own API Terminal ID and its own UTG URL. They normally share one UTG URL, because a single UTG serves every PIN pad at the property, while each PIN pad gets a distinct API Terminal ID.

C3. Diagnosing “not configured for any PinPad”

1. Note the number in the message. That is the API Terminal ID Stayflexi sent, and it came from whichever terminal the agent selected in the drop-down.
2. Confirm the same value appears on that terminal’s entry in Stayflexi. If the drop-down showed FD2 - 0002, Stayflexi sent 0002 — that part is working.
3. Open TuneUp on the property PC (Procedure A) and go to the Devices tab. Check whether a PIN pad exists with that exact API Terminal ID.
4. If only the first terminal is listed, the Stayflexi side is correct and the remaining work is Shift4’s. Ask Shift4 to add and configure the second PIN pad in the UTG with API Terminal ID 0002. Do not change anything in Meta.
5. If a PIN pad with that ID does exist, compare it character by character — it is case-sensitive — and correct whichever side is wrong.

Procedure D — Update Stayflexi Meta

Meta holds the two values Stayflexi uses to reach the UTG.

Include the https:// prefix and the trailing slash. Save, then have the front desk hard-refresh their browser before retesting.

Onboarding note — access tokens

Before a new install session, confirm the merchant is visible on the Shift4 partner portal and that you hold a valid AUTH token. Generate the access token in Meta using that AUTH token and save it.

If you see AuthToken not valid ENGINE27S7, the auth token is not valid. Use the Reissue token button in the partner portal to generate a fresh one and retry. If reissuing also fails, escalate to Shift4.

Note: merchants under Blisspoint are not visible on the partner portal — request the token from Shift4 directly.

Procedure E — Prove the UTG is actually listening

Do this before blaming certificates or Meta. It isolates “is the gateway alive at all” from everything else.

E1. Shift4’s browser test

With the UTG running (service or Stand Alone), open a browser on the property PC and go to:

https://<UTG-IP>:277/api/rest/v1/

E2. Confirm the UTG owns the port

In Command Prompt:

netstat -n -a -o | find "LISTENING"

Find the line for port 277 and note the PID in the last column. Cross-check that PID in Task Manager’s Details tab — it should belong to the UTG, not some other application.

E3. The negative control

This is the test that catches an impostor. Stop the Shift4 UTG2 service, then test the port again:

Test-NetConnection -ComputerName <UTG-IP> -Port 277

With the UTG stopped, this must fail. If it still succeeds, a different program has taken port 277 and the UTG can never bind to it. Restart the service and the test should succeed again.

Procedure F — Regenerate and reinstall the certificate

Use this for ERR_CERT_AUTHORITY_INVALID, ERR_CERT_INVALID, and ERR_SSL_SERVER_CERT_BAD_FORMAT.

The UTG presents a self-signed certificate. Two separate things must be true: the certificate must have been generated for the IP address the browser is calling, and the PC must trust it. An IP change breaks the first; a fresh PC or a skipped install step breaks the second.

F1. Remove the old certificate first

A stale certificate issued for the previous IP is the most common reason a reinstall “doesn’t help”. Check the Windows trust store (F4 below) and delete any previous Shift4 UTG certificate before importing the new one.

F2. Generate the new certificate

1. Stop the service and open TuneUp (Procedure A).
2. Go to API Interfaces, select the REST interface, and click Generate Certificate.
3. Fill in the Subject box — Common Name, Organization, Email Address, Locality, State/Province and Country. Stayflexi installs use stayflexi, support@stayflexi.com and usa, with the property’s own town and state.
4. In the Subject Alternative Name (SAN) box, click the IP tab and enter both addresses, one per line:
   • 127.0.0.1
   • the machine’s actual current IP address, from ipconfig

   This box is what binds the certificate to the address. Get it wrong and you will see ERR_CERT_AUTHORITY_INVALID no matter how many times you reinstall.

5. Under Certificate Generation Options, tick SelfSigned, Server Authentication and Client Authentication. Leave CA SelfSign and CA Intermediate unticked.
6. Under Cert Type, choose CRT and leave Embed Key unticked. Unticking it is what produces two separate files — a certificate and a key — which is what the next step expects.
7. Set Key Size to 4096 bit. Leave the Dates at their default ten-year span unless Shift4 says otherwise.
8. Type the Password: 123456 (the value Stayflexi installs use).
9. Click Generate, choose a save location, and wait for SUCCESS.

F3. Bind it to the REST interface

Still in the REST interface window: Browse to the newly created certificate file, and then the key file. If the files do not appear in the dialog, change the file-type filter to All Files. Enter the certificate password (123456). Click Save.

F4. Install it into the Windows trust store

This must be done at the computer level so it applies to every user on that PC. Local admin rights are required.

1. Press Windows + R → mmc.exe → Enter.
2. File → Add/Remove Snap-in → select Certificates → Add.
3. Choose Computer account → Next → Local Computer → Finish → OK.
4. Expand Certificates (Local Computer) → Trusted Root Certification Authorities.
5. Right-click Certificates → All Tasks → Import.
6. Browse to the new certificate. If it is not listed, change the file-type filter to *.*.
7. On the store page choose Place all certificates in the following store → Trusted Root Certification Authorities.
8. Next → Finish. You should see “The import was successful.”

Close and reopen Chrome completely afterwards — it caches certificate decisions.

Procedure G — Verify with Stand Alone, then hand back to the service

Never go straight from TuneUp back to the service. Stand Alone shows you live status that the service hides.

1. Launch UTG (v2) Stand Alone as administrator: Start → search “UTG” → UTG (v2) Stand Alone → Run as administrator. (Or run C:\Shift4\UTG2\UTG2.exe as admin.)
2. Watch the Devices section at the top. Give it up to five minutes to come up, and wait until the device status reads Idle or Listening — Idle means the device is ready to take a payment. A device stuck on Start-Up or Abort Failure signals a misconfiguration — recheck Procedures B and C.
3. Check Global Status reads Ready No Failures. WaitKeyPage or Offline means it has not registered with the data centre yet — give it a moment, then investigate connectivity.
4. Run the browser test from Procedure E1.
5. Run a $1 EMV transaction from Stayflexi with the Chrome Network tab open. The PIN pad should display the amount.
6. Once it works: close Stand Alone via File → Exit → Yes (use Override first if it will not close).
7. Restart the Shift4 UTG2 service and confirm Startup Type is Automatic.
8. Wait 2–3 minutes for the service to initialise, then run one final $1 test.