# Buyer accounts

> Email-code sign-in, orders, keys, downloads, subscriptions and the wallet from your own site.

Source: https://shopfa.st/docs/headless/accounts

Buyers sign in with a code sent to their email: no passwords to store, and the account is created on the first
sign-in. Everything they bought in your store, under that email, is there.

## Sign in

```ts
await shop.customer.requestCode(email);                           // emails a 6-digit code
const { token, expiresAt, account } = await shop.customer.signIn(email, code);
const buyer = shop.withCustomer(token);                           // a client bound to this buyer
const { orders } = await buyer.customer.orders();
```

Keep `token` in an httpOnly cookie on your server (never in localStorage) and send it on every call for that buyer
(the SDK's `withCustomer` does that):

```sh
curl https://api.shopfa.st/v1/shops/your-store/customer \
  -H "ShopFast-Storefront-Key: sfsk_live_…" \
  -H "ShopFast-Customer-Token: <token>"
```

Sessions last 30 days, and end after 7 days without use. `DELETE /customer/session` signs the buyer out. Codes are
limited per email and address, like on your store.

## What a buyer can see and do

| Operation | |
| --- | --- |
| `GET /customer` | Name, email, country and store credit |
| `GET /customer/orders` | Every order placed with their email |
| `GET /customer/library` | License keys, downloads with fresh signed links, and subscriptions |
| `POST /customer/subscriptions/{id}/cancel` | Cancel at the end of the period |
| `GET /customer/wallet` | Store credit, gift cards and coupons |
| `GET /support/tickets` | Their support tickets; reply with `POST /support/tickets/{id}/messages` |

## Orders without an account

Every order has an access token, in the receipt link (`/orders/cs_…?access=…`) and in the answer of
[`POST /carts/{id}/checkout`](https://shopfa.st/docs/headless/checkout). `GET /orders/{sessionId}?access=…` shows the order, and once
paid, its keys and downloads.

## Support tickets

Anyone can open a ticket with `POST /support/tickets`. A signed-in buyer's ticket is linked to their account; a guest
gets an access link by email.