Frictionless Payment Update

Let subscribers update their payment method without the friction of logging in with the Frictionless Payment Update. Reduce failed orders and improving retention automatically.

What is the Frictionless Payment Update?

The Frictionless Payment Update modifies the payment update flow on Shopify; it's a self-serve page where subscription customers can update their credit card on file. Frictionless Payments was designed to remove barriers from the recovery process: customers arriving from a payment failure email don't need to create a session or remember a password. They simply click a link, enter their new card details, and they're done.

The page handles everything behind the scenes — creating the updated payment method in Shopify, syncing it to Ordergroove, and automatically retrying orders that failed due to the original payment issue.

Note: Your store must be on Shopify, and use Ordergroove's built-in emails or our Klaviyo or Attentive integration to offer Frictionless Payment Updates. Headless stores are not yet supported.

The Customer Journey

There are two ways a customer can reach the payment update page:

Via Email Link (No Login Required)

This is the primary flow. When a subscription order fails due to a payment issue, the customer receives an email containing a secure, time-limited link. 

When they click the link:

1. The customer lands on the payment update page on your storefront.
2. Their email address is displayed for confirmation, with an option to switch accounts if needed.
3. A banner notifies them that their order couldn't be processed and prompts them to update.
4. The customer enters their full name, card number, expiration date, CVV, and billing ZIP.
5. The system attempts to match the billing ZIP to an address already on file.
   • If a match is found, the payment update is processed immediately.
   • If no match is found, the customer is asked to enter their full billing address before proceeding.
6. A success screen confirms the update.
7. The new payment method is applied to all of their subscriptions in Ordergroove. 
8. Ordergroove looks for any orders the customer has in retry. If there are no orders with an upcoming retry set, we will instead reattempt the most recently rejected order (within the last 30 days).

Logged-In Form

Customers who are already logged into the storefront, for example through the Subscription Manager, can access the same page without a link token. The experience is identical, except the order details banner is not shown in this case.

Expired or Invalid Links

If a customer clicks an expired or invalid link and is not logged in, they'll see a message letting them know the link is no longer valid, along with a prompt to log in to their account to access the payment update page directly.

How it Works

The Frictionless Payment Update flow is powered by a magic link token — a secure, single-use token tied to a specific customer's payment failure. When inserted into a payment update URL, this token authenticates the customer and lets them update their card without logging in.

There are three ways to deliver this magic link token to your customers:

• Ordergroove transactional emails
• Klaviyo
• Attentive

Note: For non-Ordergroove transactional emails (Klaviyo and Attentive), the magic link token is available in the root object of the event.

Set up Frictionless Payments

1. Enable Frictionless Payments

Reach out to Ordergroove, while the feature is in early access we need to enable it for you.

2. Verify it's working

Visit your payment update page. If the feature is enabled, you should see either the payment form or an error page if no customer session is present. If it's not enabled, you'll get a 404. Take a look here, replace merchant-store with your store URL:

https://merchant-store.myshopify.com/apps/subscriptions/payment-update

3. Apply the URL to your templates

Add the payment update URL to your email and SMS templates in hyperlinks and buttons to redirect customers to the new Payment Update Page. The URL format depends on where your messages are sent from.

Ordergroove Transactional Emails

If you use Ordergroove's built-in transactional emails, the token is already wired into your Order Not Placed - CC Issue template. Add the following URL to your email templates in hyperlinks and buttons:

https://{{store_domain}}/apps/subscriptions/payment-update?token={{payment.payment_update_token}}

Klaviyo

If you send your payment failure communications through Klaviyo, use the URL below. The frictionless payment update token is available on the order.reject and order.retryable_placement_failure events. Replace merchant-store with your store's URL:

https://merchant-store.com/apps/subscriptions/payment-update?token={{event.frictionless_payment_update_token}}

Attentive

If you send payment failure communications through Attentive — whether by email, SMS, or both — use the URL below. The frictionless payment update token is available on the order.reject and order.retryable_placement_failure events. Replace merchant-store with your store's homepage URL:

https://merchant-store.com/apps/subscriptions/payment-update?token={{triggerEvent.custom[‘frictionless_payment_update_token’]}}

4. Route the Subscription Manager's "Update payment" link

Out of the box, the "Update payment" link in the Subscription Manager doesn't go to your payment update page. Depending on your setup, it routes to Shopify's customer accounts interface, Ordergroove's Shopify billing flow, or an external payment URL you've configured. If you want logged-in customers to land on the Frictionless Payments form instead, you'll need to override your Subscription Manager theme.

This involves editing a theme file in the Advanced editor. Step-by-step instructions are in our developer documentation: Routing the Update payment link to Frictionless Payments.

