One-Click Checkout
One-click checkout lets a returning shopper complete a purchase with a single confirmation, using payment and delivery details stored from a previous order — a network token, a saved address, a tap or a fingerprint. Amazon patented the pattern in 1999 and it expired in 2017; wallets, tokens and checkout networks then made it available to every merchant, and Europe's SCA rules made it a question of exemptions.
- Also known as
- One-tap checkout, Express checkout, Stored-credential checkout
- Used at
- any merchant with returning customers — marketplaces, retailers, food delivery, app stores; checkout networks extend it across merchants, so a shopper known to the network is one-click at a shop they have never visited
- Binding
- PCI DSS on stored credentials (tokens, not numbers), the schemes' stored-credential and merchant-initiated-transaction framework, SCA in Europe (a customer-present one-click purchase is a new payment and needs authentication or an exemption; the exemptions and low-value rules make most of them frictionless)
- Typical effect
- repeat-purchase conversion far above first-purchase — merchants report 20–40% higher conversion for stored-credential checkouts, and checkout networks claim similar uplifts for their recognised shoppers
- Typical mechanics
- the card stored as a network token at the first purchase with the customer's consent; a device or account recognised; a single confirmation with biometric or a CVV re-entry; authentication frictionless where the issuer or an exemption allows
- Parties
- the merchant, its PSP or checkout network, the schemes (tokens, Click to Pay), the issuer (authentication), and the shopper who gave consent once
How one-click checkout works in practice
A customer buys from a retailer for the first time: a guest checkout with a wallet tap, and a consent to save the card — stored as a network token bound to the merchant. Three weeks later she returns; the site recognises her device and email; the checkout shows her saved address and card ending 4412, and a single "Buy now" button. She taps; the merchant charges the token; in Europe, the transaction is a customer-initiated payment and needs SCA — the PSP requests a low-value or TRA exemption, the issuer accepts, and no challenge appears; or the issuer authenticates frictionlessly on the rich data; or, on a large purchase, a fingerprint prompt in her banking app is the click. The purchase is confirmed in three seconds.
The pattern's spread is a story of infrastructure. Amazon's patent kept the exact flow proprietary for eighteen years; when it lapsed, the pieces to replicate it were already commodity — tokens from the schemes, wallets from the phone makers, checkout networks from Shopify and Stripe that recognise a shopper across every merchant using them. What remains hard is regulation: SCA makes every customer-present payment authenticable, and one-click survives it only by exemption strategy, data quality and merchant-initiated flags for the flows where the customer is genuinely absent.
For a merchant, one-click is repeat-purchase conversion; for a checkout network, it is the reason merchants join; for a buyer of either, the share of purchases completed in one click is a retention metric with a payments explanation.
Example
A food-delivery app has 2 million customers with stored cards as PSP tokens and a checkout that re-asks for the CVV and runs a 3DS challenge on every order. Conversion at payment: 88%; average time at checkout 40 seconds. It migrates to network tokens, requests low-value exemptions (most orders are under €30) and TRA exemptions above that, populates full 3DS data, and rebuilds the flow to one confirmation with a biometric. Conversion at payment: 96%; time at checkout 6 seconds; challenge rate 6%; fraud rate unchanged at 0.04%. On €300m of annual orders the uplift is about €27m of completed orders that were previously abandoned at a step the app had built to feel safe.
Common mistakes
- Re-asking for the CVV and running a challenge on every repeat purchase because someone was cautious in 2018. - Stored cards as proprietary tokens that cannot move with the merchant or be updated by the scheme. - Treating a customer-present repeat purchase as merchant-initiated to skip SCA, which the schemes and regulators police. - One-click without a clear consent at the first purchase, which the stored-credential rules require. - Measuring first-purchase conversion and never repeat-purchase conversion, where one-click lives.