Guest order lookup
Let shoppers without an account check one order with its number, email and a second factor, and the limits that protect it.
Guests can ask "where is my order?" and give the order number and email. The assistant then shows the status, items and tracking of that one order, as your platform's own guest order tracking would.
Second factor
| Platform | Second factor |
|---|---|
| Shopify | Billing last name (always) |
| Magento 2 | Billing last name or postcode (always) |
| WooCommerce | Billing postcode, when Require second factor is on |
| PrestaShop | None (reference and email, as in PrestaShop) |
| Generic | As your order RPC declares |
What guests see
Status, items, totals, shipment and tracking for 30 minutes. Never addresses, phone numbers, payment details or the order status page link. Actions need the stronger email verification.
Protection against guessing
- 5 lookups per 15 minutes per chat session, 20 per hour per network, 200 per hour per store.
- 3 failed attempts for the same order number within an hour lock it for an hour; a locked order always answers "not found".
- A wrong combination never says which field was wrong.
- The typed email is stored only as a keyed hash.
Switch guest lookup off in Orders & actions → Order status.
Last updated on
Identity JWT for Generic stores
Mint a short-lived HS256 identity token on your server for signed-in customers and pass it to the widget, with Python, Node.js and PHP examples.
Email verification
The one-time code that verifies a guest for one order, how long it lasts and how it protects against enumeration.