Authentication without leaking secrets
Cartly separates storefront resolution, cart secrets, and shopper sessions so your browser never needs to hold a privileged token.
Storefront context
The host header is the public identity of a store. Cartly resolves it server-side and rejects unknown or unpublished storefronts.
Requiredcopy
X-Storefront-Host: shop.example.comCustomer sessions
Register and login return a customer session token. Store it in an HttpOnly, secure cookie on your storefront server, then forward it as X-Customer-Token for account operations.
Security rules
- Never expose cart or customer tokens to client-side JavaScript.
- Use HTTPS in every deployed environment.
- Use the same idempotency key when retrying a checkout.
- Return only the fields your page needs from your server route.