# Magento 2 identity

> How the Magento module recognises signed-in customers safely with full-page cache and Varnish, and the guest lookup factors.

Source: https://shopassist.coec.dk/docs/orders-and-identity/magento-2 · Updated 2026-10-01

The widget calls `POST /shopassist/identity/token` with Magento's form key after the page has loaded. The module returns a token for the signed-in customer, signed with the website's identity secret. Nothing personal is rendered into the cached page, so full-page cache and Varnish are safe.

* **Luma and Breeze:** the widget reads the `shopassist` customer-data section to know when a customer signs in or out.
* **Hyvä:** it listens for Hyvä's `private-content-loaded` event.

Orders are shown only for the connected website. With customer accounts shared across websites, a customer of another website sees no orders from it.

## Guest lookup [#guest-lookup]

On Magento, guest lookup always needs a second factor (billing last name or postcode), matching Magento's own order tracking.

## Troubleshooting [#troubleshooting]

Without a form key (some headless or heavily customized themes), the identity call is skipped and customers are treated as guests. See [signed-in customers](/docs/troubleshooting/signed-in-customers).