Various embodiments of a hosted payment service are disclosed. In some embodiments, a merchant can enable customer use of the payment service by adding a line or sequence of widget code to a web page, such as a shopping cart page, of the merchant's site. Thereafter, a user who is registered with the payment service can invoke the payment service and complete a purchase transaction directly from the merchant site. For example, while viewing a shopping cart page, the user may be able to securely interact with the payment service and complete the purchase transaction via a transaction display object that is incorporated into the shopping cart page. In some embodiments, the transaction display object prompts the registered customer to enter a secondary authentication input, and the payment service uses this input in combination with a browser cookie to authenticate the user.