# Customer and order access

Verify a visitor's order details or store sign-in before showing private commerce information.

*Release 3.3 · admin, developer, visitor*

**Settings › Commerce › Commerce Providers** · **Settings › Commerce › Order Cards**

## What it is

**Customer and order access** checks whether a visitor may see private store information in chat. You can allow verification using order details, store sign-in, or both. Visitor access is off by default.

## Who uses it and why

- Users with the **Settings** or **Developer** role choose how visitors verify access.
- Developers connect the supported store sign-in method and account-change notifications.
- Visitors verify a single order or sign in to ask about their own order history.

## Where to find it

Open **Settings › Commerce › Commerce Providers**, edit a provider and find **Customer and order access**. The **Settings** or **Developer** role provides access, subject to permissions.

Use **Settings › Commerce › Order Cards** with the **Settings** role to set a stronger **Guest order matching** rule for a card configuration.

## How it works

For guest access, the visitor supplies an exact order number and the required email or phone details recorded on that order. Email matching ignores case and surrounding spaces. Phone matching requires a valid full international number, including the country code.

A successful guest check authorises only the matching order. It does not unlock a customer profile or order history. Anyone who knows the required details could qualify; INSIDE does not send a verification code.

Store sign-in verifies the customer with the provider and checks ownership before showing orders. Shopify supports **Online store app proxy** or **Customer Account API**. BigCommerce uses its Current Customer integration. Salesforce B2C Commerce supports order-detail matching only.

An AI assistant can request missing verification details in the conversation. This check does not replace the visitor's signed-in identity.

## Configure it

1. Edit the provider and enable **Allow visitors to access their orders**.
2. Choose **Verify access using** and, for guest access, **Required order details**.
3. For store sign-in, complete the integration fields shown for your provider. BigCommerce requires an app-level account capable of verifying the current customer.
4. Save and check both an authorised order and an order belonging to someone else.

Developers must call and await `insideCommerceIdentityChanged()` on logout or account switching before exposing the next account. This revokes live access and locks protected cards.

### Settings

| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Allow visitors to access their orders | Settings › Commerce › Commerce Providers › Customer and order access | website | Off | Settings role, Developer role | Enables supported visitor verification methods for this provider. |
| Verify access using | Settings › Commerce › Commerce Providers › Customer and order access | website | Order details in the editor; access remains off until enabled | Settings role, Developer role | Chooses Order details, Store sign-in, or Store sign-in with order details as a fallback. |
| Required order details | Settings › Commerce › Commerce Providers › Customer and order access | website | Order number + email or phone | Settings role, Developer role | Requires the order number with a matching email, phone, or both; unlocks only that order. |
| Shopify sign-in integration | Settings › Commerce › Commerce Providers › Customer and order access | website | Online store app proxy for a new configuration | Settings role, Developer role | Chooses Online store app proxy or Customer Account API for Shopify customer verification. |
| App proxy URL | Settings › Commerce › Commerce Providers › Customer and order access | website | Not set | Settings role, Developer role | Sets the public customer identity proxy address for Shopify app-proxy sign-in. This sign-in method needs an address before it can be used. |
| Storefront URL | Settings › Commerce › Commerce Providers › Customer and order access | website | Provider's storefront address in the editor when available; otherwise not set | Settings role, Developer role | Sets the store used for supported customer sign-in methods. Store sign-in needs a valid HTTPS address before it can be enabled. |
| App client ID | Settings › Commerce › Commerce Providers › Customer and order access | website | Not set | Settings role, Developer role | Selects the BigCommerce app used to verify customer sign-in. BigCommerce store sign-in is unavailable until an app client ID and secret are supplied. |
| Customer Account API client ID | Settings › Commerce › Commerce Providers › Customer and order access | website | Not set | Settings role, Developer role | Selects the Shopify Customer Account API application. This sign-in method is unavailable until a client ID is supplied. |
| App client secret | Settings › Commerce › Commerce Providers › Customer and order access | website | Not set | Settings role, Developer role | Supplies the credential for sign-in methods that require it. Those methods are unavailable until a secret is supplied. Leave blank when editing to retain the saved value. |

