Orders and identity
The four identity levels, what each unlocks, how signed-in customers are recognised on each platform, and how guests verify an order.
The assistant only shows order data to someone who has proven they may see it. ShopAssist never stores orders; it reads them live from your platform for the verified shopper.
Identity levels
| Level | Reached by | Unlocks |
|---|---|---|
guest | Everyone | Products, stock, store hours, policies, cart |
order_lookup | Order number + email (+ a second factor on some platforms) | Read-only status, items and tracking of that one order, for 30 minutes |
order_otp | A 6-digit code sent to the order's email | That order, plus guest actions you allow (cancellation, return request) |
customer | Signed in on your store | The customer's orders and the actions you enable |
Guests never see addresses, phone numbers or payment details. Order status pages are linked only for signed-in customers.
Signed-in customers per platform
- Shopify: shopify_app_proxy
- Magento 2 / Adobe Commerce: plugin_endpoint
- WooCommerce: plugin_endpoint
- PrestaShop: plugin_endpoint
- Any store (Generic: script tag, Push API, feeds): Your server mints a token — Needs identity tokens minted by the merchant's server
| Platform | How | Guide |
|---|---|---|
| Shopify | Shopify App Proxy, automatic | Shopify |
| Magento 2 | Module identity endpoint, automatic | Magento 2 |
| WooCommerce | Plugin identity endpoint, automatic | WooCommerce |
| PrestaShop | Module identity controller, automatic | PrestaShop |
| Generic | Your server mints a token | Identity JWT |
In every case the platform (or your server) signs a short-lived token with the store's identity secret, bound to the shopper's chat session. Tokens are never stored on the device or in your page HTML.
A conversation belongs to its customer
Once a conversation has shown a customer's orders, it can only be continued by the same signed-in customer. If someone else signs in on the same device, or the customer signs out, the widget starts a fresh conversation. This protects shared devices.
Settings
Orders & actions → Order status switches order answers, guest lookup, the second factor and email verification on or off. See guest order lookup and email verification.
Last updated on
Bot protection
How ShopAssist detects scripted traffic, proof-of-work and Cloudflare Turnstile challenges, and the daily cost guard that protects your AI budget.
Shopify identity
How signed-in Shopify customers are recognised through the App Proxy, the popup fallback, and the 60-day order history limit.