Testing Frictionless Payments

There are two ways to test Frictionless Payments. If you use Klaviyo, start with the payment update link test. It's quick, doesn't require a failed order, and doesn't send any messages. Then run the full recovery test to confirm the whole flow works, from entering a new card to retrying the failed order. If you use Attentive or Ordergroove's transactional emails, go straight to the full recovery test.

Test your payment update link (Klaviyo)

Use Klaviyo's email preview to confirm that the payment update link in your payment failure emails takes customers straight to the payment form, with no login required. The preview uses details from a real order.reject event in your store, so you'll need at least one recent event in Klaviyo. Because the flow stays in draft, no emails are sent.

1. In Klaviyo, clone one of your existing payment failure flows, or create a new flow triggered by the order.reject event. Keep the flow in Draft.
2. Open the email in the flow and find your "Update Payment" button or link. Its URL should match the Klaviyo URL in Step 3 above, with your store's homepage in place of merchant-store.
3. Preview the email. Klaviyo fills it in with details from a real order.reject event, including the product from the rejected order and a unique token for that customer.
4. In the preview, click the "Update Payment" button.
5. Check that the payment update page:
   • Opens on your storefront without asking you to log in.
   • Shows the payment failure banner and the email address of the customer you're previewing.
6. Close the page without entering any information.

Note: Your storefront will still show a login option on this page. That's expected. The link doesn't sign you in to the customer's account; it only opens this payment form.

If both checks pass, your link is set up correctly. Make sure your live payment failure emails use the same URL, then run the full recovery test below to check the rest of the flow.

Not reaching the payment form? Check the URL in your browser's address bar:

• Wrong site or page not found: Make sure the URL starts with your store's homepage, not merchant-store.com. If the domain is right and you still get a 404, confirm Frictionless Payments is enabled for your store (see Step 2 above).
• Nothing after ?token=: The token isn't filling in. Compare the token variable in your button URL with the Klaviyo URL in Step 3.
• A token is there, but you see a "link no longer valid" message: Links expire after a set time and can only be used once, so the token on that event may have expired or already been used. Switch the preview to a different, more recent event and try again.

Test the full recovery flow

To confirm Frictionless Payments is working end to end, walk a failed order through the full recovery flow using the steps below.

1. Find a subscription that previously failed to place.
2. Trigger another order placement attempt.
3. Wait for the order to enter a rejected or retry state.
4. Look for the email from Klaviyo, Attentive, or from our native provider, depending on your setup.
5. Click the payment update link (if that's what you're testing), or go directly to the payment form URL.
6. On the payment form, enter one of the following test cards, then submit: 4111111111111111, 5555555555554444, or 378282246310005.
7. Wait for the order to be retried (if it's in a retry state), or click Send Now on the next upcoming order for this subscription.
8. Confirm the order goes through successfully.

Best Practices for Klaviyo and Attentive Messaging

Because you control the formatting of your own Klaviyo and Attentive emails and SMS, the way you design these messages matters. A short link with no context can easily look like a phishing attempt — especially in SMS — and customers may hesitate to click.

To make sure your messages feel trustworthy and drive action, we recommend including the following:

• Clear, prominent messaging tied to what the customer wants. Lead with the outcome — for example, "Update your card to keep your subscription on track" — so it's immediately clear why they're receiving the message and what they get by clicking.
• Personal identifying information. Include details only the real customer would expect to see, such as the order number, order value, and the specific product items in the subscription. This signals legitimacy and reassures the customer the message is not fraud.
• A large, obvious call-to-action. Make the "Update Payment" button or link the most prominent element of the message. Avoid burying the link in small text or behind ambiguous phrasing.

Tip: Treat these messages the same way you'd treat an order confirmation — branded, specific, and full of recognizable details. The more the message looks like something the customer expects from you, the more likely they are to click through and complete the update.

Security

Card Data Never Touches Our Servers

Card details are entered into secure iframes hosted by a third party, a PCI-compliant payment tokenization provider. The card number and CVV never pass through Ordergroove's servers or the merchant's website - only a one-time-use token is returned, which is then used to create the payment method in Shopify.

Secure, Single-Use Email Links

Each link sent to a customer is cryptographically signed and tied to a specific customer and merchant. Links expire after a set period of time and can only be used once — replaying a link after a successful update will be rejected.

Protection Against Email Impersonation

If a customer's email contains international or special characters (punycode), the page displays a visual warning to help prevent lookalike email addresses from being used to impersonate another customer.

Shopify Proxy Authentication

All page requests are routed through Shopify's App Proxy, which verifies the request signature before forwarding it to Ordergroove's servers. This means the payment update page can only be accessed through the merchant's own storefront domain.

Availability

The Frictionless Payment Update is currently in early access. This feature is being offered for free for a limited time. To learn more or get set up, please reach out to your CSM.