# Orders and identity

> The four identity levels, what each unlocks, how signed-in customers are recognised on each platform, and how guests verify an order.

Source: https://shopassist.coec.dk/docs/orders-and-identity/overview · Updated 2026-10-01

The assistant only shows order data to someone who has proven they may see it. ShopAssist never stores orders; it reads them live from your platform for the verified shopper.

## Identity levels [#levels]

| Level          | Reached by                                                 | Unlocks                                                                 |
| -------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------- |
| `guest`        | Everyone                                                   | Products, stock, store hours, policies, cart                            |
| `order_lookup` | Order number + email (+ a second factor on some platforms) | Read-only status, items and tracking of that one order, for 30 minutes  |
| `order_otp`    | A 6-digit code sent to the order's email                   | That order, plus guest actions you allow (cancellation, return request) |
| `customer`     | Signed in on your store                                    | The customer's orders and the actions you enable                        |

Guests never see addresses, phone numbers or payment details. Order status pages are linked only for signed-in customers.

## Signed-in customers per platform [#platforms]

- **Shopify:** shopify_app_proxy
- **Magento 2 / Adobe Commerce:** plugin_endpoint
- **WooCommerce:** plugin_endpoint
- **PrestaShop:** plugin_endpoint
- **Any store (Generic: script tag, Push API, feeds):** Your server mints a token — Needs identity tokens minted by the merchant's server

| Platform    | How                                   | Guide                                                          |
| ----------- | ------------------------------------- | -------------------------------------------------------------- |
| Shopify     | Shopify App Proxy, automatic          | [Shopify](/docs/orders-and-identity/shopify)                   |
| Magento 2   | Module identity endpoint, automatic   | [Magento 2](/docs/orders-and-identity/magento-2)               |
| WooCommerce | Plugin identity endpoint, automatic   | [WooCommerce](/docs/orders-and-identity/woocommerce)           |
| PrestaShop  | Module identity controller, automatic | [PrestaShop](/docs/orders-and-identity/prestashop)             |
| Generic     | Your server mints a token             | [Identity JWT](/docs/orders-and-identity/generic-identity-jwt) |

In every case the platform (or your server) signs a short-lived token with the store's identity secret, bound to the shopper's chat session. Tokens are never stored on the device or in your page HTML.

## A conversation belongs to its customer [#binding]

Once a conversation has shown a customer's orders, it can only be continued by the same signed-in customer. If someone else signs in on the same device, or the customer signs out, the widget starts a fresh conversation. This protects shared devices.

## Settings [#settings]

**Orders & actions → Order status** switches order answers, guest lookup, the second factor and email verification on or off. See [guest order lookup](/docs/orders-and-identity/guest-order-lookup) and [email verification](/docs/orders-and-identity/email-verification).