Customer and order access
Verify a visitor's order details or store sign-in before showing private commerce information.
What it is
Customer and order access checks whether a visitor may see private store information in chat. You can allow verification using order details, store sign-in, or both. Visitor access is off by default.
Who uses it and why
- Users with the Settings or Developer role choose how visitors verify access.
- Developers connect the supported store sign-in method and account-change notifications.
- Visitors verify a single order or sign in to ask about their own order history.
Where to find it
Open Settings › Commerce › Commerce Providers, edit a provider and find Customer and order access. The Settings or Developer role provides access, subject to permissions.
Use Settings › Commerce › Order Cards with the Settings role to set a stronger Guest order matching rule for a card configuration.
How it works
For guest access, the visitor supplies an exact order number and the required email or phone details recorded on that order. Email matching ignores case and surrounding spaces. Phone matching requires a valid full international number, including the country code.
A successful guest check authorises only the matching order. It does not unlock a customer profile or order history. Anyone who knows the required details could qualify; INSIDE does not send a verification code.
Store sign-in verifies the customer with the provider and checks ownership before showing orders. Shopify supports Online store app proxy or Customer Account API. BigCommerce uses its Current Customer integration. Salesforce B2C Commerce supports order-detail matching only.
An AI assistant can request missing verification details in the conversation. This check does not replace the visitor's signed-in identity.
Configure it
- Edit the provider and enable Allow visitors to access their orders.
- Choose Verify access using and, for guest access, Required order details.
- For store sign-in, complete the integration fields shown for your provider. BigCommerce requires an app-level account capable of verifying the current customer.
- Save and check both an authorised order and an order belonging to someone else.
Developers must call and await insideCommerceIdentityChanged() on logout or account switching before exposing the next account. This revokes live access and locks protected cards.
Settings
| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Allow visitors to access their orders | Settings › Commerce › Commerce Providers › Customer and order access | website | Off | Settings role, Developer role | Enables supported visitor verification methods for this provider. |
| Verify access using | Settings › Commerce › Commerce Providers › Customer and order access | website | Order details in the editor; access remains off until enabled | Settings role, Developer role | Chooses Order details, Store sign-in, or Store sign-in with order details as a fallback. |
| Required order details | Settings › Commerce › Commerce Providers › Customer and order access | website | Order number + email or phone | Settings role, Developer role | Requires the order number with a matching email, phone, or both; unlocks only that order. |
| Shopify sign-in integration | Settings › Commerce › Commerce Providers › Customer and order access | website | Online store app proxy for a new configuration | Settings role, Developer role | Chooses Online store app proxy or Customer Account API for Shopify customer verification. |
| App proxy URL | Settings › Commerce › Commerce Providers › Customer and order access | website | Not set | Settings role, Developer role | Sets the public customer identity proxy address for Shopify app-proxy sign-in. This sign-in method needs an address before it can be used. |
| Storefront URL | Settings › Commerce › Commerce Providers › Customer and order access | website | Provider's storefront address in the editor when available; otherwise not set | Settings role, Developer role | Sets the store used for supported customer sign-in methods. Store sign-in needs a valid HTTPS address before it can be enabled. |
| App client ID | Settings › Commerce › Commerce Providers › Customer and order access | website | Not set | Settings role, Developer role | Selects the BigCommerce app used to verify customer sign-in. BigCommerce store sign-in is unavailable until an app client ID and secret are supplied. |
| Customer Account API client ID | Settings › Commerce › Commerce Providers › Customer and order access | website | Not set | Settings role, Developer role | Selects the Shopify Customer Account API application. This sign-in method is unavailable until a client ID is supplied. |
| App client secret | Settings › Commerce › Commerce Providers › Customer and order access | website | Not set | Settings role, Developer role | Supplies the credential for sign-in methods that require it. Those methods are unavailable until a secret is supplied. Leave blank when editing to retain the saved value. |
Permissions
| Permission | Lets you |
|---|---|
| Settings | Configure commerce access, subject to Settings permissions. |
| AI | Permits commerce administration when the Settings role has restricted permissions. |
| Developer | Access Commerce Providers to configure the integration. |
Limits and good to know
- Access lasts at most 30 minutes and may expire sooner with the store's sign-in evidence. Repeating the same verification does not extend an existing access period.
