Buyer accounts
Email-code sign-in, orders, keys, downloads, subscriptions and the wallet from your own site.
Buyers sign in with a code sent to their email: no passwords to store, and the account is created on the first sign-in. Everything they bought in your store, under that email, is there.
Sign in
await shop.customer.requestCode(email); // emails a 6-digit code
const { token, expiresAt, account } = await shop.customer.signIn(email, code);
const buyer = shop.withCustomer(token); // a client bound to this buyer
const { orders } = await buyer.customer.orders();Keep token in an httpOnly cookie on your server (never in localStorage) and send it on every call for that buyer
(the SDK’s withCustomer does that):
curl https://api.shopfa.st/v1/shops/your-store/customer \
-H "ShopFast-Storefront-Key: sfsk_live_…" \
-H "ShopFast-Customer-Token: <token>"Sessions last 30 days, and end after 7 days without use. DELETE /customer/session signs the buyer out. Codes are
limited per email and address, like on your store.
What a buyer can see and do
| Operation | |
|---|---|
GET /customer |
Name, email, country and store credit |
GET /customer/orders |
Every order placed with their email |
GET /customer/library |
License keys, downloads with fresh signed links, and subscriptions |
POST /customer/subscriptions/{id}/cancel |
Cancel at the end of the period |
GET /customer/wallet |
Store credit, gift cards and coupons |
GET /support/tickets |
Their support tickets; reply with POST /support/tickets/{id}/messages |
Orders without an account
Every order has an access token, in the receipt link (/orders/cs_…?access=…) and in the answer of
POST /carts/{id}/checkout. GET /orders/{sessionId}?access=… shows the order, and once
paid, its keys and downloads.
Support tickets
Anyone can open a ticket with POST /support/tickets. A signed-in buyer’s ticket is linked to their account; a guest
gets an access link by email.