Magento 2 identity
How the Magento module recognises signed-in customers safely with full-page cache and Varnish, and the guest lookup factors.
The widget calls POST /shopassist/identity/token with Magento's form key after the page has loaded. The module returns a token for the signed-in customer, signed with the website's identity secret. Nothing personal is rendered into the cached page, so full-page cache and Varnish are safe.
- Luma and Breeze: the widget reads the
shopassistcustomer-data section to know when a customer signs in or out. - Hyvä: it listens for Hyvä's
private-content-loadedevent.
Orders are shown only for the connected website. With customer accounts shared across websites, a customer of another website sees no orders from it.
Guest lookup
On Magento, guest lookup always needs a second factor (billing last name or postcode), matching Magento's own order tracking.
Troubleshooting
Without a form key (some headless or heavily customized themes), the identity call is skipped and customers are treated as guests. See signed-in customers.
Last updated on