# Signed-in customers

> Fix problems with recognizing signed-in customers in the chat, per platform.

Source: https://shopassist.coec.dk/docs/troubleshooting/signed-in-customers · Updated 2026-10-01

When the assistant does not recognize a signed-in customer, it falls back to guest order lookup or an email code. Check the following.

## Test it [#test]

Sign in to your storefront as a test customer, open the chat and ask "What are my recent orders?". The assistant should list orders without asking for an order number. In the playground you can [simulate a signed-in customer](/docs/assistant/playground).

## Shopify [#shopify]

* Identity uses Shopify's App Proxy. Check that the app is installed and the app embed is on.
* With **new customer accounts**, Shopify does not always share the sign-in with apps on the storefront. The widget then offers a sign-in popup or an email code. This is a known Shopify limitation.
* Headless storefronts (Hydrogen) need the [Generic identity JWT](/docs/orders-and-identity/generic-identity-jwt).

## Magento 2 [#magento-2]

The module endpoint must be reachable and must not be cached. If you use Varnish or a CDN, make sure `/shopassist/` routes bypass the full-page cache (the module marks them uncacheable). Check that the store is connected at the right website scope.

## WooCommerce [#woocommerce]

The plugin uses a WC-AJAX endpoint. Caching plugins must not cache it (exclude `?wc-ajax=shopassist_identity`). WooCommerce does not verify customer emails, so orders are matched by customer id only.

## PrestaShop [#prestashop]

The module front controller must be reachable. In multistore setups, check that the customer belongs to the shop connected to ShopAssist.

## Generic [#generic]

* Your endpoint must be `POST`, send `Cache-Control: no-store` and return `{ "token": null }` for guests.
* Tokens must be signed with the decoded identity secret (base64), with `iss = generic:<store id>`, `aud = shopassist`, `sid` = the widget session id passed to your callback, and expire within 5 minutes.
* A `401 identity_invalid` in the browser console carries a `details.reason` (`signature`, `issuer`, `audience`, `session_mismatch`, `expired`, …) that tells you which claim is wrong.
* After [rotating the identity secret](/docs/orders-and-identity/identity-secret-rotation), deploy the new secret and `kid`.