WooCommerce identity
How the WooCommerce plugin recognises signed-in customers, and why orders are matched by customer id only.
The widget calls POST /?wc-ajax=shopassist_identity with the headers X-ShopAssist: 1 and X-ShopAssist-Session. The plugin returns a token for the logged-in WordPress user. The endpoint is a POST with Cache-Control: no-store, so page caches don't store it.
You can switch identity sharing off in the plugin settings; signed-in customers are then treated as guests.
Account emails are not verified
WooCommerce doesn't verify the email address a customer registers with. ShopAssist matches orders by customer id only,
and the token always says email_verified: false. Handoffs show the email as unverified.
Guest lookup
Order number and email, plus the billing postcode when you switch on Require second factor.
Last updated on