How it works
When Shopify marks an order as paid, Alva Digital Downloads calls the Shopify Risk API for that order. Orders rated HIGH (and MEDIUM, when the high-risk threshold is enabled in settings) land in the queue as a FraudCheckAction. Alva pauses the download email, holds license-key assignment, and waits for your decision. LOW and NONE orders skip the queue and ship immediately.
Review and decide
1. Open Flagged Orders
In the Alva admin, click Flagged Orders in the left navigation. The Active tab lists every order held for review. The Archive tab shows past decisions.
Alva admin → Flagged Orders page, Active tab. Show the table with three example rows: order ID column, flagged date, risk level (mix of HIGH and MEDIUM badges), auto-fulfilment column, and Approve / Reject buttons in the rightmost column. No real customer data visible.
2. Review the risk signal
Open the same order in Shopify admin in a second tab. Cross-reference Shopify's risk reasons (billing IP, address mismatch, chargeback flags) and customer history before deciding.
Shopify admin order page with the Risk panel highlighted (red box around "High risk" and the assessment reasons list — e.g. "Card transactions attempted with multiple cards", "Billing address is high risk"). No real customer data visible.
3. Approve to release the order
Click Approve on the order row. Alva marks every purchase on the order as fraud-passed, assigns license keys for any tagged products, sends the download email (skipped if the customer already received one in the last five minutes), and runs auto-fulfilment when enabled in settings. The decision moves to the Archive tab.
Close-up of a single Flagged Orders row with the green "Approve" button highlighted (red box around it). Show the row in context with the row above and below visible but unfocused. No real customer data visible.
4. Reject to hold the order
Click Reject. Alva marks every purchase on the order as fraud-failed. No email is sent and no license keys are assigned. Refund or cancel the order in Shopify yourself — Alva does not. The decision moves to the Archive tab and can be reversed by clicking Approve from there.
Close-up of a Flagged Orders row with the red "Reject" button highlighted (red box around it). After the click, show the toast confirmation "Order rejected" and the row moving to the Archive tab. No real customer data visible.
What customers see
While an order sits in the queue, the thank-you page shows no download links and no email arrives. On Approve, the email lands within seconds and the customer-account and order-status pages start showing the files. On Reject, no email is sent and the customer-facing pages stay empty.
Limitations
POS orders skip the fraud queue entirely. POS sales are taken in person, so Alva sends the download email immediately without calling the Risk API.
FAQ
Can I undo a rejection?
Yes. Open the Archive tab in Flagged Orders, find the rejected order, and click Approve. Alva runs the same approval chain — license keys assigned, email sent — as if the decision were fresh.
Does approving send a duplicate email if the customer already received one?
No. Alva checks the email log and skips the send when an AUTO_SEND email for the same customer was logged in the last five minutes.
What happens if license keys are out of stock at approval time?
Alva still approves the order and queues a PendingLicenseKeyAssignment. Keys are issued automatically when stock is restocked or replenished via CSV upload.
Where can I see who approved or rejected an order?
Each decision is recorded against the FraudCheckAction record. The Archive tab in Flagged Orders shows the decision and timestamp. Granular per-merchant attribution is on the roadmap.
See also
Was this helpful?
Last updated 2026-05-06