Returning customers order flow (SSO in Cart)

Overview

2Checkout supports a streamlined order flow for returning customers (SSO in Cart) using ConvertPlus and Inline Cart. When a vendor generates a signed checkout link that includes a customer identifier, 2Checkout automatically retrieves the customer's billing details and saved payment methods, allowing them to complete a purchase with minimal effort.

Optionally, the cart and customer details can also be locked, so the shopper cannot edit the cart, billing, or delivery information during an SSO session.

It is compatible with new acquisition, manual renewal, trial and retry order flows, for catalogue products.

Availability

The returning customers order flow(SSO in Cart) must be enabled on your merchant account before it can be used. Contact 2Checkout Support or your account manager to enable the setting.

How it works

When a returning customer accesses a checkout link that meets all the conditions below (see Requirements), 2Checkout:

1. Retrieves and prefills the customer's billing details from their 2Checkout account.
2. Presents the saved payment methods as selectable options in the payment area, along with other available payment methods.
3. If the checkout link also includes the lock and lock-customer parameters, the cart, billing, and delivery details are presented as read-only instead of editable.

Requirements

The returning customers order flow is activated when all of the following conditions are satisfied:

Requirement	Details
Feature enabled	The SSO in Cart setting is active on your merchant account.
Customer identifier	The buy-link includes either customer-ref (2Checkout customer reference) or customer-ext-ref (external customer reference).
Valid expiration	The buy-link includes an expiration parameter set to a UTC Unix timestamp in the future.
Valid signature	The buy-link is signed with a valid HMAC-SHA256 signature using your Buy Link Secret Word and includes all needed parameters.

Checkout link setup

Parameters

The following parameters are relevant to returning customer checkout links. Parameters marked as Signed must be included in the signature calculation.

Parameter	Required	Signed	Description
customer-ref	One of the two	Yes	The numerical 2Checkout customer reference ID.
customer-ext-ref	One of the two	Yes	The external (vendor-side) customer reference.
expiration	Yes	Yes	UTC Unix timestamp indicating when the buy-link expires. e.g. expiration=1893456001
signature	Yes	—	HMAC-SHA256 hash generated from your signed parameters. See Signature generation.
lock	No	Yes	When present, locks all cart content and thus makes it non-editable.
lock-customer	No	Yes	When present, locks all customer, billing delivery and shopping information and takes the user directly to the Review step of the Checkout flow. Compatible with new acquisition orders.

A Unix timestamp is just a count of seconds that have elapsed since a fixed reference point in time — 00:00:00 UTC on January 1, 1970 (called "the Unix epoch"). It's a single integer, with no timezone info attached to it at all - that's actually the point of it.

Signature generation

See also ConvertPlus Buy-Link signature for catalog products.

1. Collect all parameters that require signing. The signature must include all parameters marked Signed above, plus any other buy-link parameters you are signing (such as return-url, return-type, order-ext-ref, product parameters, etc.).
2. Sort them alphabetically by parameter name.
3. Serialize each value by prefixing it with its character length.
4. Concatenate the serialized values without separators.
5. Hash the resulting string using HMAC-SHA256 with your Buy Link Secret Word.
6. Append the hash as the signature parameter to your buy-link URL.

Buy link with SSO in Cart example:

https://secure.2checkout.com/checkout/buy?merchant=MERCHANT_CODE&prod=PRODUCT_CODE_1&customer-ref=CUSTOMER_REFERENCE&expiration=1893456001&signature=GENERATED_SIGNATURE

How to test the link

Open the link and confirm:

• Billing details prefill from the matched customer.
• Saved, non-expired cards show up in the payment area, with the CVV field blank.
• Apple Pay / Google Pay / PayPal (if enabled) and other payments methods are still selectable.
• Placing an order with the prefilled card completes successfully.

What shoppers see

1

Editable SSO in Cart use case

• Billing fields prefilled with shoppers' account information (name, email, phone, billing address), based on the customer reference. Shoppers can review and edit these details before placing the order.
• A dedicated Card details section on the right displaying the credit and debit cards associated with their 2Checkout account from previous transactions.

Variant 1 — Editable checkout with pre-filled billing details and saved cards. The Card details section shows saved cards with an empty Security code field.

2

Non-editable checkout flow

If you want to guarantee that a pre-configured cart and customer record stay unchanged all the way through payment - regardless of how the shopper authenticated - combine lock-customer with the existing lock parameter alongside your SSO parameters (customer-ref/customer-ext-ref, expiration, signature).

• lock - for locking the cart content and
• lock-customer for locking the customer billing/delivery details. In this case, shoppers who land on the Review page need to enter only the CVV of the saved card and place the order.

Variant 2 — Locked checkout with pre-filled billing details and saved cards. The Card details section shows saved cards with an empty Security code field.

Saved payment methods behavior

• Only valid, non-expired cards are displayed.
• CVV required: The Security code (CVV) field is empty for all saved cards. Shoppers must enter their CVV to confirm their intention to use the selected card. This is required because the transaction is treated as a Customer Initiated Transaction (CIT).
• If the shopper does not enter a CVV, they cannot proceed with the saved card.
• Shoppers can also choose to pay with a new card or use an available alternative payment method (e.g. Apple Pay, Google Pay, PayPal Express) instead of a saved card.

What is not prefilled:

• B2B US 2Checkout tax-exempt ID
• Shipping details (for PSP accounts) - merchants can still use shipping parameters to pre-populate these fields.

Fallback: If no valid saved cards are found for the customer, or the customer reference does not match any account, the saved cards section is not displayed. The checkout loads normally with a standard payment form.

Supported templates

Cart type	Supported templates
ConvertPlus	All templates
Inline Cart	All templates

Troubleshooting quick reference

What you see	Likely cause
Standard, non-prefilled checkout	Merchant setting disabled, missing/invalid signature, expired link, or missing (valid, active)customer reference
Empty cart	customer-ref / customer-ext-ref doesn't match any customer on the account
Checkout loads but no saved card shown	Customer exists but has no valid (non-expired) card on file — billing details may still prefill
Pre-filled checkout instead of the review page	Not all mandatory billing and/or delivery details are available on the customer saved in the 2Checkout system or the lock-customer parameter not applied.