# WooCommerce identity

> How the WooCommerce plugin recognises signed-in customers, and why orders are matched by customer id only.

Source: https://shopassist.coec.dk/docs/orders-and-identity/woocommerce · Updated 2026-10-01

The widget calls `POST /?wc-ajax=shopassist_identity` with the headers `X-ShopAssist: 1` and `X-ShopAssist-Session`. The plugin returns a token for the logged-in WordPress user. The endpoint is a POST with `Cache-Control: no-store`, so page caches don't store it.

You can switch identity sharing off in the plugin settings; signed-in customers are then treated as guests.

> **Account emails are not verified:** WooCommerce doesn't verify the email address a customer registers with. ShopAssist matches orders by customer id only,
> and the token always says `email_verified: false`. Handoffs show the email as unverified.

## Guest lookup [#guest-lookup]

Order number and email, plus the billing postcode when you switch on **Require second factor**.