Hello,
If you're using the legacy mode (which is not recommended)
The URL is called from a form and it should include some POST data (the Stripe Token) to finalize the order paiement
If you're using the 3DSecure mode :
The URL is called from the javascript and you should never got it in your browser.
Regards,
Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.
Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.