- Access is specific to the website, visitor session, conversation and provider. Policy changes invalidate earlier access.
- Guest checks allow five attempts per scoped session, 30 per website and network, and ten per website, provider and order in 15 minutes. Successful checks also count.
- An order-card rule can strengthen the provider's checks, but cannot weaken them.
- An operator's customer match does not verify the visitor for automated disclosure.
Depends on and works with
+3 more · this feature uses
- Order card configuration and accessConfigured by
The selected order-card configuration can require stronger guest matching.
- AI commerce functions and access limitsEnhances
AI commerce access respects the verified visitor identity.
- Visitor identityRequires
Live authorisation belongs to the current visitor session.
+2 more · used by
- Order card configuration and accessConfigured by
Automated visitor disclosure requires current order or customer verification.
- AI commerce functions and access limitsConfigured by
Verified visitor access determines which private customer and order information is available.
View all connections as a list
This feature uses
- Roles and permissionsConfigured by
Roles control access to provider administration.
- Starting, ending and expiring chatsRequires
Protected visitor access is specific to the current conversation.
- Commerce provider setup and selectionRequires
Visitor access uses an enabled provider with authorisation support.
- Shopify commerce connectionEnhances
Shopify supports guest matching and supported customer sign-in integrations.
- Salesforce B2C Commerce connectionEnhances
Salesforce B2C Commerce supports guest matching, but not storefront sign-in.
- BigCommerce store connectionEnhances
BigCommerce supports guest matching and customer sign-in through an app integration.
- Custom commerce integrationsEnhances
A custom provider can supply supported verification methods.
- Store order details and historyEnhances
Successful verification permits the appropriate order reads.
- Order card configuration and accessConfigured by
The selected order-card configuration can require stronger guest matching.
- AI commerce functions and access limitsEnhances
AI commerce access respects the verified visitor identity.
- Visitor identityRequires
Live authorisation belongs to the current visitor session.
Used by
- Order cards in visitor chatConfigured by
Visitor order-access settings control fresh protected order lookups without requiring sign-in to reread a shared snapshot.
- Commerce provider setup and selectionConfigured by
Customer and order access options control visitor verification separately from operator reads.
- Shopify commerce connectionConfigured by
Visitor order access uses separate order matching or supported Shopify sign-in verification.
- Salesforce B2C Commerce connectionConfigured by
Visitor order access supports order-detail verification, without store sign-in.
- BigCommerce store connectionConfigured by
Visitor order matching and Current Customer sign-in require separate access configuration.
- Custom commerce integrationsConfigured by
Visitor access requires implemented verification and ownership checks as well as the access policy.
- Store customer matches and ordersRelated
Operator customer matching does not grant the visitor verified access to private store records.
- Store order details and historyEnhances
Visitor verification adds access to a shopper's own orders alongside private operator reads.
- Order card configuration and accessConfigured by
Automated visitor disclosure requires current order or customer verification.
- AI commerce functions and access limitsConfigured by
Verified visitor access determines which private customer and order information is available.
FAQ and troubleshooting
Why is order access unavailable?
Check Allow visitors to access their orders, the provider's supported methods and the selected order operations. A provider may support operator reads without supporting visitor verification.
Why do correct details fail?
Use the order number and contacts recorded on the order. Include the country code for a phone number. Attempt limits or expired access can also prevent a check; failure alone does not mean the order does not exist.
Why can a guest see one order but not their history?
Guest matching authorises one order. History needs verified store sign-in and provider support.
Why did a card lock after switching accounts?
Live access belongs to the previous customer session. Verify the current account before requesting more order information.