### Permissions

| Permission | Lets you |
|---|---|
| Settings | Configure commerce access, subject to Settings permissions. |
| AI | Permits commerce administration when the Settings role has restricted permissions. |
| Developer | Access Commerce Providers to configure the integration. |

## Limits and good to know

- Access lasts at most 30 minutes and may expire sooner with the store's sign-in evidence. Repeating the same verification does not extend an existing access period.
- Access is specific to the website, visitor session, conversation and provider. Policy changes invalidate earlier access.
- Guest checks allow five attempts per scoped session, 30 per website and network, and ten per website, provider and order in 15 minutes. Successful checks also count.
- An order-card rule can strengthen the provider's checks, but cannot weaken them.
- An operator's customer match does not verify the visitor for automated disclosure.

## Depends on and works with

### This feature uses

- **Requires** [Starting, ending and expiring chats](CHAT-001.md): Protected visitor access is specific to the current conversation.
- **Requires** [Commerce provider setup and selection](COM-001.md): Visitor access uses an enabled provider with authorisation support.
- **Requires** [Visitor identity](VIS-001.md): Live authorisation belongs to the current visitor session.
- **Configured in** [Roles and permissions](ADM-008.md): Roles control access to provider administration.
- **Configured in** [Order card configuration and access](COM-015.md): The selected order-card configuration can require stronger guest matching.
- **Works better with** [Shopify commerce connection](COM-002.md): Shopify supports guest matching and supported customer sign-in integrations.
- **Works better with** [Salesforce B2C Commerce connection](COM-003.md): Salesforce B2C Commerce supports guest matching, but not storefront sign-in.
- **Works better with** [BigCommerce store connection](COM-004.md): BigCommerce supports guest matching and customer sign-in through an app integration.
- **Works better with** [Custom commerce integrations](COM-006.md): A custom provider can supply supported verification methods.
- **Works better with** [Store order details and history](COM-013.md): Successful verification permits the appropriate order reads.
- **Works better with** [AI commerce functions and access limits](COM-029.md): AI commerce access respects the verified visitor identity.

### Used by

- **Configures** [Order cards in visitor chat](VX-020.md): Visitor order-access settings control fresh protected order lookups without requiring sign-in to reread a shared snapshot.
- **Configures** [Commerce provider setup and selection](COM-001.md): Customer and order access options control visitor verification separately from operator reads.
- **Configures** [Shopify commerce connection](COM-002.md): Visitor order access uses separate order matching or supported Shopify sign-in verification.
- **Configures** [Salesforce B2C Commerce connection](COM-003.md): Visitor order access supports order-detail verification, without store sign-in.
- **Configures** [BigCommerce store connection](COM-004.md): Visitor order matching and Current Customer sign-in require separate access configuration.
- **Configures** [Custom commerce integrations](COM-006.md): Visitor access requires implemented verification and ownership checks as well as the access policy.
- **Configures** [Order card configuration and access](COM-015.md): Automated visitor disclosure requires current order or customer verification.
- **Configures** [AI commerce functions and access limits](COM-029.md): Verified visitor access determines which private customer and order information is available.
- **Enhances** [Store order details and history](COM-013.md): Visitor verification adds access to a shopper's own orders alongside private operator reads.
- **Related** [Store customer matches and orders](COM-010.md): Operator customer matching does not grant the visitor verified access to private store records.

## FAQ and troubleshooting

### Why is order access unavailable?

Check **Allow visitors to access their orders**, the provider's supported methods and the selected order operations. A provider may support operator reads without supporting visitor verification.

### Why do correct details fail?

Use the order number and contacts recorded on the order. Include the country code for a phone number. Attempt limits or expired access can also prevent a check; failure alone does not mean the order does not exist.

### Why can a guest see one order but not their history?

Guest matching authorises one order. History needs verified store sign-in and provider support.

### Why did a card lock after switching accounts?

Live access belongs to the previous customer session. Verify the current account before requesting more order information.