Signed-in customers

When the assistant does not recognize a signed-in customer, it falls back to guest order lookup or an email code. Check the following.

Test itCopy Anchor Link

Sign in to your storefront as a test customer, open the chat and ask "What are my recent orders?". The assistant should list orders without asking for an order number. In the playground you can simulate a signed-in customer.

ShopifyCopy Anchor Link

• Identity uses Shopify's App Proxy. Check that the app is installed and the app embed is on.
• With new customer accounts, Shopify does not always share the sign-in with apps on the storefront. The widget then offers a sign-in popup or an email code. This is a known Shopify limitation.
• Headless storefronts (Hydrogen) need the Generic identity JWT.

Magento 2Copy Anchor Link

The module endpoint must be reachable and must not be cached. If you use Varnish or a CDN, make sure /shopassist/ routes bypass the full-page cache (the module marks them uncacheable). Check that the store is connected at the right website scope.

WooCommerceCopy Anchor Link

The plugin uses a WC-AJAX endpoint. Caching plugins must not cache it (exclude ?wc-ajax=shopassist_identity). WooCommerce does not verify customer emails, so orders are matched by customer id only.

PrestaShopCopy Anchor Link

The module front controller must be reachable. In multistore setups, check that the customer belongs to the shop connected to ShopAssist.

GenericCopy Anchor Link

• Your endpoint must be POST, send Cache-Control: no-store and return { "token": null } for guests.
• Tokens must be signed with the decoded identity secret (base64), with iss = generic:<store id>, aud = shopassist, sid = the widget session id passed to your callback, and expire within 5 minutes.
• A 401 identity_invalid in the browser console carries a details.reason (signature, issuer, audience, session_mismatch, expired, …) that tells you which claim is wrong.
• After rotating the identity secret, deploy the new secret and kid.